Checking Address Resolution Protocol ARP
If you're not able to ping your gateway, you may have an issue at the Ethernet MAC layer. The Address Resolution Protocol (ARP) can be used to find information at the MAC layer. To view and configure ARP entries, use the arp or ip neighbor command. This example shows arp listing computers in the ARP cache by hostname:
# arp -v List ARP cache entries by name
Address HWtype HWaddress Flags Mask Iface ritchie ether 00:10:5A:AB:F6:A7 C eth0
einstein ether 00:0B:6A:02:EC:98 C eth0
Entries: 1 Skipped: 0 Found: 1
In this example, you can see the names of other computers that the local computer's ARP cache knows about and the associated hardware type and hardware address (MAC address) of each computer's NIC. You can disable name resolution to see those computers' IP addresses instead:
# arp -vn List ARP cache entries by IP address
Address HWtype HWaddress Flags Mask Iface
10.0.0.1 ether 00:10:5A:AB:F6:A7 C eth0
10.0.0.50 ether 00:0B:6A:02:EC:98 C eth0
Entries: 1 Skipped: 0 Found: 1
To delete an entry from the ARP cache, use the -d option:
# arp -d 10.0.0.50 Delete address 10.0.0.50 from ARP cache
Instead of just letting ARP dynamically learn about other systems, you can add static ARP entries to the cache using the -s option:
# arp -s 10.0.0.51 00:0B:6A:02:EC:95 Add IP and MAC addresses to ARP
To do the same actions with the ip command that you just did with the arp command, use the neighbor object (notice that neighbor, nei, and n objects can be used interchangeably):
# ip neighbor
10.0.0.1 dev eth0 lladdr 00:10:5a:ab:f6:a7 DELAY 10.0.0.50 dev eth0 lladdr 00:0b:6a:02:ec:98 REACHABLE
# ip n add 10.0.0.51 lladdr 00:0B:6A:02:EC:95 dev eth0
To query a subnet to see if an IP is already in use, and to find the MAC address of the device using it, use the arping command. The arping command is used by ifup to avoid IP conflicts when bringing an Ethernet NIC up. Here are examples:
# arping 10.0.0.50 Query subnet to see if 10.0.0.50 is in use ARPING 10.0.0.50 from 10.0.0.195 eth0
Unicast reply from 10.0.0.50 [00:0B:6A:02:EC:98] 0.694ms Unicast reply from 10.0.0.50 [00:0B:6A:02:EC:98] 0.683ms
# arping -I eth0 10.0.0.50 Specify interface to query from
Like the ping command, the arping command continuously queries for the address until the command is ended by typing Ctrl+c. Typically, you just want to know if the target is alive, so you can run one of the following commands:
# arping -f 10.0.0.50 Query 10.0.0.50 and stop at the first reply
# arping -c 2 10.0.0.51 Query 10.0.0.50 and stop after 2 counts
Continue reading here: Tracing Routes to Hosts
Was this article helpful?