Arping - When Ping Does Not Work

2 minute read

Have you ever been in a situation when ping just doesn’t work? Maybe the firewall blocks the ICMP or the device’s network stack is incomplete or broken.
If you are in the same LAN (e.g. Ethernet), use arping.

ARP and arping

The ARP protocol allows for devices to discover each other using their MAC and IPv4 addresses.

The arping utility does just that, sends an ARP request for a specific IP and waits for an ARP reply. In Linux, it requires CAP_NET_RAW (so… let’s sudo all the things) to create a raw socket, just like the old ping for ICMP. However, ping has root suid and more recent versions of ping even use unprivileged ICMP raw socket.

[email protected]:~$ sudo arping -i eth0 -c 5 192.168.1.1
ARPING 192.168.1.1
60 bytes from 43:3a:58:cd:9c:42 (192.168.1.1): index=0 time=448.951 usec
60 bytes from 43:3a:58:cd:9c:42 (192.168.1.1): index=1 time=193.046 usec
60 bytes from 43:3a:58:cd:9c:42 (192.168.1.1): index=2 time=793.208 usec
60 bytes from 43:3a:58:cd:9c:42 (192.168.1.1): index=3 time=210.227 usec
60 bytes from 43:3a:58:cd:9c:42 (192.168.1.1): index=4 time=166.297 usec

--- 192.168.1.1 statistics ---
5 packets transmitted, 5 packets received,   0% unanswered (0 extra)
rtt min/avg/max/std-dev = 0.166/0.362/0.793/0.238 ms

A Story

/* just bragging, no insights */

It was around 2005 and technologies like LTSP were flying high. I was watching my brother and a friend of ours helping another mate run a printed business directory. He had bought cheap thin clients (~100€ back then), which were connecting to X server through VNC and the sessions were running GNOME 2.

I was in early secondary school at the time and this technology looked really impressive to me. However, the system had a problem - the X server sessions would not close, if the terminal devices were shut down improperly (e.g. due to a power failure). Right away, my brother wrote a bash script that grepped through the running X sessions and started pinging the client IPs to check if they were alive and killing those that weren’t. It did not work, the terminal devices were all dead. Due to bad networking stack or some filewall rules on the thin clients, they were not replying to the ICMP echo requests.

I recall saying something like “maybe ARP ping would work”. My brother, looking amazed, told me something along the lines of “You are brilliant!”. He switched ping with arping on the server and the script was now working. Next thing was adding it to the cron to run every minute and it was all done.