arping command in Linux with Examples

---

Name

arping - send ARP REQUEST to a neighbour host

Synopsis

arping [-AbDfhqUV] [-c count] [-w deadline] [-s source] -I interface destination

Description

Ping destination on device interface by ARP packets, using source address source.

Options

The options for id commands are:

-A    The same as -U, but ARP REPLY packets used instead of ARP REQUEST.

-b    Send only MAC level broadcasts. Normally arping starts from sending broadcast, and switch to unicast after reply received.

-c count
   Stop after sending count ARP REQUEST packets. With deadline option,  arping waits for count ARP REPLY packets, until the timeout expires.  

-D    Duplicate address detection mode (DAD). See RFC2131, 4.4.1.  Returns 0, if DAD succeeded i.e. no replies are received

-f    Finish after the first reply confirming that target is alive.

-I interface
   Name of network device where to send ARP REQUEST packets.

-h    Print help page and exit.

-q    Quiet output. Nothing is displayed.
-s source
IP source address to use in ARP packets. If this option is absent, source address is:

· In DAD mode (with option -D) set to 0.0.0.0.

· In Unsolicited ARP mode (with options -U or -A) set to destination.

· Otherwise, it is calculated from routing tables.

-U    Unsolicited ARP mode to update neighbours' ARP caches. No replies are expected.

-V    Print version of the program and exit.

-w    deadline
Specify a timeout, in seconds, before arping exits regardless of how many packets have been sent or received. In this case arping does not stop after count packet are sent, it waits either for deadline expire or until count probes are answered.

Examples

We can use ip link show command to list all the network interfaces available on a machine.

$ ip link show
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
   link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: enp0s25: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
   link/ether 7c:05:07:10:08:8d brd ff:ff:ff:ff:ff:ff
3: wlx503eaa7c4c9b: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000
   link/ether 50:3e:aa:7c:4c:9b brd ff:ff:ff:ff:ff:ff

We see that output of ifconfig command displays 3 interfaces, namely lo, enp0s25 and wlx503eaa7c4c9b.

1. Without any option or arguments arping command displays the help message.

$ arping
Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
   -f : quit on first reply
   -q : be quiet
   -b : keep broadcasting, don't go unicast
   -D : duplicate address detection mode
   -U : Unsolicited ARP mode, update your neighbours
   -A : ARP answer mode, update your neighbours
   -V : print version and exit
   -c count : how many packets to send
   -w timeout : how long to wait for a reply
   -I device : which ethernet device to use
   -s source : source ip address
   destination : ask for what ip address

2. Command arping is used to check the arp response for a particular host in LAN. By default the request is unicast.

$ arping -I wlx503eaa7c4c9b 192.168.0.1
ARPING 192.168.0.1 from 192.168.0.4 wlx503eaa7c4c9b
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.216ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  2.422ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  2.456ms
...

3. Use -c option to limit the number of arp packets.

$ arping -c 2 -I wlx503eaa7c4c9b 192.168.0.1
ARPING 192.168.0.1 from 192.168.0.4 wlx503eaa7c4c9b
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.245ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  2.423ms
Sent 2 probes (1 broadcast(s))
Received 2 response(s)

4. By default arping starts from sending broadcast, and switch to unicast after reply received. But we can use -b option to send only MAC level broadcasts.

$ arping -c 4 -b -I wlx503eaa7c4c9b 192.168.0.1
ARPING 192.168.0.1 from 192.168.0.4 wlx503eaa7c4c9b
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.246ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.534ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.230ms
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.273ms
Sent 4 probes (4 broadcast(s))
Received 4 response(s)

5. Use -f option to stop sending packets as soon as the first response is received confirming that target is alive.

$ arping -c 4 -b -f -I wlx503eaa7c4c9b 192.168.0.1
ARPING 192.168.0.1 from 192.168.0.4 wlx503eaa7c4c9b
Unicast reply from 192.168.0.1 [74:DA:DA:A0:0B:47]  3.302ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)

You can see in the example abobe, even though the packet count was specified as 4, arping command stopped sending packets after it received the first response.

6. We can use -w count option with number of seconds to specify a timeout, in seconds, before arping exits regardless of how many packets have been sent or received. In this case arping does not stop after count packet are sent, it waits either for deadline expire or until count probes are answered.

$ arping -w 4 -D -I wlx503eaa7c4c9b 192.168.0.4
ARPING 192.168.0.4 from 0.0.0.0 wlx503eaa7c4c9b
Sent 5 probes (5 broadcast(s))
Received 0 response(s)