19.4. Finding Duplicate IP Addresses with arping

Problem

You want to know how to test an IP address on your LAN to see whether it is a duplicate.

Solution

Use arping, like this:

	$ arping -D 192.168.1.76
	ARPING 192.168.1.76 from 0.0.0.0 eth0
	Unicast reply from 192.168.1.76 [00:14:2A:54:67:D6] for 192.168.1.76 [00:14:2A:54:67:
	D6] 0.605ms
	Sent 1 probes (1 broadcast(s))
	Received 1 response(s)

Received 1 response(s) means that this address is already in use, and arping even gives you the MAC address. You may also test with a hostname:

	$ arping -D uberpc
	ARPING 192.168.1.76 from 0.0.0.0 eth0
	Unicast reply from 192.168.1.76 [00:14:2A:54:67:D6] for 192.168.1.76 [00:14:2A:54:67:
	D6] 0.590ms
	Sent 1 probes (1 broadcast(s))
	Received 1 response(s)

You should set a time limit or count limit, or arping will keep running when it gets no response. This example sets a time limit of 10 seconds:

	$ arping -w10 -D 192.168.1.100
	ARPING 192.168.1.100 from 0.0.0.0 eth0
	Sent 11 probes (11 broadcast(s))
	Received 0 response(s)

Use -c5 instead of -w10 to tell arping to run for five counts.

Discussion

Of course, you may use any value for -c and -w that you like.

This is a good test to run when you have mobile users with static IP addresses on their laptops that come and go a lot, or to use before assigning a static address to a new host. If you're having intermittent connectivity problems with a particular host, run arping to see if it has a duplicate address.

arping is also useful to see if a host is up when ping fails. Some folks like to block ping, which is not a good thing to do, so arping will work when ping is blocked.

Address Resolution Protocol (ARP) is used mainly to translate IP addresses to Ether-net MAC addresses. You can see this in action with tcpdump:

	# tcpdump -pi eth0 arp
	tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
	listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes
	14:58:34.835461 arp who-has xena.alrac.net tell pyramid.alrac.net
	14:58:34.839337 arp reply xena.alrac.net is-at 00:03:6d:00:83:cf (oui Unknown)

pyramid is the local name server, so it needs to keep track of the hosts on the LAN.

oui Unknown means the IEEE Organizational Unique Identifier is unknown. The first 24-bits of every MAC address are assigned to the manufacturer, and you can look them up at Standards.ieee.org (http://standards.ieee.org/regauth/oui/index.shtml). You can't just copy and paste because you have to enter the numbers separated by dashes, like this: 00-03-6d.

See Also