1. Overview
arping is a tool for probing hosts in a network. Unlike the ping command, which operates at the network layer, arping operates at the data link layer and uses the Address Resolution Protocol (ARP). Using it involves sending ARP requests to a destination host and waiting for ARP replies.
In this tutorial, we’ll examine how to use arping. While there are different implementations in different Linux distros, the one we’ll examine is from the iputils package.
2. Example Setup
We’ll examine arping using two hosts – the local host and a destination host. The local host’s IP address is 192.39.59.16, and the destination host’s IP address is 192.39.59.17. The local host has only one network interface, eth0.
We must be the root user in order to use arping.
3. Basic Usage of arping
Let’s begin by probing the destination host using arping without any options:
$ arping 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.754ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.668ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.676ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.672ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.663ms
^CSent 5 probes (1 broadcast(s))
Received 5 response(s)
The result of pinging the destination host seems to be successful. The first line of the output shows that we’ll be sending ARP requests to the destination IP address 192.39.59.17 using the source IP address 192.39.59.16. eth0 is the name of the network interface. arping will use this network device to send ARP requests.
We let arping send five ARP requests and then canceled it with Control+C. If we don’t specify any options, arping sends ARP requests forever.
As we see from the output, we received ARP replies to all of the ARP requests. [00:50:56:B2:AB:CD] is the MAC address of the destination host. The time duration in milliseconds at the end of each line is the time elapsed between each ARP request and reply.
Normally, arping sends a broadcast message first. If it receives an ARP reply, it switches to unicast. We observed this behavior in the line Sent 5 probes (1 broadcast(s)). However, all of the ARP replies from the destination host are in unicast, as the output lines containing the Unicast reply from statements indicate.
Alternatively, we can pass the destination hostname instead of the destination IP address.
4. Sending a Specific Number of ARP Requests
As we’ve already seen, if we only supply the destination to arping, it’ll send ARP requests to the destination forever. However, we can pass the desired number of ARP requests with the -c option:
$ arping –c 2 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.765ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.676ms
Sent 2 probes (1 broadcast(s))
Received 2 response(s)
Here, after the second request, arping terminated automatically. So we didn’t have to terminate it using Control+C.
5. Stopping ARP Requests After the First Reply
Using the -f option, we can tell arping to stop sending ARP requests as soon as it receives the first reply from the destination:
$ arping –f 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.663ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
6. Stopping ARP Requests After a Time Duration
It’s also possible for arping to stop sending ARP requests after a specific time duration by using the –w option:
$ date; arping –w 5 192.39.59.17; date
Tue May 24 16:44:17 +03 2022
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.674ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.682ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.653ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.661ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.652ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.657ms
Sent 6 probes (1 broadcast(s))
Received 6 response(s)
Tue May 24 16:44:23 +03 2022
Here, we passed -w 5 to arping. This tells arping to send ARP requests for a period of five seconds.
We ran two date commands immediately before and after arping to measure the execution time of arping. As we see from the output, arping sent six ARP requests in an approximate period of five seconds.
What if we use the –c and –w options at the same time? In that case, arping continues pinging either until the duration specified by the –w option expires or until the number of requests specified by the –c option is sent:
$ date; arping –w 5 –c 15 192.39.59.17; date
Tue May 24 17:26:55 +03 2022
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.660ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.616ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.616ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.636ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.638ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.632ms
Sent 6 probes (1 broadcast(s))
Received 6 response(s)
Tue May 24 17:27:01 +03 2022
Here, we passed the –w 5 –c 15 options to arping. arping stopped pinging after about five seconds because the time duration of five seconds was shorter than the time duration for sending 15 ARP requests.
Now, let’s run arping using a longer time duration:
$ date; arping –w 15 –c 5 192.39.59.17; date
Tue May 24 17:27:30 +03 2022
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.719ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.625ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.665ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.656ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.626ms
Sent 5 probes (1 broadcast(s))
Received 5 response(s)
Tue May 24 17:27:35 +03 2022
The time duration of 15 seconds was longer than the time duration for sending five ARP requests. So arping stopped pinging after sending five ARP requests.
7. Specifying the Network Interface
If the local host has more than one network interface, we must explicitly specify the interface using the –I option. Otherwise, arping gives an error:
$ arping –f 192.39.59.17
arping: Suitable device could not be determined. Please, use option –I.
Here, we ran arping on a host that has more than one network interface. So, we must explicitly specify the interface that we want to use for ARP requests:
$ arping –f –I ens192 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.18 ens192
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.626ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
We specified the interface using the –I ens192 option. This time, we were successful in sending the ARP request.
8. Sending Only MAC Level Broadcasts
Normally, arping first sends the ARP request as a MAC broadcast. However, it switches to unicast when it receives a reply to the broadcasted ARP request. It starts to send the following ARP requests only to the destination host.
Using the -b option, it’s possible to change this behavior and send only broadcasts:
$ arping -b –c 2 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.773ms
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.825ms
Sent 2 probes (2 broadcast(s))
Received 2 response(s)
As it’s apparent from the output line, Sent 2 probes (2 broadcast(s)), arping broadcast both of the ARP requests.
