Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A product I'm testing appears to freak out when it receives an ARP request with a Sender IP Address of This is not an ARP probe, as the request is addressed to my module, and the customer's system sends the request just before it starts using its own valid IP address, which is different than my module's IP address. The problem is recreating that here in the lab rather than having to travel to the customer's site.

Is there software I can use to generate an ARP request from a fake address? This is similar to, but not quite the same as, ARP spoofing, since I'm trying to fake the request and not the reply. Do any of the spoofing tools have this functionality? Or is there a way to force Windows or Linux to send an ARP probe?

share|improve this question
up vote 4 down vote accepted

I think arpspoof in the dsniff package will do what you need.

share|improve this answer
Thanks, that wasn't quite it, but exploring the dependencies led me to the winpcap API, which has library functions to write any stream of bytes you want out on the wire. I can use that to make the fake ARP requests. – Sam Skuce Sep 27 '10 at 15:25

There's some sample code and documentation at

There's also a bit of additional background in this thread:

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.