macOS uses arping to scan for ip conflicts

Original link: https://blog.frytea.com/archives/644/

75

Recently, the working network has been unstable, and many commonly used IPs have conflicted. Even the IP obtained by DHCP will conflict immediately. The reason is waiting for relevant personnel to solve it. Today, I will briefly record the reasons for IP conflict detection under macOS.

The general way to check if an IP is occupied is to use ping

 $ ping 119.29.29.29 PING 119.29.29.29 (119.29.29.29): 56 data bytes 64 bytes from 119.29.29.29: icmp_seq=0 ttl=50 time=14.477 ms 64 bytes from 119.29.29.29: icmp_seq=1 ttl=50 time=15.033 ms 64 bytes from 119.29.29.29: icmp_seq=2 ttl=50 time=15.330 ms ^C --- 119.29.29.29 ping statistics --- 3 packets transmitted, 3 packets received, 0.0% packet loss round-trip min/avg/max/stddev = 14.477/14.947/15.330/0.354 ms

However, this method cannot see IP conflicts. If multiple machines occupy the same IP, you can use the arp protocol to check the MAC address:

 # macOS 下这样安装$ brew install arping # 使用alias 定义快速使用别名$ alias arping='sudo /opt/homebrew/opt/arping/sbin/arping'

In addition, it is found that the brew installation arping under m1 will not enter the PATH by default, so an alias is manually set here for convenience.

After scanning, if there is an IP conflict, you can see that there are multiple MAC addresses responding:

 $ sudo /opt/homebrew/opt/arping/sbin/arping 192.168.5.79 Password: ARPING 192.168.5.79 60 bytes from 6a:f2:77:bd:bf:16 (192.168.5.79): index=0 time=463.000 usec 60 bytes from 6a:29:af:20:80:7f (192.168.5.79): index=1 time=1.002 msec 60 bytes from 6a:f2:77:bd:bf:16 (192.168.5.79): index=2 time=582.000 usec 60 bytes from 6a:29:af:20:80:7f (192.168.5.79): index=3 time=1.182 msec 60 bytes from 6a:f2:77:bd:bf:16 (192.168.5.79): index=4 time=658.000 usec 60 bytes from 6a:29:af:20:80:7f (192.168.5.79): index=5 time=1.117 msec 60 bytes from 6a:f2:77:bd:bf:16 (192.168.5.79): index=6 time=772.000 usec 60 bytes from 6a:29:af:20:80:7f (192.168.5.79): index=7 time=1.096 msec ^C --- 192.168.5.79 statistics --- 4 packets transmitted, 8 packets received, 0% unanswered (4 extra) rtt min/avg/max/std-dev = 0.463/0.859/1.182/0.257 ms

You can also check whether the IP is occupied by arping. Some machines will prohibit PING detection. It will be more accurate to use a layer-2 protocol such as arp to detect the occupancy.

references

This article is reproduced from: https://blog.frytea.com/archives/644/
This site is for inclusion only, and the copyright belongs to the original author.