9. Running in the Unsolicited ARP Mode
We can use the -U option to run arping in unsolicited ARP mode.
Unsolicited ARP is also called gratuitous ARP. Unsolicited ARP updates the ARP tables of the neighboring hosts before the neighboring hosts ask for it.
This might be useful, for example, when there is an update in the MAC or IP address of the local host because of a failover. Unsolicited ARP propagates this change to other hosts. No ARP reply is expected in this case.
Let’s use arping with the -U option to update the ARP table of the destination host:
$ arping –U -c 1 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.17 eth0
Sent 1 probes (1 broadcast(s))
Received 0 response(s)
As a result of the above command execution, if there’s no entry for the local host in the ARP table of the destination host, then it’s added. If there’s already an entry in the ARP table, it’s updated.
The last line of the output, Received 0 response(s), shows that we didn’t get an ARP reply as expected. In addition to this, arping set the source IP address to the destination IP address as we see in the first line of the output, ARPING 192.39.59.17 from 192.39.59.17 eth0.
By default, the creation of new entries in the ARP table using unsolicited ARP updates isn’t allowed. So, we must set the arp_accept kernel parameter in the destination host to 1 using the sysctl command. It’s equal to 0 by default:
$ sysctl net.ipv4.conf.all.arp_accept # Unsolicited ARP isn’t allowed
net.ipv4.conf.all.arp_accept = 0
$ sysctl -w net.ipv4.conf.all.arp_accept=1 # Now, unsolicited ARP is allowed
net.ipv4.conf.all.arp_accept = 1
10. Sending Only ARP Replies
Using arping with the -A option also updates the ARP table of the destination host. However, it doesn’t use unsolicited ARP but uses ARP reply as if an ARP request were made:
$ arping –A -c 1 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.17 eth0
Sent 1 probes (1 broadcast(s))
Received 0 response(s)
Since arping sends an ARP reply, in this case, we don’t get any responses. We observed this behavior in the last line of the output, Received 0 response(s). arping set the source IP address to the destination IP address as it did with the –U option.
11. Specifying the Source IP Address
arping assigns the source IP address in ARP packets automatically. However, it’s also possible to set it manually using the –s option.
First, let’s try to ping the destination 192.39.59.17 without using the –s option:
$ arping –c 1 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.16 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.697ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
As we see in the first line of the output, the term from 192.39.59.16 indicates that arping uses 192.39.59.16 as the source IP address. This is the IP address of the local host.
Now, let’s try to ping the destination 192.39.59.17 using the –s option:
$ arping –c 1 –s 192.39.59.20 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.20 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.697ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
Here, we set the source IP address to 192.39.59.20 using –s 192.39.59.20. The term from 192.39.59.20 in the first line of the output shows that arping actually used the specified source address.
In order to be able to set the source IP address with the –s option, we must be able to bind on addresses that are not local to the machine. Normally, this is disabled. However, we can enable it by setting the net.ipv4.ip_nonlocal_bind kernel parameter to 1:
$ sysctl net.ipv4.ip_nonlocal_bind
net.ipv4.ip_nonlocal_bind = 0
$ arping –c 1 –s 192.39.59.20 192.39.59.17
bind: Cannot assign requested address
$ sysctl –w net.ipv4.ip_nonlocal_bind=1
net.ipv4.ip_nonlocal_bind = 1
$ arping –f –s 192.39.59.20 192.39.59.17
ARPING 192.39.59.17 from 192.39.59.20 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.697ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
As we see, we couldn’t use the specified IP address as the source IP address since the kernel parameter was equal to 0. However, we could use the same IP address as the source IP address when we set the kernel parameter to 1.
12. Running in the Duplicate Address Detection Mode
We pass the -D option to arping to run it in the Duplicate Address Detection (DAD) mode. If another host in the network is using the destination IP address, then arping detects this and returns 1. If there’s no duplicate IP address, it returns 0.
Let’s test the IP address, 192.39.59.17, which is already being used, in DAD mode:
$ arping –D –c 1 192.39.59.17
ARPING 192.39.59.17 from 0.0.0.0 eth0
Unicast reply from 192.39.59.17 [00:50:56:B2:AB:CD] 0.970ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)
$ echo $?
1
Since the IP address 192.39.59.17 is the IP address of the remote host, arping returned 1 as the exit status.
Now, let’s ping an IP address that is not being used using the -D option:
$ arping -D –c 1 192.39.59.20
ARPING 192.39.59.20 from 0.0.0.0 eth0
Sent 1 probes (1 broadcast(s))
Received 0 response(s)
$ echo $?
0
Now, since there is no host with the IP address 192.39.50.20, the exit status of arping was 0.
Using arping in DAD mode sets the source IP address to 0.0.0.0 automatically.
13. Conclusion
In this article, we discussed the arping command. We explained its options and showed how to use them with several examples.