28

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP.

Is there any way to do the same on Windows? (I use Windows 7)

Etienne Dechamps
  • 2,164
  • 8
  • 24
  • 28

12 Answers12

16

If you clear Window's arp cache ( arp -d ) and then try to ping the ip address, it will issue a arp broadcast.

Check it out with Wireshark.

Stef Heylen
  • 145
  • 7
  • Is this behavior guaranteed? – Pacerier Apr 11 '15 at 08:59
  • 2
    @Pacerier: Yes, since ICMP (ping) is built on top of the IP layer. The IP layer needs the hardware address for a given IP address in order to know who to send its packet to. If the ARP cache is empty, the IP layer will have no choice but to issue an ARP request before it can send the packet. – Cameron Oct 07 '15 at 16:50
  • 1
    This behavior is *NOT* guaranteed. It will only happen if the IP address is reachable according to subnet rules; otherwise it will use the IP address of the default gateway to issue an ARP request. – Peter Crabtree Aug 17 '16 at 06:31
15

Arping for windows does actually exist.

http://freshmeat.net/projects/arping/

Correction: this is for Linux, MAC OSX, etc... but can be installed on windows through cygwin.

Napster_X
  • 3,333
  • 16
  • 20
Ryaner
  • 3,027
  • 5
  • 24
  • 32
  • To be clear, anything on the network nowadays needs to respond to ARP, therefore just about anything "supports" ARP pinging. Whether or not they have a nice packaged-with-a-bow utility for doing so is the question. – Qix - MONICA WAS MISTREATED Jun 14 '17 at 16:56
9

A built in way to do this in windows:

cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in () do @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! "

If you want to show a fresh ARP result each time (Needs to run as administrator)

cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in () do @arp -d & @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! "
sparks
  • 241
  • 3
  • 3
  • Wow, this is hardcore -- I love i! And it's almost working here. Actually I had to add a space between `-n` and `1` so it became: `... @ping -n 1 ...` – saulius2 Apr 18 '16 at 11:56
  • This loop runs for ever. I think what you intended is `cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in (1,1,2) do @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! "` which runs twice and so picks up duplicate MAC addresses. – parsley72 Aug 22 '18 at 03:55
  • Could you explain what this command is doing? – Penguin9 May 13 '20 at 01:29
  • 1
    @RaisingAgent Sure, as we are using a variable within the command, we use a variable expanded command prompt (/v) that runs once (/c). Then sets an IP address to your target ip Then creates an endless loop, that will ping and then ARP resolve a target – sparks May 14 '20 at 03:32
6

WinXP's ARP command is for displaying data only. Try Nmap, it's free and fairly easy for this type of scan. Nmap is available at insecure.org.

  • 5
    That's probably the closest I can get to the arping utility (using nmap -PR -sP ). Congratulations, you won. – Etienne Dechamps Oct 13 '09 at 19:03
  • 1
    @e-t172 With newer versions of nmap, the command `nmap -PR -sn ` is preferred. `-sP` is deprecated. Also, this only worked for me when I ran it as root. – Nic Jun 23 '13 at 03:12
5

Try "arp-ping.exe"

Thought I would add this tool which runs directly from the command prompt:

arp-ping.exe command line options

Usage: arp-ping.exe [options] target
        -s ip : specify source ip
        -n X  : ping X times
        -t    : ping until stopped with CTRL-C
        -x    : exit immediately after successful ping
        -i X  : ping every X seconds
        -d    : do an 'arp -d *' between pings (requires Administrator)
                (-d prevents cached ARP responses on Windows XP.)
        -c    : include date and time on each line
        -m X  : ignore failures that take less than X milliseconds
        -.      : print a dot (.) for every ignored failure
        -l    : print debug log
        -v    : print version and exit

Versus the Linux "arping" command line options

Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
-f : quit on first reply
-q : be quiet
-b : keep broadcasting, don't go unicast
-D : duplicate address detection mode
-U : Unsolicited ARP mode, update your neighbours
-A : ARP answer mode, update your neighbours
-V : print version and exit
-c count : how many packets to send
-w timeout : how long to wait for a reply
-I device : which ethernet device to use (eth0)
-s source : source ip address
destination : ask for what ip address
Community
  • 1
Valamas
  • 355
  • 1
  • 4
  • 9
3

You can check this out: https://github.com/seladb/PcapPlusPlus/tree/master/Examples/Arping. This is a cross-platform Arping that can work both on Windows, Linux and Mac OS X

fx20
  • 31
  • 1
2

This is not exactly an ARP "ping" but running "arp inet_addr (ip address)" from a command prompt will send a single ARP request to the host specified in (ip address). You can then run "arp -a" to see the result.

joeqwerty
  • 108,377
  • 6
  • 80
  • 171
  • Just doesn't work. I get my prompt back but nothing happened. A sniffer didn't show any ARP requests coming out. Same result if the IP address is not already in the ARP table. – Etienne Dechamps Sep 30 '09 at 10:57
  • Right, you don't get a result back. The command sends a single ARP request to the ip address, which you can then see the result by issuing the arp -a command. I said it's not exactly an arp ping, but it does send a single arp request. – joeqwerty Sep 30 '09 at 11:11
  • No it doesn't. As I said, a network sniffer doesn't show any ARP request going out, and no entry is added to arp -a. – Etienne Dechamps Sep 30 '09 at 17:16
  • That's strange. It works exactly as I described on Windows 7 but not on Windows XP. Sorry. – joeqwerty Sep 30 '09 at 19:44
  • 1
    Doesn't work for me either on Win7, sorry. – Cameron Oct 07 '15 at 16:59
1

Hardping is a decent program that does this.

There's the full version that costs money that's more of a ping sweep program, but I just use the freeware version. The free one only does 1 ip at a time, but that's all I needed it for.

You'd use it like c:>hardping 192.168.1.1 and it would reply with the mac or not.

I think they took it off their site, but you can still find it by googling "hardping freeware"

1

How to Get an ARP Table with an IP Helper API http://www.codeguru.com/cpp/i-n/internet/internetprotocolip/article.php/c6153

GetIpNetTable: Retrieves address resolution table information.

SetIpNetEntry: Adds entry to the ARP table.

DeleteIpNetEntry: Deletes entry from the ARP table.

CreateIpNetEntry: Creates an entry in the ARP table.

FlushIpNetTable: Deletes all ARP entries for the specified interface from the ARP table

SendARP: Sends an ARP request to obtain the physical address that corresponds to the specified destination IP address.

calloatti
  • 11
  • 1
1

I believe you can arp-ping with CAIN, which is free.

GregD
  • 8,713
  • 1
  • 23
  • 35
0

Unfortunately there is not a built in tool to do this in Windows, there are some third party tools that will do this such as Netscan, but its not free

Sam Cogan
  • 38,158
  • 6
  • 77
  • 113
0
arp -a your.ip.here.jo

ex: arp -a 192.168.0.1

techraf
  • 4,163
  • 8
  • 27
  • 44
supersimple
  • 11
  • This command will only lookup against the current arp cache, not issue a new arp "Who has 192.168.0.1?" request – Chriz Sep 04 '18 at 15:13