How to use Arping in linux

Table of Contents

In this post, we are going to look at how to use the Arping tool in Linux to use this tool to learn about communication between two devices.

What is Arping?

Arping is a computer software tool that detects and analyzes hosts on a computer network. Using the Address Resolution Protocol (ARP) request method, orbiting probes hosts the analyzed network connection by sending the linked layer frames addressed to the host identified by the MAC address of the network interface.

How to install?

Arping tool is pre-installed on Linux devices, to run this tool on Linux you must first click on the Linux logo in the top left corner then information geathering> live host identification> arping

If you do not have an Arping tool on your device, type the following command into your terminal and install it.

									sudo apt install arping				

Using Arping to discover a host

First of all, as any device communicating over Ethernet, your device has an internal ARP table used to communicate over the network.

If you want to see your ARP entry, you need to run the arp command with option -a

									arp -a				

You can see your host provider with IP address and mac address by running the above command in your terminal.

Pinging hosts using IP addresses

To ping hosts on your network, you can use the “Arping” command and specify the IP address to ping.

Additionally, you can specify the number of pins to send using the “-c” option for “Count“.

									sudo arping -c 2 <ip_address>				

Sending ARP pings from Source MAC

In some cases, you may want to specify the source MAC address from which the packets will be sent. To achieve that you need to run the “arping” command with the “-s” option for “source” following the MAC address you want to ping.

									sudo arping -c 2 -s 2e:33:61:71:7b:64 <ip_address>				

In this case, you have two possibilities :

1. You are the owner of the MAC address and you can simply use the “-s” option.
2. You are not the owner of the MAC address and you are trying to spoof the MAC address. In this case, you need to use the promiscuous mode. As a short reminder, the promiscuous mode is set to transmit all frames received by the NIC rather than the ones it was meant to receive.

In order to enable the promiscuous mode with the “arping” command, you need to use the “-p” option.

Using the options we used previously, would lead us to the following command.

									sudo arping -c 2 -s 2e:33:61:71:7b:64 -p <ip_address>				

I hope this post was very helpful to you and I want to share this post with your friends too. If you have any doubts about this post you can ask me through the command section.