Questions tagged [arp]
The arp tag has no usage guidance.
0
votes
0answers
23 views
Best way to filter/limit ARP packets on embedded Linux
I have an embedded Linux on some network device. Because this device is pretty important I have to make many network tests (I have a separate device for that). These tests include flooding my device ...
0
votes
0answers
17 views
Ubuntu 14.04 ,looking for script auto restart eth0
I got the problem on 14.04.3(default install iso, do not apply network update or upgeade to 14.04.6), the system sometimes network fail, can't ping other one and arp get the mac address show ,i need ...
0
votes
0answers
38 views
ARP requests sent from wrong interface on Hostapd managed access point
I am trying to setup a wireless access point, managed by Hostapd and with dynamic VLAN support. The VLANs are managed dynamically by a FreeRadius server that I use for 802.X authentication.
I am ...
3
votes
1answer
34 views
Does `arp-scan` not work well in a wifi created by a hotspot?
When I use a wifi hotspot, sometimes I can't use sudo arp-scan -l to see other devices (except the hotspot), but sometimes I can see another laptop, but I never see another android phone. (The hotspot ...
0
votes
2answers
67 views
How can I find out the hostnames of other computers in the same local network?
In my local wifi, I can find out the IP and MAC of another computer which also runs Lubuntu, and whose hostname is known to me.
$ sudo arp-scan olive
[sudo] password for t:
Interface: ...
0
votes
1answer
96 views
Ubuntu ARP reply configuration
I am wondering what/if there is any configuration that enables arp replies.
I have an Ubuntu machine with two interfaces - one is ethernet to a non-public LAN, the other is Wifi which connects to the ...
0
votes
1answer
82 views
Why do I have these arp cache entries, for addresses way outside my network?
$ ip -4 neigh show dev eno1
209.132.181.16 FAILED
152.19.134.142 FAILED
85.236.55.6 FAILED
152.19.134.198 FAILED
8.43.85.67 FAILED
140.211.169.206 FAILED
How could these weird ip neighbour (ARP)...
1
vote
0answers
33 views
ARP responses not arriving to virtual interface in Linux
I created virtual interface in Linux from command line, and asked for an IP address from the router with the following commands:
ip link add link enp0s3 my-iface type macvlan
ifconfig my-iface up
...
1
vote
1answer
124 views
Refresh arp entries in FreeBSD
In Linux, an ARP entry's age gets reset/refreshed if a packet comes by. However, it seems that FreeBSD simply sets a timer, and unconditionally evicts the ARP entry even if packets with that MAC-...
1
vote
1answer
100 views
How to inspect decrypted TLS/SSL traffic in Wireshark from program not supporting SSLKEYLOGFILE?
TL;DR: I feel I'm pretty close to doing so by using sslsplit's interface mirroring, but I ran into an issue where the kernel is not replying to ARP requests that sslsplit is sending out on the ...
0
votes
1answer
36 views
How can I track down the source of an Ethernet ARP table issue between Linux laptops?
On our home LAN, after rebooting the router, I cannot ssh from laptop A to laptop B except via the router. However, after doing a ping from laptop B to laptop A, I can connect normally from A to B. I ...
2
votes
1answer
39 views
DHCP works on wifi but my computer cannot receive unicast packets only broadcast packets
I cannot use my wireless capabilities of my laptop at all.
I connect to my home router manually (without using the network manager, I purged it). Using the following commands:
ifconfig wlan0 up
...
1
vote
1answer
464 views
Ubuntu not replying to ARP requests
I experience a behavior on my linux machine that I cannot explain. I see incoming ARP requests but they are not answered by my machine. When I plug the Ethernet cable into a Windows 10 machine those ...
1
vote
3answers
327 views
NMAP network scan shows IP-addresses and MAC addresses of items that are then missing from a subsequent arp-cache dump?
The logic I have is this
get the definition of the subnet
use nmap to scan every item in the subnet to populate the arp cache
use the /usr/sbin/arp tool to dump the arp cache
parse the arp-cache to ...
1
vote
2answers
412 views
ARP hostnames problem
I am having problem with viewing hostnames of devices located in my LAN.
On my first laptop (Ubuntu 18.04 LTS Desktop edition) result of following command:
arp -a
Is exactly what I want:
X (192.168....
1
vote
0answers
153 views
OpenBSD not replying to ARP requests
I am setting up an OpenBSD system as a router, I have one interface as the upstream, then another with a vlan configured:
Upstream(em0):
inet 10.0.2.20 255.255.255.0 NONE description upstream
...
1
vote
1answer
185 views
Linux - net.ipv4.conf.all [duplicate]
I'm changing the default setting for arp_ignore on an ubuntu 16.04 server, from it's default value 0 to 1.
