Questions tagged [arp]

Questions pertaining to ARP (Address Resolution Protocol) a communication protocol used for discovering the link layer address, such as a MAC address, associated with a given internet layer address, typically an IPv4 address.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

entry in arp table present but still requests

Working with a linux machine and a microcontroller with the lightweight IP stack on it. Trying to get a ping going between them and facing some issues. The first time when a ping is initiated from the ...
0
votes
0answers
17 views

IPVS: Is it still necessary to handle ARP problems with newer kernel?

I set up a load balancer with ipvs, and several howtos are claiming that it is necessary to set net.ipv4.conf.<interface>.arp_ignore=1 and net.ipv4.conf.<interface>.arp_announce=2 at ...
1
vote
0answers
33 views

arptables-nft persistence

Introduction This is on Debian Buster with kernel 4.19.0-6 I've installed iptables-persistent and netfilter-persistent versions 1.0.11 and added a basic rule to arptables-nft to block all LAN ...
0
votes
0answers
9 views

Creating a VPN based on TAP devices - no response to i.e. `ping`

I am trying to build a L2 VPN with Go for GNU/Linux (source is on GitHub). It reads all ethernet frames from a TAP device and sends them over TCP to a destination, which in turn writes it to it's TAP ...
1
vote
0answers
81 views

gc_thresh kernel config issues

We were having problems with kernel logs in our datacenter: arp_cache: neighbor table overflow! It was related to all of our servers having consul on them using gossip protocol and "flooding" the ...
1
vote
3answers
173 views

Parse command arp -a for only ip

I need to parse the command arp -a to get only the ip of the device. Right now I have arp -a | awk '{print $2}' | head -1 However this gives me (192.168.1.71) and I must remove the ( ) from ...
0
votes
1answer
83 views

Is there a file for ip neigh show

I am looking for the file containing the output of ip neigh show command. I need the file as I can't invoke command and redirect as per requirement. The closest thing I found is the file /proc/net/arp....
1
vote
1answer
1k views

Best way to filter/limit ARP packets on embedded Linux

I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
0
votes
0answers
19 views

Ubuntu 14.04 ,looking for script auto restart eth0

I got the problem on 14.04.3(default install iso, do not apply network update or upgeade to 14.04.6), the system sometimes network fail, can't ping other one and arp get the mac address show ,i need ...
0
votes
0answers
132 views

ARP requests sent from wrong interface on Hostapd managed access point

I am trying to setup a wireless access point, managed by Hostapd and with dynamic VLAN support. The VLANs are managed dynamically by a FreeRadius server that I use for 802.X authentication. I am ...
2
votes
1answer
144 views

Does `arp-scan` not work well in a wifi created by a hotspot?

When I use a wifi hotspot, sometimes I can't use sudo arp-scan -l to see other devices (except the hotspot), but sometimes I can see another laptop, but I never see another android phone. (The hotspot ...
0
votes
2answers
967 views

How can I find out the hostnames of other computers in the same local network?

In my local wifi, I can find out the IP and MAC of another computer which also runs Lubuntu, and whose hostname is known to me. $ sudo arp-scan olive [sudo] password for t: Interface: ...
0
votes
1answer
542 views

Ubuntu ARP reply configuration

I am wondering what/if there is any configuration that enables arp replies. I have an Ubuntu machine with two interfaces - one is ethernet to a non-public LAN, the other is Wifi which connects to the ...
0
votes
1answer
506 views

Why do I have these arp cache entries, for addresses way outside my network?

$ ip -4 neigh show dev eno1 209.132.181.16 FAILED 152.19.134.142 FAILED 85.236.55.6 FAILED 152.19.134.198 FAILED 8.43.85.67 FAILED 140.211.169.206 FAILED How could these weird ip neighbour (ARP)...
1
vote
0answers
251 views

ARP responses not arriving to virtual interface in Linux

I created virtual interface in Linux from command line, and asked for an IP address from the router with the following commands: ip link add link enp0s3 my-iface type macvlan ifconfig my-iface up ...
1
vote
1answer
587 views

Refresh arp entries in FreeBSD

In Linux, an ARP entry's age gets reset/refreshed if a packet comes by. However, it seems that FreeBSD simply sets a timer, and unconditionally evicts the ARP entry even if packets with that MAC-...
1
vote
1answer
267 views

How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?

TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
56 views

How can I track down the source of an Ethernet ARP table issue between Linux laptops?

