arping

arping sends ARP requests and prints who answers, and with which MAC address. Because ARP is below IP, it works when a firewall drops ping, and it shows two answers when two devices claim one address. -D is duplicate address detection: it asks whether anyone already uses an address, and exits 0 only if nobody does.

arping command usage

arping [-c COUNT] [-w SECONDS] [-D] -I CARD ADDRESS

Options

-I eth0

the card to ask on (required)

-c 2

send 2 requests and stop

-w 3

give up after 3 seconds

-D

duplicate address detection: is this address taken?

arping examples

arping -c2 -I eth0 10.0.1.2

Asks twice who has 10.0.1.2 and prints the MAC address that answers.

arping -D -c2 -w3 -I eth0 10.0.1.50; echo exit=$?

Checks whether 10.0.1.50 is free before using it: exit 0 means nobody answered.

arping -f -I eth0 10.0.1.2

Stops at the first reply: the quickest proof that 10.0.1.2 is on this network.

arping -b -c3 -I eth0 10.0.1.2

Keeps broadcasting instead of switching to unicast after the first reply, so a second device claiming the address shows too.

arping -U -c3 -I eth0 10.0.1.10

Announces your own address (gratuitous ARP) so neighbours update their caches, as after a failover moves an address.

arping -A -c3 -I eth0 10.0.1.10

The same announcement as ARP replies, for devices that ignore unsolicited requests.

arping -s 10.0.1.50 -c2 -I eth0 10.0.1.2

Asks from another of your addresses, to check the router answers that one too.

arping -c3 -w5 -I eth0 10.0.1.2; echo exit=$?

Waits for three replies or five seconds: exit 0 if all three came.

arping -q -c1 -w1 -I eth0 10.0.1.2 && echo present

Prints nothing of its own, only the result, for a script.

arping -c2 -I eth0.10 10.0.10.1

Asks on VLAN 10's subinterface, where that VLAN's gateway lives.

arping -c 2 -i eth0 10.0.1.2

The same ask in Thomas Habets' arping (package arping), which takes the card with -i: the commands above are iputils arping (iputils-arping).

ip neigh show 10.0.1.2

Shows the MAC address the kernel stored after the ARP exchange.

Reading the output

$ arping -c2 -I eth0 10.0.1.2
ARPING 10.0.1.2 from 10.0.1.10 eth0
Unicast reply from 10.0.1.2 [4E:D8:1B:80:A0:83]  0.524ms
Unicast reply from 10.0.1.2 [4E:D8:1B:80:A0:83]  0.541ms
Sent 2 probes (1 broadcast(s))
Received 2 response(s)

• [4E:D8:…]: the MAC address that answered. Two different ones in the replies: two devices claim this address.
• Received 0 response(s): nobody on this network has the address.

Pitfalls

• ARP never crosses a router: arping only reaches your own network.

Run it on real machines