3

I have been facing a particularly anomalous network issue. For a particular test, I set a Class A IP on my Windows Machine and tried using arp-scan and ping separately. Here are my Windows settings :

enter image description here

The output of arp-scan is as follows :

arp-scan 10.0.0.1
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.0.1    08:00:27:ec:ae:6d   CADMUS COMPUTER SYSTEMS
1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.8.1: 1 hosts scanned in 0.703 seconds (1.42 hosts/sec). 1 responded

and output of ping is as follows :

ping -c 5 10.0.0.1
PING 10.0.0.1 (10.0.0.1) 56(84) bytes of data.
From 192.168.1.1 icmp_seq=3 Destination Host Unreachable
From 192.168.1.1 icmp_seq=2 Destination Host Unreachable
From 192.168.1.1 icmp_seq=1 Destination Host Unreachable
From 192.168.1.1 icmp_seq=5 Destination Host Unreachable
From 192.168.1.1 icmp_seq=4 Destination Host Unreachable

--- 10.0.0.1 ping statistics ---
5 packets transmitted, 0 received, +5 errors, 100% packet loss, time 4024ms pipe 3

Here's the output of the route command :

route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
default         192.168.1.1     0.0.0.0         UG    0      0        0 eth0
link-local      *               255.255.0.0     U     1000   0        0 eth0
192.168.0.0     *               255.255.248.0   U     0      0        0 eth0

Has anyone encountered the same issue? Why does this happen? Any valid answer is appreciated. Thanx in advance.

3
  • What is the IP/netmask on the nix host?
    – stevieb
    Commented Oct 29, 2015 at 14:00
  • 3
    Post also your ruoting table (route command). AFAIK the arp protocol sends a packet to the broadcast IP address so if the windows machine is reachable through the broadcast interface used for arp then the packet will be received. However, if in your routing table there's no route to reach the 10.0.0.1 IP address then your nix host doesn't know which interface use to send the ICMP packet.
    – migrc
    Commented Oct 29, 2015 at 14:41
  • Sorry, do you have your Windows machine directly connected to your nix host or the connection goes through a router?
    – migrc
    Commented Oct 30, 2015 at 10:18

1 Answer 1

3

You should add direct route to Windows subnet that is detected. Try adding such a route to address 10.0.0.0/8 directly on eth0:

ip r add 10.0.0.0/8 dev eth0

Then verify the kernel knows where to go:

ip r get 10.0.0.1

and try pinging again.

BTW 08:00:27 part of MAC shows someone running VirtualBox on the machine or something like that.

4
  • Thanx mate nd yes I am using a vm. What I still am not able to completely wrap my head around is how arp-scan is able to find dat machine. Commented Oct 31, 2015 at 5:46
  • 1
    arp-scan does not use ip level communications, but uses layer two communications that are valid only within your local segment. Layer 2 packets have hardware addresses which are macs. Layer 3 packets use ip addresses. The interesting fact is that machine still can be found even if it does not answer pings, but only within local segment of network. For further research install Wireshark - it's great software for anyone - beginners as well as professionals, it shows complete packet structure and well explains each field in it. Do not forget to read about OSI levels too.
    – user140866
    Commented Oct 31, 2015 at 6:16
  • Thnx to u mate, I have a much clear perspective about arp-scan and ping now. Commented Oct 31, 2015 at 6:20
  • Good to hear this shed light on! If my answer is helped you, please tick my answer as accepted.
    – user140866
    Commented Oct 31, 2015 at 6:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .