arping doesn't work

I got an email from a user saying that he used to be able to (a long
time ago)

arping -I eth0 00:1a:64:c2:cg:5a

and get the IP address of the MAC. Now, he can't. I've tried on a couple
of different Linux systems, and it doesn't work for me, either. Anyone
know what's up with this? The man page doesn't help... it seems to
indicate that the above should work just fine.

--
* John Oliver http://www.john-oliver.net/ *

On Wednesday 9 July 2008 20:23, John Oliver wrote:

> I got an email from a user saying that he used to be able to (a long
> time ago)
>
> arping -I eth0 00:1a:64:c2:cg:5a
>
> and get the IP address of the MAC. Now, he can't. I've tried on a couple
> of different Linux systems, and it doesn't work for me, either. Anyone
> know what's up with this? The man page doesn't help... it seems to
> indicate that the above should work just fine.

As I understand it, since you're doing ARP, you should supply an IP address,
not a MAC address.

On Wed, 9 Jul 2008, in the Usenet newsgroup comp.os.linux.networking, in article
<(E-Mail Removed)>, John Oliver wrote:

>I got an email from a user saying that he used to be able to (a long
>time ago)
>
>arping -I eth0 00:1a:64:c2:cg:5a

I'm going to guess that's two typ0s for the price of one - the option
is a lower-case i, and while 00:1a:64: is an IBM prefix, the 'g' is
not a possible character in the address.

>and get the IP address of the MAC. Now, he can't.

What happens - does the computer catch fire or something?

>I've tried on a couple of different Linux systems, and it doesn't
>work for me, either.

[compton ~]# arping -c 3 -i eth0 08:00:20:d2:f9:33
ARPING 08:00:20:d2:f9:33
60 bytes from 192.0.2.102 (08:00:20:d2:f9:33): icmp_seq=0 time=2.618 msec
60 bytes from 192.0.2.102 (08:00:20:d2:f9:33): icmp_seq=1 time=849.009 usec
60 bytes from 192.0.2.102 (08:00:20:d2:f9:33): icmp_seq=2 time=886.917 usec

--- 08:00:20:d2:f9:33 statistics ---
3 packets transmitted, 3 packets received, 0% unanswered
[compton ~]# exit
[compton ~]$

>Anyone know what's up with this? The man page doesn't help... it seems
>to indicate that the above should work just fine.

What happens - does the computer catch fire or something? Have you
tried to use a packet sniffer to see what is going out over the line?
Are you using a switched network (as opposed to a hub or coax)?

Old guy

On Wed, 9 Jul 2008 20:23:00 +0200 (CEST), John Oliver wrote:
> I got an email from a user saying that he used to be able to (a long
> time ago)
>
> arping -I eth0 00:1a:64:c2:cg:5a
>
> and get the IP address of the MAC. Now, he can't. I've tried on a couple
> of different Linux systems, and it doesn't work for me, either. Anyone
> know what's up with this? The man page doesn't help... it seems to
> indicate that the above should work just fine.

For the archives... arping has apparently forked, and the one that ships
with iputils doesn't do this any more. I was directed to:

http://www.habets.pp.se/synscan/prog...hp?prog=arping

I haven't heard back from my user, so either it worked and made him
happy, or it made his computer eloctrocute him. Either way, I'm good
:-)

--
* John Oliver http://www.john-oliver.net/ *

Hello,

John Oliver a écrit :
> I got an email from a user saying that he used to be able to (a long
> time ago)
>
> arping -I eth0 00:1a:64:c2:cg:5a
>
> and get the IP address of the MAC. Now, he can't. I've tried on a couple
> of different Linux systems, and it doesn't work for me, either. Anyone
> know what's up with this? The man page doesn't help... it seems to
> indicate that the above should work just fine.

When the target is a MAC address, it appears that arping sends to that
MAC address an ICMP echo (ping) request directed to the IP limited
broadcast address (255.255.255.255). However recent Linux kernels have
the /proc/sys/net/ipv4/ignore_icmp_echo_ignore_broadcasts sysctl enabled
by default, so they won't reply unless it is explicitly disabled.
Besides, the iptables ruleset on the target host may drop broadcast (or
even all) ping requests.