How to: Detect Duplicate IP Address With arping command under Linux

Q. I run quite large network with different subnets. I’d like to know how can I find out duplicate IP address under Linux / UNIX?

A. You can use arpping command. The arping utility performs an action similar to ping command, but at the Ethernet layer. You can send ARP REQUEST to a neighbor host / computers.

Task: Send ARP request

Let us find out reachability of an IP on the local Ethernet with arping i.e send ARP request
$ sudo arping -I eth0 -c 3

ARPING from ra0
Unicast reply from [00:18:39:6A:C6:8B]  2.232ms
Unicast reply from [00:18:39:6A:C6:8B]  1.952ms
Sent 3 probes (1 broadcast(s))
Received 3 response(s)


  • -I eth0 : Specify network interface i.e. name of network device where to send ARP REQUEST packets. This option is required.
  • -c 3 : Stop after sending 3 ARP REQUEST packets

Task: Find duplicate IP

The -D option specifies duplicate address detection mode (DAD). It returns exit status 0, if DAD succeeded i.e. no replies are received.
$ sudo arping -D -I eth0 -c 2
If duplicated you should see zero exit status:
$ echo $?
Always use following syntax for duplicate address detection with arping:
$ sudo arping -D -I <interface-name> -c 2 <IP-ADDRESS-TO-TEST>
$ echo $?


🐧 Get the latest tutorials on Linux, Open Source & DevOps via RSS feed or Weekly email newsletter.

🐧 8 comments so far... add one

CategoryList of Unix and Linux commands
Disk space analyzersdf ncdu pydf
File Managementcat cp mkdir tree
FirewallAlpine Awall CentOS 8 OpenSUSE RHEL 8 Ubuntu 16.04 Ubuntu 18.04 Ubuntu 20.04
Network UtilitiesNetHogs dig host ip nmap
OpenVPNCentOS 7 CentOS 8 Debian 10 Debian 8/9 Ubuntu 18.04 Ubuntu 20.04
Package Managerapk apt
Processes Managementbg chroot cron disown fg jobs killall kill pidof pstree pwdx time
Searchinggrep whereis which
User Informationgroups id lastcomm last lid/libuser-lid logname members users whoami who w
WireGuard VPNAlpine CentOS 8 Debian 10 Firewall Ubuntu 20.04
8 comments… add one
  • David Nov 23, 2007 @ 22:03

    Be aware that there is an arping as part of the iproute2 package, and this arping is present on Red Hat systems when newly installed – and perhaps others.

    This version is available from Thomas Habets.

  • 🐧 nixCraft Nov 24, 2007 @ 8:51


    thanks for pointing out more information about arping. I believe they follows same syntax.

  • siniranji Feb 7, 2008 @ 8:32

    still the problem persists, even after using lan guard software i am able to find out the mac address of the duplicate ip, it makes my network to respond to mail server requests to slow down partially

  • Mukesh Oct 29, 2011 @ 9:42

    can we check duplicate ip online

  • Prashant Oct 19, 2012 @ 10:47

    Q. I want arpiing library to be run in a thread and check contiuously for IP address collision. If duplicate IP collosion occurs it should notify my process as well as store the last host m/c mac as a proc entry? I did change arping utility to library and spawn a thread with the following argument to libary
    “arping -d -I eth0 -c 2”
    but i am getting the following error on 3 rd packet sent :
    arping: libnet_build_arp(): libnet_pblock_find(): couldn’t find protocol block
    arping: libnet_build_ethernet(): libnet_pblock_find(): couldn’t find protocol block

  • Gini Jul 23, 2013 @ 3:59

    good one.
    If you are in a bonded interface, dont forget to put ” -I bond0″. :)

  • Syed Abrar May 16, 2014 @ 18:46

    Can you please show to find [MAC flapping] same mac address being learned on different ports . usually to trouble shoot this we collect mac table multiple time and find the single mac address being learned on different ports .My colleague are using some tool but they want to share it with me.

    plzzzzzzzzzzzzzzzzzzzzzzzzzzzzzz help me with this :)

  • ali May 25, 2015 @ 10:41

    xarp is the tool to check that within the same vlan (broadcast domain)

Leave a Reply

Your email address will not be published.

Use HTML <pre>...</pre> for code samples. Still have questions? Post it on our forum