What to do when you can’t ping a computer

If you’re on a local network the answer is arping.

Arping will use the Address Resolution Protocol (ARP) which will request the MAC address for a given IP Address. Arping will record the turnaround time just like ping.

internet:~ # arping 10.1.2.161
ARPING 10.1.2.161 from 10.1.2.1 eth0
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 6.740ms
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 2.191ms
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 4.885ms
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 2.621ms
Sent 4 probes (1 broadcast(s))
Received 4 response(s)

There are some options that arping has to extend its usability. A few that I find myself using most often are -c and -w

-c (count): Will stop after sending a specified number of ARP REQUESTS

-w (deadline): Will specify how many seconds to wait before arping exits.

When combining both -c (count) and -w (deadline) which ever comes first will cause arping to exit.

Example 1:  -c 4 -w 1

In this example 1 second will pass before we send 4 requests.

internet:~ # date; arping -c 4 -w 1 10.1.2.161; date
Sun May 17 04:38:13 ADT 2009

ARPING 10.1.2.161 from 10.1.2.1 eth0
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 5.029ms
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 2.243ms
Sent 2 probes (1 broadcast(s))
Received 2 response(s)

Sun May 17 04:38:15 ADT 2009

Example 2: -c 1 -w 4

In this example 1 request will be sent before 4 seconds.

internet:~ # date; arping -c 1 -w 4 10.1.2.161; date
Sun May 17 04:38:38 ADT 2009

ARPING 10.1.2.161 from 10.1.2.1 eth0
Unicast reply from 10.1.2.161 [00:24:2B:79:2A:F8] 4.685ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)

Sun May 17 04:38:39 ADT 2009

Yes its almost 5am on Sunday morning and I have nothing better to do then write this blog. So please enjoy 🙂

—

Shawn