4

I have got a simple question, I am doing a broadcasted ping request on my local network, using a Mac with the latest Yosemite 10.10.4.

So I ping 255.255.255.255, I get responses from a bunch of devices ( all on the local 10.11.204.XX network, with 255.255.255.0 mask). But if I look into the ARP table with arp -a, I can not see any of the devices that responded to my ping request. I only can see the broadcast IP and MAC address in the table (10.11.204.255 | ff:ff:ff:ff:ff:ff).

However, if I ping individually each device, then they appear into the ARP table. Why is this behavior ?

Then, if I leave the ping request looping, I will see after a while and only sometimes, some of the devices's IPs. This is really strange for me.

Improve this question
1
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Jan 5, 2021 at 23:09

4 Answers 4

Reset to default
3

Your (unspecified OS) is apparently only populating it's cache based on hosts it has directly contacted. As it send a frame to FF:FF:FF:FF:FF:FF, none of the previously unknown responding nodes will be learned.

Improve this answer
1
  • Thank you and sorry, my OS is Mac OS Yosemite 10.10.4, I have edited my first post. So this behavior depends on the OS I use, if I try with Linux for example it could work differently ?
    – phenetas
    Jul 9, 2015 at 23:20
3

If a broadcast relied on ARP then how could it have ARP'd in the first place? You are basically sending all packets to FF:FF:FF:FF:FF:FF. Since you have the source mac address your computer wouldn't ARP.

Improve this answer
1

What you want to do is ping the broadcast ip for the network (subnet) you are on. For example x.x.x.0/24 would have a network address of x.x.x.0 and a broadcast of x.x.x.255. If you ping the x.x.x.255 instead of the 255.255.255.255, you'll start receiving responses and when you issue the arp -a from terminal.app on your Mac, you'll see the entries. Keep in mind you may need to let your ping run for a bit so you can capture everybody. I'd open two terminal windows, ping the broadcast IP address for the subnet I'm on and run a loop to check ARP table: while true; do date; arp -a; sleep 10

Example:

Subnet = 10.0.0.0/24
Network Address = 10.0.0.0
Broadcast Address = 10.0.0.255
Range of available IP addresses: 10.0.0.1 to 10.0.0.254
Improve this answer
4
  • Hi Joseph, thank you. I think I tried before, but I tried again and the results are not really better than before. After 60 loops ( 1 minute ) pinging the x.x.x.255, I only have 8/10 devices. What I would like is a way to find an IP knowing a MAC. This is the only way I thought about and it is not working on my Mac.
    – phenetas
    Jul 10, 2015 at 2:20
  • Ah okay. Thanks for the quick reply. Alright so with that information, I'm thinking that the 2 missing hosts are discarding the broadcast attempts (typically Windows firewall is on, SELinux maybe or Mac OS X firewall). Another possibility is run NMAP, LAN Sweeper, ARPping (Synscan) or something similar. arping tool -> habets.pp.se/synscan/programs.php?prog=arping
    – Joseph Drane
    Jul 10, 2015 at 2:48
  • I should add, to prove the point: (1.) you claim you are receiving broadcasts but your Mac OS X is not storing in ARP table ----OR---- (2.) I say those 2 hosts that you know about, that are not in your ARP table, have something blocking the broadcasts.-----------> So, to prove this, go ahead and setup a packet capture on your Mac OS X device, ping the 10.11.204.255, looking at your arp table for 60 loops. Then let's look at that packet capture for all responses to the broadcast and see if there are 10 or 8 unique MAC addresses present.
    – Joseph Drane
    Jul 10, 2015 at 3:03
  • Hi, I tried this morning and there were 17 devices responding to my ping request to 10.11.204.255. After 74 loops, only 7 in the ARP table (and they come really slowly, like 1 appears from time to time, maybe every 5 or 8 loops). I investigated on some of the missing ones and they are several devices (Macs, iPads, some other things I don't know). It may look like the problems come in major part from Apple but I think this is just because people in the office mainly(only) use Macs.
    – phenetas
    Jul 10, 2015 at 18:22
0

Simple explanation those pings are being sent through multicast which is FF-FF-FF-FF in your first scenario. the router doesn't always know the mac to IP mapping and sends out a gratuitous arp...when it receives a response it isnt going to tell you about every multicast host that received the message and dropped it or didnt reply because it didnt match When you ping a single host you are getting a single MAC to IP binding and it can be filed in an ARP table.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.