Tech Juice

Introduction

The arping tool for Linux is the Layer 2 equivalent of the ping command. It is used to send ARP (Address Resolution Protocol) request messages to a destination host in a Local Area Network (LAN) . This is useful to test whether a particular IP address is in use and online in the network. The arping tool operates at OSI Layer 2, so it can only be used in local networks: ARP messages cannot be routed across routers or gateways. Many Linux distributions, including Backtrack, include arping by default.

When arping is run without parameters it will not do anything – except display the command line options:

$ arping
ARPing 2.09, by Thomas Habets <thomas@habets.pp.se>
usage: arping [ -0aAbdDeFpqrRuv ] [ -w <us> ] [ -S <host/ip> ]
 [ -T <host/ip ] [ -s <MAC> ] [ -t <MAC> ] [ -c <count> ]
 [ -i <interface> ] <host/ip/MAC | -B>
For complete usage info, use --help or check the manpage.

Arping with an IP Address Argument

Now let’s see arping in action by supplying it with an IP address to probe. This is the most common way to use arping. Say we want to send…

Introduction

The Dynamic Host Configuration Protocol (DHCP) is an automatic configuration protocol used on IP networks [RFC 2131]. A major advantage is that it eliminates the need to manually assign each host a static IP address. Hosts can ‘ask’ to join a network and they will be assigned an IP, and provided with additional information such as the subnetmask and gateway IP.

There are two versions of DHCP, one for IPv4 and one for IPv6. While both versions bear the same name and perform much the same purpose, the details of the protocol for IPv4 and IPv6 are sufficiently different that they can be considered separate protocols. In this article we explain the DHCP for IPv4 protocol and its packets.

How It Works

A client initially knows nothing about the network is it joining, so it needs to contact the DHCP server to request an IP address and receive other network information such as the subnetmask and the address of the DNS server. However, the MAC and IP address of the DHCP server are initially unknown to the client as well. So how can the new client contact the DHCP server, if it doesn’t know its location?

To solve this bootstrap problem the DHCP protocol uses special broadcast…

Introduction

The Address Resolution Protocol, or ARP, is used for resolution of network-layer addresses (IP) to link-layer addresses (MAC). This post describes the basics of the ARP protocol, viewing and manipulating your arp cache is discussed in the next post.

Other posts on the ARP protocol are available here:

• Viewing and manipulating the ARP cache on Windows and Linux.
• An introduction to ARP cache poisoning.

ARP Basics

When a system wants to send data to another computer, it prepares an IP packet with the appropriate destination IP. This packet is passed down to the link-layer (usually Ethernet). This layer needs to encapsulate the IP packet in an Ethernet frame before it can be sent.

An Ethernet frame must be addressed to a destination hardware address (MAC address). But which MAC address corresponds with the destination IP address? This is looked up in the ARP cache. The ARP cache contains mappings of the form (IP - MAC).

Source and Destination Hosts on the Same Local Network

The sending host will first look up the destination IP address in its routing table. If the destination IP is on the same physical network (subnet) then there are no routers between the host…