# Check IP by using "arping"

###### tags: `arp` `network`

Traditionally to know whether a remote host is running or crashed, we use ping to check.

But when you only know the MAC address of the remote host, you will check the ARP table cache to find its IP address. If there is no ARP entity that map to the MAC address, you may use 'arping' to check.

!!! to use arping, the remote host has to disable "icmp echo ignore broadcast" feature.

echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_broadcasts
echo "0" > /proc/sys/net/ipv4/icmp_echo_ignore_all

You can use "arping <MAC address of remote host>" to get information similar to the reply information from ping command and then you can get the IP address of the remote host.

root@localhost:/home/floodlight# arping -c 3 -i eth0 08:00:27:65:2d:7b
ARPING 08:00:27:65:2d:7b
60 bytes from 192.168.56.102 (08:00:27:65:2d:7b): icmp_seq=0 time=522.000 usec
60 bytes from 192.168.56.102 (08:00:27:65:2d:7b): icmp_seq=1 time=210.000 usec
60 bytes from 192.168.56.102 (08:00:27:65:2d:7b): icmp_seq=2 time=301.000 usec

--- 08:00:27:65:2d:7b statistics ---
3 packets transmitted, 3 packets received,   0% unanswered (0 extra)

parameters:
-c <number of ping echo>
-i <output interface to remote machine>