Raspberry Pi does not show up in ARP table until connected to

I'd like to be able to connect a Raspberry Pi to a company network via Ethernet and discover its IP address using ARP. I would like to be able to do this on both Windows and *nix machines.

However, after I initially connect the RPi to the network I can't find it in the ARP table using arp -a (at least on Windows 7). If I hook the RPi up to a monitor and use ifconfig to find its address on the network, I see it's using an address that isn't present in the ARP table.

If I then try to connect to the RPI using the address I've found from ifconfig, the connection succeeds. After doing this the RPi shows up in the ARP table at that address.

I have limited knowledge of ARP. Can anyone explain what the cause of this is, and if there's a way I can either get the RPi to reliably show up in the ARP table after connecting to the network or force it to show up using a kind of scan. As stated above, I'd need a solution that works for both Windows and *nix machines.

Tagc

Posted 2017-07-14T11:27:56.237

Reputation: 194

Answers

To fill the arp cache from windows with the local subnet you don't need 3rd party tools,
a small batch should suffice:

:: FindActivePIsInSubNet.cmd
@Echo off
Set "SubNet=172.16.1"
Set "PiMac=b8-27-eb"
Set "Ping=ping.exe -n 1 -l 0 -f -i 2 -w 1 -4"
For /L %%A in (1,1,254) do Start /HIGH /B %Ping% %SubNet%.%%A >nul 2>&1
For /F "tokens=1,2" %%A in ('arp -a^|findstr /i %PiMac%') do Echo IP=%%A MAC=%%B

It takes just some seconds to run.

LotPings

Posted 2017-07-14T11:27:56.237

Reputation: 6 150

1Relevant username haha. I'll try this on Monday when I get into work again. – Tagc – 2017-07-15T00:21:05.323

This helped get me off to a great start. I've made some improvements here (https://pastebin.com/fDfghrX4). This helped get me off to a great start. There were about 100 dynamic entries, so I filtered by a part of the MAC address that all Pi's share. After another 20 minutes of googling and bashing my head against my desk, I also figured how to extract just the part of the string with the IP address (how is batch this terrible?).

– Tagc – 2017-07-17T07:39:14.257

If you edit your answer to incorporate this (hesitant if I should edit it myself), I'd be happy to accept this answer as the best solution. – Tagc – 2017-07-17T07:39:55.390

Just as an aside, since you can execute batch files using git bash, I can now just execute ssh tagc@$(./find-pi.bat) to login to my RPi, regardless of the IP address our company's DHCP server has assigned it. :) I also double-typed something by accident in my second comment, sorry about that. – Tagc – 2017-07-17T07:48:02.887

@Tagc Had to change to get more than one PI. Your first for would only get the last one as one set command would overwrite the previous. Otherwise good idea to use the manufacturer prefix to catch all Raspberry PIs. I have a batch which uses this to identify all manufacturers MAC from http://standards-oui.ieee.org/oui.txt

– LotPings – 2017-07-17T08:57:46.067

I only anticipate having one RPi connected to the network, but thanks. – Tagc – 2017-07-17T09:20:48.170

@Tagc Thanks. Well I needed a more general solution (having a zoo of an a,b+,22b,23,2*0w) and follow up readers can participate the advantage. – LotPings – 2017-07-17T09:30:38.340

ARP tables on a PC won't list all the devices on the network.

It only shows the IP and MAC adddress of the devices that your PC had communication with recently.

If your Windows 7 is passively and not interacting with any other device on the network, the ARP table will be empty.

When you try to connect to other IP address then it is in that moment when your PC sends an ARP request using broadcast adddress. if the destination IP exists then it replies to the ARP request and the relationship IP/MAC is cached on the PC's ARP table for a while.

If time passes and your PC is not communicating with that device then the entry is deleted.

jcbermu

Posted 2017-07-14T11:27:56.237

Reputation: 15 868

Ah, that makes sense. So I'd need to make my PC ping every address within the company intranet submask (172.16.1.xxx), and that would cause it to show up? – Tagc – 2017-07-14T11:37:00.850

Yes. That's right. – jcbermu – 2017-07-14T11:49:42.527

Cool, I've installed nmap on Windows and used it to discover all hosts on the intranet subnet, including the RPi. Unfortunately, Windows CLI absolutely sucks compared to what's available on Linux so the most convenient command sequence I could dig up to easily find the RPI's IP address is nmap -sPn 172.16.1.0/24 | find /i /n "b8:27", which gives me the rough location in the nmap output to search within (it would be a lot easier to find this using Linux's grep -B 3 or awk). – Tagc – 2017-07-14T12:29:28.560

Sorry to unaccept this answer but this one (https://superuser.com/a/1230030/395228) helped me develop a more complete solution.

– Tagc – 2017-07-17T09:21:20.820

@Tagc That's the beauty of this site. The best answer isn't always the first one. – jcbermu – 2017-07-17T09:34:14.353