Ping not working? try ARP



I’ll confess to having a lot to learn about IP ethernet networking. I feel pretty comfortable with basic TCP/IP (v4), the concept of UDP vs. TCP ports, ICMP pings, etc… but ARP is something that I haven’t dabbled much with. It is, of course, a layer that TCP depends on. When a machine sends a packet to another machine, it sends an arp packet out to “discover” the hardware (MAC) address of the machine on the other end, so ARP underlies everything. These days ICMP is many times blocked by firewall rules. The default with XP’s software firewall is to block ICMP pings for instance.


This is a good thing, but within a LAN it can make life a bit trickier for someone scanning to see what machines are up. So, when the ping command fails… linux.com has an article on arping which is a tool to send an arp ping (makes sense…) These arp requests are non-routable so you can’t do an arp through a router to another network, but an arping will answer with the reply and MAC address of the host being pinged. That’s your ticket to identify if a firewalled host is up on your network.

Given that arp is required for tcp ip address/mac discovery, it can’t be blocked which makes it an excellent ICMP workaround.

So, another neat use of arp is to see what machines your computer has communicated with on the LAN, running arp gives the current IP to MAC address routing table, running this from a router/firewall would likely identify each machine on a network. The command ip neighbours should give a similar result (on one machine that was “ip neigh” instead….) All of the above commands will need to be run with root priviliges.

Related Posts

Blog Traffic Exchange Related Posts
  • Network Security - Hub or Switch? So, for those that have a little bit of knowledge about network hardware, you've probably heard this. "You can't sniff switched networks".... wrong.... let's see what this is about. Older networking hardware was dominated by what's called a hub. This was basically a "dumb" device that when it received data,......
  • Network Security - Defenses against arp spoofing So, we've spent a couple articles talking about arp spoofing. It sounds really bad, it's a frighteningly easy way to do a "mitm" or man in the middle attack and anyone using arp spoofing could capture ALL network traffic including passwords. There's got to be an easy fix right? Um..........
  • What a week.... I think it's time to pass along a long story of what's gone on over the last week or so here and some of the reasons there hasn't been anything posted. Generally, I would say that work has been busy, but something happened last week that went a bit beyond......
Blog Traffic Exchange Related Websites
  • D-Link Announced 2 new 2-Bay Network Storage Devices Two new Network Storage Devices from D-Link D-Link today announced that its ShareCenter® 2-Bay Network Storage devices, the DNS-320 and DNS-325, are now available. Building off of the successful DNS-321 and DNS-323, the new DNS-320 and DNS-325 provide centralized storage, enabling consumers to easily share documents, files and digital media......
  • Todays Screening Equipment Ever wonder how the Mayans, Egyptians and the Romans worked with the earth and created such massive structures? They had all man operated systems to haul the rocks and mortar to the desired place. Animals sweating over wagons filled with building materials. What would they have built if they had......
  • How to Safely Access Online Banking Sites from Public Wi-Fi Hot Spots The number of coffee shops, restaurants, and other stores that are offering free wireless internet access to their customers through 802.11B/G/N technologies (more commonly known as WiFi) has seen a dramatic increase in the last few years. In just about every major metropolitan "down town" area, you'll be hard-pressed to......
www.pdf24.org    Send article as PDF   

Similar Posts


See what happened this day in history from either BBC Wikipedia
Search:
Keywords:
Amazon Logo

Comments are closed.


Switch to our mobile site