How to send an ARP request manually? [closed]

Question

I recently sniffed with Tcpdump a packet "ARP, Request who-has 192.168.2.3 tell 192.168.2.2, length 28".

I would like to reproduce this message, and to send an ARP request from my laptop to any IP I would decide. How can I do this ?

I would be interested as well in forcing refreshing the whole ARP table. I know that deleting the table will renew it but only laptop this operation is really slow and it can take up to 1/2/5 minutes to rebuild the complete ARP table. Is there a way to force rebuilding the table, by sending a broadcasted ARP request ?

I am using a Mac with the latest OS Yosemite 10.10.4

Thank you.

Answer 1

First of all lets have a look at why we actually need ARP.

Computers on the same subnet communicate directly with each other using a layer 2 MAC address.

So if you try to contact a computers IP-address your computer calculates if the computer is on the same network.

If the computer is on the same network your computer checks if its arp table already contains the MAC address of the target host. If the table does not contain the MAC address your computer needs to obtain it.

This is done via ARP-requests (who has 192.168.2.2, send MAC address to 192.168.2.2 from your example output).

So how can you issue ARP-requests on your own?

By using what we know from above we can make your computer do so:

1. delete your ARP table (sudo arp -ad on Mac OS X)
2. contact other computers on your local network (eg ping 192.168.2.2).

The underlying network stack will check if it knows the MAC address (which it does not) and issue an ARP-request.

There is no need to have a complete arp table already before you actually need it when communicating with other hosts, but if you explicitly want to have it you could ping all hosts in your network:

for i in {1..254}; do ping -c 1 192.168.2.$i > /dev/null &; done

This command

• pings every host in your network (192.168.2.{1..254})
• once (-c 1)
• and outputs the results to /dev/null

You should have all active hosts on your network in your arp table afterwards.

Using tools

You could also use arping to issue ARP-requests for IP-addresses from your command line.

Answer 2

If your need is to reproduce the same (getting same packet again), capture the packet into a file using tcpdump (at the receiving end) and replay the captured packets using tcpreplay tool (at the sending end).

While capturing packet(s) using tcpdump, use the "-w " option to save packet(s) into a file. The captured packet(s) in the file can be replayed using tcpreply.