32

On Linux and other systems, there is an utility called arping which can be used to send ARP requests ("pings") and show the answers, much like the "ping" utility but using ARP instead of ICMP.

Is there any way to do the same on Windows? (I use Windows 7)

12 Answers 12

15

Arping for windows does actually exist.

http://freshmeat.net/projects/arping/

Correction: this is for Linux, MAC OSX, etc... but can be installed on windows through cygwin.

1
  • To be clear, anything on the network nowadays needs to respond to ARP, therefore just about anything "supports" ARP pinging. Whether or not they have a nice packaged-with-a-bow utility for doing so is the question. Jun 14, 2017 at 16:56
16

If you clear Window's arp cache ( arp -d ) and then try to ping the ip address, it will issue a arp broadcast.

Check it out with Wireshark.

3
  • Is this behavior guaranteed?
    – Pacerier
    Apr 11, 2015 at 8:59
  • 2
    @Pacerier: Yes, since ICMP (ping) is built on top of the IP layer. The IP layer needs the hardware address for a given IP address in order to know who to send its packet to. If the ARP cache is empty, the IP layer will have no choice but to issue an ARP request before it can send the packet.
    – Cameron
    Oct 7, 2015 at 16:50
  • 1
    This behavior is NOT guaranteed. It will only happen if the IP address is reachable according to subnet rules; otherwise it will use the IP address of the default gateway to issue an ARP request. Aug 17, 2016 at 6:31
9

A built in way to do this in windows:

cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in () do @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! "  

If you want to show a fresh ARP result each time (Needs to run as administrator)

cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in () do @arp -d & @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! "
5
  • Wow, this is hardcore -- I love i! And it's almost working here. Actually I had to add a space between -n and 1 so it became: ... @ping -n 1 ...
    – saulius2
    Apr 18, 2016 at 11:56
  • This loop runs for ever. I think what you intended is cmd /V /C "set "IP=10.0.2.2" & FOR /L %i in (1,1,2) do @ping -n 1 -w 1000 "!IP!" >NUL & arp -a | findstr /c:"!IP! " which runs twice and so picks up duplicate MAC addresses.
    – parsley72
    Aug 22, 2018 at 3:55
  • Could you explain what this command is doing?
    – Penguin9
    May 13, 2020 at 1:29
  • 1
    @RaisingAgent Sure, as we are using a variable within the command, we use a variable expanded command prompt (/v) that runs once (/c). Then sets an IP address to your target ip Then creates an endless loop, that will ping and then ARP resolve a target
    – sparks
    May 14, 2020 at 3:32
  • -w 0 works just as well, there's no need to wait for the ping to return at all. Much faster if you're adapting this to run in a loop for multiple IPs
    – JeffUK
    Oct 14, 2023 at 10:03
6

WinXP's ARP command is for displaying data only. Try Nmap, it's free and fairly easy for this type of scan. Nmap is available at insecure.org.

2
  • 5
    That's probably the closest I can get to the arping utility (using nmap -PR -sP <host>). Congratulations, you won. Oct 13, 2009 at 19:03
  • 1
    @e-t172 With newer versions of nmap, the command nmap -PR -sn <host> is preferred. -sP is deprecated. Also, this only worked for me when I ran it as root.
    – Nic
    Jun 23, 2013 at 3:12
6

Try "arp-ping.exe"

Thought I would add this tool which runs directly from the command prompt:

arp-ping.exe command line options

Usage: arp-ping.exe [options] target
        -s ip : specify source ip
        -n X  : ping X times
        -t    : ping until stopped with CTRL-C
        -x    : exit immediately after successful ping
        -i X  : ping every X seconds
        -d    : do an 'arp -d *' between pings (requires Administrator)
                (-d prevents cached ARP responses on Windows XP.)
        -c    : include date and time on each line
        -m X  : ignore failures that take less than X milliseconds
        -.      : print a dot (.) for every ignored failure
        -l    : print debug log
        -v    : print version and exit

Versus the Linux "arping" command line options

Usage: arping [-fqbDUAV] [-c count] [-w timeout] [-I device] [-s source] destination
-f : quit on first reply
-q : be quiet
-b : keep broadcasting, don't go unicast
-D : duplicate address detection mode
-U : Unsolicited ARP mode, update your neighbours
-A : ARP answer mode, update your neighbours
-V : print version and exit
-c count : how many packets to send
-w timeout : how long to wait for a reply
-I device : which ethernet device to use (eth0)
-s source : source ip address
destination : ask for what ip address
3

You can check this out: https://github.com/seladb/PcapPlusPlus/tree/master/Examples/Arping. This is a cross-platform Arping that can work both on Windows, Linux and Mac OS X

2

This is not exactly an ARP "ping" but running "arp inet_addr (ip address)" from a command prompt will send a single ARP request to the host specified in (ip address). You can then run "arp -a" to see the result.

5
  • Just doesn't work. I get my prompt back but nothing happened. A sniffer didn't show any ARP requests coming out. Same result if the IP address is not already in the ARP table. Sep 30, 2009 at 10:57
  • Right, you don't get a result back. The command sends a single ARP request to the ip address, which you can then see the result by issuing the arp -a command. I said it's not exactly an arp ping, but it does send a single arp request.
    – joeqwerty
    Sep 30, 2009 at 11:11
  • No it doesn't. As I said, a network sniffer doesn't show any ARP request going out, and no entry is added to arp -a. Sep 30, 2009 at 17:16
  • That's strange. It works exactly as I described on Windows 7 but not on Windows XP. Sorry.
    – joeqwerty
    Sep 30, 2009 at 19:44
  • 1
    Doesn't work for me either on Win7, sorry.
    – Cameron
    Oct 7, 2015 at 16:59
1

I believe you can arp-ping with CAIN, which is free.

1

Hardping is a decent program that does this.

There's the full version that costs money that's more of a ping sweep program, but I just use the freeware version. The free one only does 1 ip at a time, but that's all I needed it for.

You'd use it like c:>hardping 192.168.1.1 and it would reply with the mac or not.

I think they took it off their site, but you can still find it by googling "hardping freeware"

1

How to Get an ARP Table with an IP Helper API http://www.codeguru.com/cpp/i-n/internet/internetprotocolip/article.php/c6153

GetIpNetTable: Retrieves address resolution table information.

SetIpNetEntry: Adds entry to the ARP table.

DeleteIpNetEntry: Deletes entry from the ARP table.

CreateIpNetEntry: Creates an entry in the ARP table.

FlushIpNetTable: Deletes all ARP entries for the specified interface from the ARP table

SendARP: Sends an ARP request to obtain the physical address that corresponds to the specified destination IP address.

1
  • link is broken - 404
    – Spike0xff
    Jul 6, 2023 at 3:28
0

Unfortunately there is not a built in tool to do this in Windows, there are some third party tools that will do this such as Netscan, but its not free

0
arp -a your.ip.here.jo

ex: arp -a 192.168.0.1

1
  • This command will only lookup against the current arp cache, not issue a new arp "Who has 192.168.0.1?" request
    – Chriz
    Sep 4, 2018 at 15:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .