Arping

Last updated

arping is a computer software tool for discovering and probing hosts on a computer network. Arping probes hosts on the examined network link by sending link layer frames using the Address Resolution Protocol (ARP) request method addressed to a host identified by its MAC address of the network interface. [1] The utility program may use ARP to resolve an IP address provided by the user.

Contents

The function of arping is analogous to the utility ping that probes the network with the Internet Control Message Protocol (ICMP) at the Internet Layer of the Internet Protocol Suite.

Two popular arping implementations exist. One is part of Linux iputils suite, [2] and cannot resolve MAC addresses to IP addresses. The other arping implementation, written by Thomas Habets, [3] can ping hosts by MAC address as well as by IP address, and adds more features. Having both arping implementations on a system may introduce conflicts. Some Linux distros handle this by removing iputils arping along with dependent packages like NetworkManager if Habets's arping is installed. Others (e.g. Debian-based distros like Ubuntu) have iputils-arping split into a separate package to avoid this problem.

In networks employing repeaters that implement proxy ARP, the ARP response may originate from such proxy hosts and not directly from the probed target.

Example

Example session output of arping from iputils:

ARPING 192.168.39.120 from 192.168.39.1 eth0 Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.810ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.607ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.602ms Unicast reply from 192.168.39.120 [00:01:80:38:F7:4C]  0.606ms Sent 4 probes (1 broadcast(s)) Received 4 response(s) 

Example session output from Thomas Habets's arping:

ARPING 192.168.16.96 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=0 time=292.000 usec 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=1 time=310.000 usec 60 bytes from 00:04:5a:4b:b6:ec (192.168.16.96): index=2 time=256.000 usec ^C --- 192.168.16.96 statistics --- 3 packets transmitted, 3 packets received,   0% unanswered (0 extra) 

See also

Related Research Articles

The Dynamic Host Configuration Protocol (DHCP) is a network management protocol used on Internet Protocol (IP) networks for automatically assigning IP addresses and other communication parameters to devices connected to the network using a client–server architecture.

An Internet Protocol address is a numerical label such as 192.0.2.1 that is assigned to a device connected to a computer network that uses the Internet Protocol for communication. IP addresses serve two main functions: network interface identification, and location addressing.

<span class="mw-page-title-main">IPv4</span> Fourth version of the Internet Protocol

Internet Protocol version 4 (IPv4) is the first version of the Internet Protocol (IP) as a standalone specification. It is one of the core protocols of standards-based internetworking methods in the Internet and other packet-switched networks. IPv4 was the first version deployed for production on SATNET in 1982 and on the ARPANET in January 1983. It is still used to route most Internet traffic today, even with the ongoing deployment of Internet Protocol version 6 (IPv6), its successor.

A MAC address is a unique identifier assigned to a network interface controller (NIC) for use as a network address in communications within a network segment. This use is common in most IEEE 802 networking technologies, including Ethernet, Wi-Fi, and Bluetooth. Within the Open Systems Interconnection (OSI) network model, MAC addresses are used in the medium access control protocol sublayer of the data link layer. As typically represented, MAC addresses are recognizable as six groups of two hexadecimal digits, separated by hyphens, colons, or without a separator.

ping (networking utility) Network utility used to test the reachability of a host

ping is a computer network administration software utility used to test the reachability of a host on an Internet Protocol (IP) network. It is available for virtually all operating systems that have networking capability, including most embedded network administration software.

In computing, traceroute and tracert are diagnostic command-line interface commands for displaying possible routes (paths) and transit delays of packets across an Internet Protocol (IP) network.

The Address Resolution Protocol (ARP) is a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address. This mapping is a critical function in the Internet protocol suite. ARP was defined in 1982 by RFC 826, which is Internet Standard STD 37.

<span class="mw-page-title-main">Routing table</span> Data table stored in a router that lists the routes to network destinations

In computer networking, a routing table, or routing information base (RIB), is a data table stored in a router or a network host that lists the routes to particular network destinations, and in some cases, metrics (distances) associated with those routes. The routing table contains information about the topology of the network immediately around it.

