How to: Detect Duplicate IP Address With arping command under Linux

by on November 23, 2007 · 6 comments· LAST UPDATED November 23, 2007

in , ,

Q. I run quite large network with different subnets. I'd like to know how can I find out duplicate IP address under Linux / UNIX?

A. You can use arpping command. The arping utility performs an action similar to ping command, but at the Ethernet layer. You can send ARP REQUEST to a neighbor host / computers.

Task: Send ARP request

Let us find out reachability of an IP on the local Ethernet with arping i.e send ARP request 192.168.1.1:
$ sudo arping -I eth0 -c 3 192.168.1.1
Output:

ARPING 192.168.1.1 from 192.168.1.106 ra0
Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B]  2.232ms
Unicast reply from 192.168.1.1 [00:18:39:6A:C6:8B]  1.952ms
Sent 3 probes (1 broadcast(s))
Received 3 response(s)

Where,

  • -I eth0 : Specify network interface i.e. name of network device where to send ARP REQUEST packets. This option is required.
  • -c 3 : Stop after sending 3 ARP REQUEST packets

Task: Find duplicate IP

The -D option specifies duplicate address detection mode (DAD). It returns exit status 0, if DAD succeeded i.e. no replies are received.
$ sudo arping -D -I eth0 -c 2 192.168.1.1
If 192.168.1.1 duplicated you should see zero exit status:
$ echo $?
Always use following syntax for duplicate address detection with arping:
$ sudo arping -D -I <interface-name> -c 2 <IP-ADDRESS-TO-TEST>
$ echo $?

References:

TwitterFacebookGoogle+PDF versionFound an error/typo on this page? Help us!

{ 6 comments… read them below or add one }

1 David November 23, 2007 at 10:03 pm

Be aware that there is an arping as part of the iproute2 package, and this arping is present on Red Hat systems when newly installed – and perhaps others.

This version is available from Thomas Habets.

Reply

2 nixCraft November 24, 2007 at 8:51 am

David,

thanks for pointing out more information about arping. I believe they follows same syntax.

Reply

3 siniranji February 7, 2008 at 8:32 am

still the problem persists, even after using lan guard software i am able to find out the mac address of the duplicate ip, it makes my network to respond to mail server requests to slow down partially

Reply

4 Mukesh October 29, 2011 at 9:42 am

can we check duplicate ip online

Reply

5 Prashant October 19, 2012 at 10:47 am

Q. I want arpiing library to be run in a thread and check contiuously for IP address collision. If duplicate IP collosion occurs it should notify my process as well as store the last host m/c mac as a proc entry? I did change arping utility to library and spawn a thread with the following argument to libary
“arping -d -I eth0 -c 2 10.129.170.131″
but i am getting the following error on 3 rd packet sent :
arping: libnet_build_arp(): libnet_pblock_find(): couldn’t find protocol block
arping: libnet_build_ethernet(): libnet_pblock_find(): couldn’t find protocol block

Reply

6 Gini July 23, 2013 at 3:59 am

good one.
If you are in a bonded interface, dont forget to put ” -I bond0″. :)

Reply

Leave a Comment

Tagged as: , , , , , , , ,

Previous Faq:

Next Faq: