natjohan's blog

Posted dim. 10 mars 2013

Tip of the week 12

Detect IP address conflicts with the arping command

If you're working in large network environment and you have some ip conflicts, you can use arping command under Linux. This command sends arp requests on the Ethernet layer and is a part of iputils package (so arping is available on many distros)


arping usage is very easy :

natjohan$ arping
        Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
          -f : quit on first reply
          -q : be quiet
          -b : keep broadcasting, don't go unicast
          -D : duplicate address detection mode
          -U : Unsolicited ARP mode, update your neighbours
          -A : ARP answer mode, update your neighbours
          -V : print version and exit
          -c count : how many packets to send
          -w timeout : how long to wait for a reply
          -I device : which ethernet device to use
          -s source : source ip address
          destination : ask for what ip address
natjohan$ arping  -I wlan0
        ARPING from wlan0
        Unicast reply from [5C:0A:5B:26:72:82]  166.580ms
        Unicast reply from [00:16:44:12:91:86]  167.651ms
        Unicast reply from [5C:0A:5B:26:72:82]  171.751ms
        Unicast reply from [5C:0A:5B:26:72:82]  89.035ms
        Unicast reply from [5C:0A:5B:26:72:82]  112.753ms
        Unicast reply from [5C:0A:5B:26:72:82]  32.680ms
        Unicast reply from [5C:0A:5B:26:72:82]  56.519ms
        Unicast reply from [5C:0A:5B:26:72:82]  81.120ms
        Unicast reply from [5C:0A:5B:26:72:82]  104.755ms
        Unicast reply from [5C:0A:5B:26:72:82]  34.628ms
        Unicast reply from [5C:0A:5B:26:72:82]  51.382ms
        Unicast reply from [5C:0A:5B:26:72:82]  75.083ms
        ^CSent 11 probes (1 broadcast(s))
        Received 12 response(s)

The main options are : -I to define on which interface you want to send arp requests and the IP address you want to test, in the example above you can see that two MAC have the ip address ([5C:0A:5B:26:72:82] and [00:16:44:12:91:86])

Go further

For your scripts : use the -D option to know if an IP is already used, Duplicate address detection mode (DAD). See RFC2131, 4.4.1. Returns 0, if DAD succeeded i.e. no replies are received

Category: ToTW
Tags: tip linux network