This article needs additional citations for verification .(July 2015) |
arping is a software utility for discovering hosts on a computer network by sending link layer frames using Address Resolution Protocol (ARP) requests addressed to a host identified by its MAC address. [1] The utility may use ARP to resolve an IP address provided by the user.
The utility is similar to ping which operates at a higher network layer – probing the network at the Internet Layer via the Internet Control Message Protocol (ICMP).
Two popular variants exist. One is part of Linux iputils suite, [2] and cannot resolve MAC addresses to IP addresses. The other, written by Thomas Habets, [3] can ping hosts by MAC address as well as by IP address, and adds more features.
In networks employing repeaters that implement proxy ARP, the ARP response may originate from such proxy hosts and not directly from the probed target.
Example output from iputils arping:
ARPING 192.168.39.120 from 192.168.39.1 eth0 Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.810ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.607ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.602ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C] 0.606ms Sent 4 probes (1 broadcast(s)) Received 4 response(s)
Example output from Thomas Habets's arping:
ARPING 192.168.16.96 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=0 time=292.000 usec 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=1 time=310.000 usec 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=2 time=256.000 usec ^C --- 192.168.16.96 statistics --- 3 packets transmitted, 3 packets received, 0% unanswered (0 extra)
The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.
An Internet Protocol address is a numerical label such as 192.0.2.1 that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface identification, and location addressing.
The Internet Control Message Protocol (ICMP) is a supporting protocol in the Internet protocol suite. It is used by network devices, including routers, to send error messages and operational information indicating success or failure when communicating with another IP address. For example, an error is indicated when a requested service is not available or that a host or router could not be reached. ICMP differs from transport protocols such as TCP and UDP in that it is not typically used to exchange data between systems, nor is it regularly employed by end-user network applications.
Internet Protocol version 4 (IPv4) is the first version of the Internet Protocol (IP) as a standalone specification. It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. IPv4 was the first version deployed for production on SATNET in 1982 and on the ARPANET in January 1983. It is still used to route most Internet traffic today, even with the ongoing deployment of Internet Protocol version 6 (IPv6), its successor.
A MAC address is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking technologies, including Ethernet, Wi-Fi, and Bluetooth. Within the Open Systems Interconnection (OSI) network model, MAC addresses are used in the medium access control protocol sublayer of the data link layer. As typically represented, MAC addresses are recognizable as six groups of two hexadecimal digits, separated by hyphens, colons, or without a separator.
ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol (IP) network. It is available in a wide range of operating systems – including most embedded network administration software.
In computing, traceroute
and tracert
are diagnostic command-line interface commands for displaying possible routes (paths) and transit delays of packets across an Internet Protocol (IP) network.
The Address Resolution Protocol (ARP) is a communication protocol for discovering the link layer address, such as a MAC address, associated with a internet layer address, typically an IPv4 address. The protocol, part of the Internet protocol suite, was defined in 1982 by RFC 826, which is Internet Standard STD 37.
In computer networking, a routing table, or routing information base (RIB), is a data table stored in a router or a network host that lists the routes to particular network destinations, and in some cases, metrics (distances) associated with those routes. The routing table contains information about the topology of the network immediately around it.
Proxy ARP is a technique by which a proxy server on a given network answers the Address Resolution Protocol (ARP) queries for an IP address that is not on that network. The proxy is aware of the location of the traffic's destination and offers its own MAC address as the destination. The traffic directed to the proxy address is then typically routed by the proxy to the intended destination via another interface or via a tunnel.
Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. The technique was initially used to bypass the need to assign a new address to every host when a network was moved, or when the upstream Internet service provider was replaced but could not route the network's address space. It has become a popular and essential tool in conserving global address space in the face of IPv4 address exhaustion. One Internet-routable IP address of a NAT gateway can be used for an entire private network.
A Smurf attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address. Most devices on a network will, by default, respond to this by sending a reply to the source IP address. If the number of machines on the network that receive and respond to these packets is very large, the victim's computer will be flooded with traffic. This can slow down the victim's computer to the point where it becomes impossible to work on.
Modbus or MODBUS is a client/server data communications protocol in the application layer. It was originally designed for use with programmable logic controllers (PLCs), but has become a de facto standard communication protocol for communication between industrial electronic devices in a wide range of buses and networks.
ifconfig is a system administration utility in Unix-like operating systems for network interface configuration.
A default gateway is the node in a computer network using the Internet protocol suite that serves as the forwarding host (router) to other networks when no other route specification matches the destination IP address of a packet.
Multicast DNS (mDNS) is a computer networking protocol that resolves hostnames to IP addresses within small networks that do not include a local name server. It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as unicast Domain Name System (DNS). It was designed to work as either a stand-alone protocol or compatible with standard DNS servers. It uses IP multicast User Datagram Protocol (UDP) packets and is implemented by the Apple Bonjour and open-source Avahi software packages, included in most Linux distributions. Although the Windows 10 implementation was limited to discovering networked printers, subsequent releases resolved hostnames as well. mDNS can work in conjunction with DNS Service Discovery (DNS-SD), a companion zero-configuration networking technique specified separately in RFC 6763.
Cisco HDLC (cHDLC) is an extension to the High-Level Data Link Control (HDLC) network protocol, and was created by Cisco Systems, Inc. HDLC is a bit-oriented synchronous data link layer protocol that was originally developed by the International Organization for Standardization (ISO). Often described as being a proprietary extension, the details of cHDLC have been widely distributed and the protocol has been implemented by many network equipment vendors. cHDLC extends HDLC with multi-protocol support.
In computer networking, a link-local address is a network address that is valid only for communications on a local link, i.e. within a subnetwork that a host is connected to. Link-local addresses are typically assigned automatically through a process known as link-local address autoconfiguration, also known as auto-IP, automatic private IP addressing, and stateless address autoconfiguration. While most link-local addresses are unicast, this is not necessarily the case; e.g. IPv6 addresses beginning with ff02:, and IPv4 addresses beginning with 224.0.0. are multicast addresses that are link-local.
Sockstress is a method of attacking servers and other devices that accept TCP connections on the Internet and other TCP-based networks. This method depletes local resources in order to crash a service or an entire machine, essentially functioning as a denial-of-service attack.
A solicited-node multicast address is an IPv6 multicast address used by the Neighbor Discovery Protocol to determine the link layer address associated with a given IPv6 address, which is also used to check if an address is already being used by the local-link or not, through a process called DAD. The solicited-node multicast addresses are generated from the host's IPv6 unicast or anycast address, and each interface must have a solicited-node multicast address associated with it.