On our home LAN, after rebooting the router, I cannot ssh from laptop A to laptop B except via the router. However, after doing a ping from laptop B to laptop A, I can connect normally from A to B. I ...
2
votes
1answer
68 views

DHCP works on wifi but my computer cannot receive unicast packets only broadcast packets

I cannot use my wireless capabilities of my laptop at all. I connect to my home router manually (without using the network manager, I purged it). Using the following commands: ifconfig wlan0 up ...
2
votes
1answer
1k views

Ubuntu not replying to ARP requests

I experience a behavior on my linux machine that I cannot explain. I see incoming ARP requests but they are not answered by my machine. When I plug the Ethernet cable into a Windows 10 machine those ...
1
vote
3answers
1k views

NMAP network scan shows IP-addresses and MAC addresses of items that are then missing from a subsequent arp-cache dump?

The logic I have is this get the definition of the subnet use nmap to scan every item in the subnet to populate the arp cache use the /usr/sbin/arp tool to dump the arp cache parse the arp-cache to ...
1
vote
2answers
1k views

ARP hostnames problem

I am having problem with viewing hostnames of devices located in my LAN. On my first laptop (Ubuntu 18.04 LTS Desktop edition) result of following command: arp -a Is exactly what I want: X (192.168....
1
vote
0answers
226 views

OpenBSD not replying to ARP requests

I am setting up an OpenBSD system as a router, I have one interface as the upstream, then another with a vlan configured: Upstream(em0): inet 10.0.2.20 255.255.255.0 NONE description upstream ...
1
vote
1answer
341 views

Linux - net.ipv4.conf.all [duplicate]

I'm changing the default setting for arp_ignore on an ubuntu 16.04 server, from it's default value 0 to 1. My understanding of the /proc/sys/net/ipv4/conf/ directory is that files under all will ...
1
vote
1answer
48 views

arp_cache option explain

$ ip ntable show dev eth0 inet arp_cache dev eth0 refcnt 4 reachable 20744 base_reachable 30000 retrans 1000 gc_stale 60000 delay_probe 5000 queue 31 app_probes 0 ucast_probes 3 ...
5
votes
1answer
1k views

FreeBSD static ARP entry when link cycles

we are trying to add a static ARP entry to a FreeBSD system. This works well with, for example, arp -S 172.16.16.9 11:54:33:A8:B2:6B . We have added this to a startup script to survive a reboot. ...
1
vote
1answer
882 views

How to add arp entry for an entire subnet (/16)?

I would like to add ARP entry for an entire subnet (10.50.0.0/16). I tried : arp -v -i p4p1 -s 10.50.0.0 MAC_OF_P4P2 netmask 255.255.0.0 pub But the command returns: arp: SIOCSARP() SIOCSARP: ...
-1
votes
1answer
2k views

How to force an ARP reply for an IP address?

Currently, I have a set up where a machine has multiple IP addresses. For some experimentation, I have set up some ip rule entries such that for certain IP addresses, the packet gets forwarded to ...
2
votes
2answers
5k views

How to find ipv6 addresses of connected devices to my Linux PC?

I can see all connected devices to my Linux PC with: cat /proc/net/arp But this show only the IPv4 addresses and MAC of the connected devices. There is no IPv6 addresses. How to find the IPv6 ...
0
votes
0answers
585 views

Linux: outbound IP to my subnet do not appear in tcpdump and do not appear to be sent

I'm trying to setup a poorly designed Wi-Fi device and I've connected to its wifi network and set my IP and routes manually as DHCP does not appear to be working. # ip route show default via 192.168....
3
votes
1answer
405 views

sender address of an ARP request is from different broadcast domain than the target address

I have a following simple network topology: I saw a situation in this server where ARP requests sender address(192.168.1.15) was from different broadcast domain than the target(10.10.10.252): server:...
1
vote
1answer
62 views

Filtering network traffic with an application

I'm trying to create a system to filter out certain types of internet traffic on a network. Basically, I'd like to be able to inspect packets that are destined for the internet and choose whether to ...
1
vote
1answer
350 views

Not responding to ARP w/ request for IP 0.0.0.0

I'm working on a personal project that involves ARP requests to a specific/known MAC for IP 0.0.0.0: Who has 0.0.0.0? Tell x.x.x.x. As far as I'm aware any receiving host should respond to that, but ...
0
votes
1answer
72 views

Do incoming LAN UDP packets create an entry containing senders MAC in receivers ARP table in Linux?