My understanding of the /proc/sys/net/ipv4/conf/ directory is that files under all will ...
1
vote
1answer
41 views
arp_cache option explain
$ ip ntable show dev eth0
inet arp_cache
dev eth0
refcnt 4 reachable 20744 base_reachable 30000 retrans 1000
gc_stale 60000 delay_probe 5000 queue 31
app_probes 0 ucast_probes 3 ...
0
votes
0answers
13 views
Forward ARP packets to an analyzing machine with pf (OS X), from en1 to en0
I have a machine that is outside a local network. The network is done via WiFi router. The machine is connected to one of the computers in network. So it doesn't see the network's ARP packets.
I can ...
5
votes
1answer
652 views
FreeBSD static ARP entry when link cycles
we are trying to add a static ARP entry to a FreeBSD system.
This works well with, for example,
arp -S 172.16.16.9 11:54:33:A8:B2:6B
. We have added this to a startup script to survive a reboot. ...
1
vote
1answer
516 views
How to add arp entry for an entire subnet (/16)?
I would like to add ARP entry for an entire subnet (10.50.0.0/16).
I tried : arp -v -i p4p1 -s 10.50.0.0 MAC_OF_P4P2 netmask 255.255.0.0 pub
But the command returns:
arp: SIOCSARP()
SIOCSARP: ...
-2
votes
1answer
1k views
How to force an ARP reply for an IP address?
Currently, I have a set up where a machine has multiple IP addresses. For some experimentation, I have set up some ip rule entries such that for certain IP addresses, the packet gets forwarded to ...
2
votes
2answers
3k views
How to find ipv6 addresses of connected devices to my Linux PC?
I can see all connected devices to my Linux PC with:
cat /proc/net/arp
But this show only the IPv4 addresses and MAC of the connected devices. There is no IPv6 addresses.
How to find the IPv6 ...
0
votes
0answers
268 views
Linux: outbound IP to my subnet do not appear in tcpdump and do not appear to be sent
I'm trying to setup a poorly designed Wi-Fi device and I've connected to its wifi network and set my IP and routes manually as DHCP does not appear to be working.
# ip route show
default via 192.168....
2
votes
1answer
162 views
sender address of an ARP request is from different broadcast domain than the target address
I have a following simple network topology:
I saw a situation in this server where ARP requests sender address(192.168.1.15) was from different broadcast domain than the target(10.10.10.252):
server:...
1
vote
1answer
35 views
Filtering network traffic with an application
I'm trying to create a system to filter out certain types of internet traffic on a network. Basically, I'd like to be able to inspect packets that are destined for the internet and choose whether to ...
1
vote
1answer
275 views
Not responding to ARP w/ request for IP 0.0.0.0
I'm working on a personal project that involves ARP requests to a specific/known MAC for IP 0.0.0.0: Who has 0.0.0.0? Tell x.x.x.x. As far as I'm aware any receiving host should respond to that, but ...
0
votes
1answer
50 views
Do incoming LAN UDP packets create an entry containing senders MAC in receivers ARP table in Linux?
When Linux receives a UDP packet originating from a sender having a LAN source IP, will Linux put the source MAC address of this packet along the source IP address into the ARP cache table?
4
votes
1answer
509 views
How can I change the MAC of outgoing ARP requests?
Is it possible to change the source MAC of all the outgoing ARP requests to a specific MAC instead of using the interface MAC in linux?
Is there a way to do this from the ARP tables?
0
votes
1answer
100 views
Find details of device based on dns name using ip command
When I'm retrieving the mac address of a device
I execute following command
$ arp <dnsname> | grep "HWaddress" -A1 | awk '{print $1 "" $3}' |head -2 | tail -1
this will probably print
<...
3
votes
1answer
482 views
Linux arp table ignored for gateway IP
Let me preface this by saying that I am relatively new to networking so please forgive my ignorance and correct any errors in my thinking, gaps in my knowledge, or incorrect assumptions.
I'm ...
1
vote
1answer
62 views
arp-scan shows machines, but I can't ping some of them
I am working on an embedded linux board with a freescale cpu and an ltib built linux on it. The appliance has two network interfaces and here is the output of ifconfig and route commands:
[root@sina-...
0
votes
1answer
521 views
nmap & arp cache behaviour
Why does the target of a nmap scan, where the target does not exist get entered into the arp cache?
nmap -v -P0 -sT 192.168.1.103
That scan always shows "host up".
This behaviour made me go crazy >...
