arping

Arping is a util to find out if a specific IP address on the LAN is 'taken' and what MAC address owns it. Sure, you could just use 'ping' to find out if it's taken and even if the computer blocks ping (and everything else) you still get an entry in your ARP cache. But what if you aren't on a routable net? Or the host blocks ping (all ICMP even)? Then you're screwed. Or you use arping. Say you have a block of N real IANA-assigned IP-addresses. You want to debug the net and you don't know which IP addresses are taken. You can't ping anyone before you take the IP, and you can't pick an IP before you know which are already taken. Catch 22. But with arping you can 'ping' the IP and if you get no response, the IP is available. If some box is dumping non-IP (like IPX) garbage and you don't know which box it is, you can ping by MAC to get the IP and fix the problem. Systems that it should still work on, but I don't personally regularly test: Debian Alpha FreeBSD IRIX 6.5 mips (last test 2009-09-27) MacOS X NetBSD OpenBSD sparc64 (last test: 2009-10-02) Solaris Q: After compiling arping without any problem, i test it first with localhost... but it doesn't respond. Isn't that strange? Q: Arping finds some hosts, but not others. why? BTW, I have several NICs. You have to choose interface with the -i switch if the default is wrong for you. A sane OS will think it's suspicious if you send packets to yourself over the wire and will ignore them. And why would you want to lookup the IP or MAC of yourself? ifconfig can tell you that. Arping depends on libnet 1.1 or newer, and libpcap. Get libnet from and libpcap from . Or more likely they were both included in your Linux distribution. I can't (portably anyway) do anything other than queue a packet to the network. That means I don't know exactly when it arrived. Also, I can't tell when a packet arrives on the wire, only when arping gets it from the kernel. Just make sure neither the network (whole segment if you are hubbed, just your NIC if you are switched) nor your box is loaded when you care about timing, and/or run arping with higher priority. But if you find way to get more exact timing portably (or just for one OS really), let me know. Be my guest, but I'd recommend restricting execution of arping to trusted users. Arping tries to drop all possible privileges as early as possible, but this is a network debugging tool, which generates low-level network packets that ordinary users have absolutely no business generating. If you are honestly debugging the network then I don't see why you aren't root already. This requires a libnet 1.1.5 or higher, which does not explicitly check for uid 0. Normally arping packets are sent out to some kind of broadcast (MAC or IPv4 broadcast) and hosts reply with source address == their address. If you don't understand, don't worry. You won't need it. But for an example use, see the arping-scan-net.sh script. Yes, I've finally bothered to write how it works. tcpdumps were taken with tcpdump -vven 'arp or icmp' . This is the packet generated by arping. An Ethernet frame from my 3com card to the broadcast address carrying an arp packet asking what MAC 192.168.0.1 has (who-has). This is the packet generated by arping. Ethernet frame from my 3com NIC to the destination MAC, carrying a broadcast ping. The answer, including the source address of the target host. Note that this is not how every OS responds to a broadcast ping (if at all). Some answer with a source address equal to the broadcast address, and others don't' answer at all. I may add this to arping some day, but don't hold your breath.