When Linux receives a UDP packet originating from a sender having a LAN source IP, will Linux put the source MAC address of this packet along the source IP address into the ARP cache table?
4
votes
1answer
698 views

How can I change the MAC of outgoing ARP requests?

Is it possible to change the source MAC of all the outgoing ARP requests to a specific MAC instead of using the interface MAC in linux? Is there a way to do this from the ARP tables?
0
votes
1answer
144 views

Find details of device based on dns name using ip command

When I'm retrieving the mac address of a device I execute following command $ arp <dnsname> | grep "HWaddress" -A1 | awk '{print $1 "" $3}' |head -2 | tail -1 this will probably print <...
3
votes
1answer
703 views

Linux arp table ignored for gateway IP

Let me preface this by saying that I am relatively new to networking so please forgive my ignorance and correct any errors in my thinking, gaps in my knowledge, or incorrect assumptions. I'm ...
1
vote
1answer
168 views

arp-scan shows machines, but I can't ping some of them

I am working on an embedded linux board with a freescale cpu and an ltib built linux on it. The appliance has two network interfaces and here is the output of ifconfig and route commands: [root@sina-...
0
votes
1answer
785 views

nmap & arp cache behaviour

Why does the target of a nmap scan, where the target does not exist get entered into the arp cache? nmap -v -P0 -sT 192.168.1.103 That scan always shows "host up". This behaviour made me go crazy >...
4
votes
1answer
1k views

Understanding virtual switches in Linux

I am confused by the way I have to set up virtual switches in Linux. I proceeded as follows: ip link add name br0 type bridge ip link set br0 up This should create a virtual switch called br0. Now, ...
3
votes
0answers
1k views

Gratuitous ARP packet gets not send out even if “arp_notify” in sysctl is set to 1 on OpenWRT

I am running a router on OpenWRT 15.05.1 and I did notice, that it does not send out Gratuitous ARP packets on a change of the IP address, nor on a reboot, nor on change of the Ethernet link state. ...
3
votes
3answers
3k views

How does one determine the process causing an ARP request?

I have a machine that runs a network intensive application that spawns many processes. I noticed recently that the machine is producing ARP requests looking for an IP address that does not exist. I ...
0
votes
0answers
486 views

ARP reply to a request which asks MAC address from another broadcast domain

I have a following network topology: Sometimes I see ARP requests from server which request MAC address for IPv4 address which is not in the broadcast domain: 18:37:01.707771 00:16:3e:1a:61:b5 > ...
3
votes
0answers
626 views

can't delete ARP entry with iproute2

On Ubuntu-14.04.5 I can't delete entry with ip tool from iproute2 package. % ip neigh show 10.0.0.119 dev eth2 lladdr c4:3d:c7:a2:fe:37 REACHABLE fe80::2e0:ecff:fe36:2af6 dev eth2 lladdr 00:e0:ec:36:...
4
votes
2answers
476 views

Why does arp -a only show some machines on my network?

I ran arp -a on a Linux server, and this is the output: [root@trnsrv1 ~]# arp -a ? (10.223.8.82) at 00:50:56:B5:75:08 [ether] on bond0 ? (10.223.11.254) at E0:5F:B9:66:A6:00 [ether] on bond0 10.223....
1
vote
0answers
50 views

Survive Mac address of client after routing

I am developing an application in which it is very important that I can know the mac address of the client hitting the server. Clients are connected to wifi router (W). Multiple wifi routers (W) are ...
1
vote
0answers
657 views

How to prevent responding to arp scan requests from outside (except the router) in ubuntu?

How do I prevent my computer from responding to arp scans in my network? A solution using iptables or something similar is very welcome. The network interface is wlan0. Some malicious users are ...
0
votes
1answer
665 views

Sudo cron job using arp-scan gives empty output

I made a script called hello.sh and it contains the following: #!/bin/bash printf "$( arp-scan --interface=eth0 --localnet )\n" printf "test\n" after making it executable (chmod o+x) and running it ...
4
votes
1answer
193 views

“legal” ARP poisoning by machine aggregating 2 NICs crashes us

Strange things are afoot, threats are being made and we need to sort this problem out; The situation: Our device (a network camera) streams video over a network to a recorder/server (Using Live555 / ...
3
votes
1answer
2k views

is there a tool/daemon that automatically fills /etc/ethers in the background to have a proper wake on lan hostname:mac database when needed?

is there a tool/daemon available that automatically fills /etc/ethers in the background with the proper hostname:mac pairs to have a up to date database when needed with for example wake on lan (wol) ?...