1
vote
0answers
237 views
How to properly test arp cache poisoning locally [closed]
So i downloaded ubuntu 12.0.4 off osboxes.org. I then created 1 image then cloned it for virtual box. How do I test arp cache poisoning if both images have the same ip address and default gateway? ...
4
votes
1answer
824 views
Understanding virtual switches in Linux
I am confused by the way I have to set up virtual switches in Linux. I
proceeded as follows:
ip link add name br0 type bridge
ip link set br0 up
This should create a virtual switch called br0. Now, ...
3
votes
0answers
740 views
Gratuitous ARP packet gets not send out even if “arp_notify” in sysctl is set to 1 on OpenWRT
I am running a router on OpenWRT 15.05.1 and I did notice, that it does not send out Gratuitous ARP packets on a change of the IP address, nor on a reboot, nor on change of the Ethernet link state.
...
4
votes
3answers
2k views
How does one determine the process causing an ARP request?
I have a machine that runs a network intensive application that spawns many processes. I noticed recently that the machine is producing ARP requests looking for an IP address that does not exist. I ...
0
votes
0answers
316 views
ARP reply to a request which asks MAC address from another broadcast domain
I have a following network topology:
Sometimes I see ARP requests from server which request MAC address for IPv4 address which is not in the broadcast domain:
18:37:01.707771 00:16:3e:1a:61:b5 > ...
3
votes
0answers
474 views
can't delete ARP entry with iproute2
On Ubuntu-14.04.5 I can't delete entry with ip tool from iproute2 package.
% ip neigh show
10.0.0.119 dev eth2 lladdr c4:3d:c7:a2:fe:37 REACHABLE
fe80::2e0:ecff:fe36:2af6 dev eth2 lladdr 00:e0:ec:36:...
4
votes
1answer
268 views
Why does arp -a only show some machines on my network?
I ran arp -a on a Linux server, and this is the output:
[root@trnsrv1 ~]# arp -a
? (10.223.8.82) at 00:50:56:B5:75:08 [ether] on bond0
? (10.223.11.254) at E0:5F:B9:66:A6:00 [ether] on bond0
10.223....
1
vote
0answers
48 views
Survive Mac address of client after routing
I am developing an application in which it is very important that I can know the mac address of the client hitting the server.
Clients are connected to wifi router (W).
Multiple wifi routers (W) are ...
1
vote
0answers
576 views
How to prevent responding to arp scan requests from outside (except the router) in ubuntu?
How do I prevent my computer from responding to arp scans in my network? A solution using iptables or something similar is very welcome.
The network interface is wlan0.
Some malicious users are ...
0
votes
1answer
539 views
Sudo cron job using arp-scan gives empty output
I made a script called hello.sh and it contains the following:
#!/bin/bash
printf "$( arp-scan --interface=eth0 --localnet )\n"
printf "test\n"
after making it executable (chmod o+x) and running it ...
4
votes
1answer
162 views
“legal” ARP poisoning by machine aggregating 2 NICs crashes us
Strange things are afoot, threats are being made and we need to sort this problem out;
The situation:
Our device (a network camera) streams video over a network to a recorder/server (Using Live555 / ...
2
votes
1answer
2k views
is there a tool/daemon that automatically fills /etc/ethers in the background to have a proper wake on lan hostname:mac database when needed?
is there a tool/daemon available that automatically fills /etc/ethers in the background with the proper hostname:mac pairs to have a up to date database when needed with for example wake on lan (wol) ?...
1
vote
0answers
112 views
no arp entries for vnet
I have multiple kvm hypervisors (HV) which runs bunch of virtual machines (VM).
Every HV has br0 and every VM is attached to it with its vnet interface.
I noticed that one HV at arp -a shows me 2 ...
0
votes
1answer
299 views
ARP Spoofing in Data Center
I have a dedicated root server. I noticed strange connections from 255.255.255.255 in iftop. Because of that i tried to investigate it. I runned the following command:
tcpdump -i eth0 ether ...
0
votes
1answer
199 views
Recover a net device, I don't know IP-address, how to get arp?
I have to recover a HP ILO3. It doesn't take a correct IP-address because it is misconfigured
and get 127.0.0.1
I have no serial cable to connect to serial port.
Other forums suggested that I change ...
1
vote
1answer
2k views
arp-scan shows a machine, but I can't ping it
I have been facing a particularly anomalous network issue. For a particular test, I set a Class A IP on my Windows Machine and tried using arp-scan and ping separately. Here are my Windows settings :
...
3
votes
0answers
203 views
Counter MAC spoofing
I use a public wifi. (connect with id/password on an open network)
The network is unstable (download stream 500ko/s then drop 0ko/s and stream stop, if a click a later in the stream it's working ...