Proxy ARP is a technique by which a proxy server on a given network answers the Address Resolution Protocol (ARP) queries for an IP address that is not on that network. The proxy is aware of the location of the traffic's destination and offers its own MAC address as the destination. The traffic directed to the proxy address is then typically routed by the proxy to the intended destination via another interface or via a tunnel.

<span class="mw-page-title-main">Network address translation</span> Technique for making connections between IP address spaces

Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. The technique was initially used to bypass the need to assign a new address to every host when a network was moved, or when the upstream Internet service provider was replaced but could not route the network's address space. It has become a popular and essential tool in conserving global address space in the face of IPv4 address exhaustion. One Internet-routable IP address of a NAT gateway can be used for an entire private network.

A Smurf attack is a distributed denial-of-service attack in which large numbers of Internet Control Message Protocol (ICMP) packets with the intended victim's spoofed source IP are broadcast to a computer network using an IP broadcast address. Most devices on a network will, by default, respond to this by sending a reply to the source IP address. If the number of machines on the network that receive and respond to these packets is very large, the victim's computer will be flooded with traffic. This can slow down the victim's computer to the point where it becomes impossible to work on.

<span class="mw-page-title-main">ARP spoofing</span> Cyberattack which associates the attackers MAC address with the IP address of another host

In computer networking, ARP spoofing is a technique by which an attacker sends (spoofed) Address Resolution Protocol (ARP) messages onto a local area network. Generally, the aim is to associate the attacker's MAC address with the IP address of another host, such as the default gateway, causing any traffic meant for that IP address to be sent to the attacker instead.

ifconfig Network administration utility in Unix-like operating systems

ifconfig is a system administration utility in Unix-like operating systems for network interface configuration.

A default gateway is the node in a computer network using the Internet protocol suite that serves as the forwarding host (router) to other networks when no other route specification matches the destination IP address of a packet.

Multicast DNS (mDNS) is a computer networking protocol that resolves hostnames to IP addresses within small networks that do not include a local name server. It is a zero-configuration service, using essentially the same programming interfaces, packet formats and operating semantics as unicast Domain Name System (DNS). It was designed to work as either a stand-alone protocol or compatible with standard DNS servers. It uses IP multicast User Datagram Protocol (UDP) packets and is implemented by the Apple Bonjour and open-source Avahi software packages, included in most Linux distributions. Although the Windows 10 implementation was limited to discovering networked printers, subsequent releases resolved hostnames as well. mDNS can work in conjunction with DNS Service Discovery (DNS-SD), a companion zero-configuration networking technique specified separately in RFC 6763.

In computer networking, a host model is an option of designing the TCP/IP stack of a networking operating system like Microsoft Windows or Linux. When a unicast packet arrives at a host, IP must determine whether the packet is locally destined. If the IP stack is implemented with a weak host model, it accepts any locally destined packet regardless of the network interface on which the packet was received. If the IP stack is implemented with a strong host model, it only accepts locally destined packets if the destination IP address in the packet matches an IP address assigned to the network interface on which the packet was received.

In computer networking, a link-local address is a network address that is valid only for communications on a local link, i.e. within a subnetwork that a host is connected to. Link-local addresses are typically assigned automatically through a process known as link-local address autoconfiguration, also known as auto-IP, automatic private IP addressing, and stateless address autoconfiguration. While most link-local addresses are unicast, this is not necessarily the case; e.g. IPv6 addresses beginning with ff02:, and IPv4 addresses beginning with 224.0.0. are multicast addresses that are link-local.

Sockstress is a method of attacking servers and other devices that accept TCP connections on the Internet and other TCP-based networks. This method depletes local resources in order to crash a service or an entire machine, essentially functioning as a denial-of-service attack.

route (command) Computer operating system command

In computing, route is a command used to view and manipulate the IP routing table in Unix-like and Microsoft Windows operating systems and also in IBM OS/2 and ReactOS. Manual manipulation of the routing table is characteristic of static routing.

A solicited-node multicast address is an IPv6 multicast address used by the Neighbor Discovery Protocol to determine the link layer address associated with a given IPv6 address, which is also used to check if an address is already being used by the local-link or not, through a process called DAD. The solicited-node multicast addresses are generated from the host's IPv6 unicast or anycast address, and each interface must have a solicited-node multicast address associated with it.

References