arping is a network diagnostic tool used to discover and test hosts on a local network by sending ARP (Address Resolution Protocol) requests instead of ICMP (ping) packets.
What ARPing Does ARP basics: ARP maps an IP address to a MAC address (layer 3 → layer 2). arping sends ARP requests to a specific IP and waits for replies. This helps verify whether a host is alive on the same subnet (since ARP doesn’t cross routers) Typical Uses Check if a host is up even when ICMP ping is blocked. Detect duplicate IPs (if multiple MAC addresses respond to the same IP). Verify ARP cache entries on your system. Troubleshoot local network connectivity at Layer 2.
⚖️ Difference from Normal Ping
| Feature | Ping (ICMP) | Arping (ARP) |
|---|---|---|
| Layer | Network (Layer 3) | Data Link (Layer 2) |
| Scope | Works across routers | Only works in local subnet |
| Use | Check IP reachability | Check MAC/IP mapping, local host presence |
Run arping Linux VM
arping -I vmnic0 192.168.1.50
-I vmnic0 specifies the NIC to send ARP requests from.
Replace vmnic0 with the correct interface on your ESXi host or Linux VM.
Interpret the Results
Single MAC reply → Only one host owns the IP (healthy).
Multiple MAC replies → Duplicate IP detected. You’ll see different MAC addresses responding.
No reply → Host may be down, disconnected, or blocked.
Why arping is Better Than Ping Here
Ping (ICMP) might succeed even if multiple hosts respond inconsistently.
Arping (ARP) shows the actual MAC addresses, so you can pinpoint which machines are conflicting.
Examples
CentOS VM
Ubuntu VM
root@ubuntu-1:~# arping -I ens37 192.168.1.14
ARPING 192.168.1.14
60 bytes from 00:0c:29:20:9c:8d (192.168.1.14): index=0 time=85.010 usec
60 bytes from 00:0c:29:20:9c:8d (192.168.1.14): index=1 time=53.720 usec
60 bytes from 00:0c:29:20:9c:8d (192.168.1.14): index=2 time=1.471 msec
60 bytes from 00:0c:29:20:9c:8d (192.168.1.14): index=3 time=9.025 usec
60 bytes from 00:0c:29:20:9c:8d (192.168.1.14): index=4 time=334.094 usec
^C
--- 192.168.1.14 statistics ---
5 packets transmitted, 5 packets received, 0% unanswered (0 extra)
rtt min/avg/max/std-dev = 0.009/0.391/1.471/0.552 ms
[root@cent7-1 ~]# arping -I ens36 192.168.1.11
ARPING 192.168.1.11 from 192.168.1.14 ens36
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 1.368ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 1.955ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 1.812ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 1.865ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 2.384ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 2.567ms
Unicast reply from 192.168.1.11 [00:0C:29:C3:D2:A7] 2.419ms
^CSent 7 probes (1 broadcast(s))
Received 7 response(s)
We can observe that getting response along with respective MAC address
root@ubuntu-1:~# arp -a
? (192.168.1.14) at 00:0c:29:20:9c:8d [ether] on ens37
dsldevice.lan (192.168.1.1) at 0c:36:23:92:61:10 [ether] on ens37
? (192.168.1.13) at 00:0c:29:37:30:3c [ether] on ens37
? (192.168.1.10) at 4c:77:cb:30:f8:18 [ether] on ens37
? (192.168.1.20) at 94:53:30:4d:5d:05 [ether] on ens37
? (192.168.10.5) at 00:0c:29:37:30:32 [ether] on ens33
_gateway (192.168.10.2) at 00:50:56:f2:42:c9 [ether] on ens33
root@ubuntu-1:~#
- -a [hostname] --all: This option is used for showing entries of the specified host. If nothing is passed all entries will be displayed.
- -e: Shows the entries in default(Linux) Style.
- -v, --verbose: This option shows the verbose information.
- -s hostname hw_address: Manually create an ARP address mapping entry for the host hostname with its mac address as hw_address.
- -d hostname, --delete hostname: Removes any entry for the specified host. If any host is down, there is no need of keeping its entry in arp cache so this command is used to delete those entries explicitly by the user.
-f filename: Works same as -s but instead of giving the entries manually, it takes entry from the file given as parameter.
Cleaning the ARP cache forces your system to drop old IP→MAC mappings and rebuild them fresh. This is useful when troubleshooting duplicate IPs, stale entries, or network changes.\
Check current ARP cache:
ip neigh show
Delete a specific entry:
ip neigh del 192.168.1.10 dev eth0
Flush the entire ARP cache:
ip -s -s neigh flush all
ip neigh show
ip neigh show
arping -I vmnic0 192.168.10.50
arping -I vmnic0 192.168.10.50
Post a Comment