1

I have been facing a particularly anomalous network issue. For a particular test, I set a Class A IP on my Windows Machine and tried using arp-scan and ping separately. Here are my Windows settings :

enter image description here

The output of arp-scan is as follows :

arp-scan 10.0.0.1
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.0.1    08:00:27:ec:ae:6d   CADMUS COMPUTER SYSTEMS
1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 1 hosts scanned in 0.703 seconds (1.42 hosts/sec). 1 responded

and output of ping is as follows :

ping -c 5 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
From 192.168.1.1 icmp_seq=3 Destination Host Unreachable
From 192.168.1.1 icmp_seq=2 Destination Host Unreachable
From 192.168.1.1 icmp_seq=1 Destination Host Unreachable
From 192.168.1.1 icmp_seq=5 Destination Host Unreachable
From 192.168.1.1 icmp_seq=4 Destination Host Unreachable

--- 10.0.0.1 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 4024ms pipe 3

Here's the output of the route command :

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.0.0     *               255.255.248.0   U     0      0        0 eth0

Has anyone encountered the same issue? Why does this happen? Any valid answer is appreciated. Thanx in advance.

  • What is the IP/netmask on the nix host? – stevieb Oct 29 '15 at 14:00
  • 3
    Post also your ruoting table (route command). AFAIK the arp protocol sends a packet to the broadcast IP address so if the windows machine is reachable through the broadcast interface used for arp then the packet will be received. However, if in your routing table there's no route to reach the 10.0.0.1 IP address then your nix host doesn't know which interface use to send the ICMP packet. – migrc Oct 29 '15 at 14:41
  • Sorry, do you have your Windows machine directly connected to your nix host or the connection goes through a router? – migrc Oct 30 '15 at 10:18
3

You should add direct route to Windows subnet that is detected. Try adding such a route to address 10.0.0.0/8 directly on eth0:

ip r add 10.0.0.0/8 dev eth0

Then verify the kernel knows where to go:

ip r get 10.0.0.1

and try pinging again.

BTW 08:00:27 part of MAC shows someone running VirtualBox on the machine or something like that.

  • Thanx mate nd yes I am using a vm. What I still am not able to completely wrap my head around is how arp-scan is able to find dat machine. – Nick Miller Oct 31 '15 at 5:46
  • 1
    arp-scan does not use ip level communications, but uses layer two communications that are valid only within your local segment. Layer 2 packets have hardware addresses which are macs. Layer 3 packets use ip addresses. The interesting fact is that machine still can be found even if it does not answer pings, but only within local segment of network. For further research install Wireshark - it's great software for anyone - beginners as well as professionals, it shows complete packet structure and well explains each field in it. Do not forget to read about OSI levels too. – user140866 Oct 31 '15 at 6:16
  • Thnx to u mate, I have a much clear perspective about arp-scan and ping now. – Nick Miller Oct 31 '15 at 6:20
  • Good to hear this shed light on! If my answer is helped you, please tick my answer as accepted. – user140866 Oct 31 '15 at 6:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.