natjohan's blog

Posted dim. 10 mars 2013

Tip of the week 12

Detect IP address conflicts with the arping command

If you're working in large network environment and you have some ip conflicts, you can use arping command under Linux. This command sends arp requests on the Ethernet layer and is a part of iputils package (so arping is available on many distros)

Usage

arping usage is very easy :

natjohan$ arping
        Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
          -f : quit on first reply
          -q : be quiet
          -b : keep broadcasting, don't go unicast
          -D : duplicate address detection mode
          -U : Unsolicited ARP mode, update your neighbours
          -A : ARP answer mode, update your neighbours
          -V : print version and exit
          -c count : how many packets to send
          -w timeout : how long to wait for a reply
          -I device : which ethernet device to use
          -s source : source ip address
          destination : ask for what ip address
natjohan$ arping  -I wlan0 192.168.1.15
        ARPING 192.168.1.15 from 192.168.1.17 wlan0
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  166.580ms
        Unicast reply from 192.168.1.15 [00:16:44:12:91:86]  167.651ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  171.751ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  89.035ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  112.753ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  32.680ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  56.519ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  81.120ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  104.755ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  34.628ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  51.382ms
        Unicast reply from 192.168.1.15 [5C:0A:5B:26:72:82]  75.083ms
        ^CSent 11 probes (1 broadcast(s))
        Received 12 response(s)

The main options are : -I to define on which interface you want to send arp requests and the IP address you want to test, in the example above you can see that two MAC have the 192.168.1.15 ip address ([5C:0A:5B:26:72:82] and [00:16:44:12:91:86])

Go further

For your scripts : use the -D option to know if an IP is already used, Duplicate address detection mode (DAD). See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received

Category: ToTW
Tags: tip linux network

Comments