Ask Ubuntu is a question and answer site for Ubuntu users and developers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

how can i detect - using bash if possible - that specific (i.e. name or mac address) machine has appeared in local network? IP addresses are dynamically assigned, so I can't rely on "traditional" ping.

share|improve this question

If you know the MAC address then you can ping it with arping

share|improve this answer
I don't think this works, unintuitively, arping requires an ip address :/ – roadmr Feb 18 '13 at 19:51
You can use a MAC address with arping; it just sends an ARP request which the host will reply to if it's present. – jgm Feb 18 '13 at 19:54
$ arping 00:14:bf:21:73:34 arping: unknown host 00:14:bf:21:73:34 - Maybe I have the wrong version of arping. – roadmr Feb 18 '13 at 20:01
Not sure seems to work for me # arping -c 1 e0:f8:47:2a:b2:8c ARPING e0:f8:47:2a:b2:8c 60 bytes from (e0:f8:47:2a:b2:8c): icmp_seq=0 time=1.064 msec – jgm Feb 18 '13 at 20:06
apparently there are two implemenations of arping, which one are you using? – ts01 Feb 19 '13 at 10:28

The easiest solution is to check the DHCP server's logs, if you have access to them.

Otherwise, you can use the traditional ping command to broadcast ping the local LAN and look in your system's local ARP table to see if your target host has replied. This does not require knowing the target's IP address, only its MAC. Example:

ping=`which ping`
iface=eth0 # MAYBE CHANGE THIS
bcast=`ip a ls $iface | awk '/inet? /{ print $4 ; exit }'`
cmd="$ping -bnrc1 $bcast"
target_mac='00:11:22:33:44:55' # DEFINITELY CHANGE THIS
if [[ -u $ping ]] ; then $cmd ; else sudo $cmd ; fi
grep $target_mac /proc/net/arp

This is similar to 'arping' in that it should trigger an ARP reply, only it's noisier. For this reason, add '-r' to limit it to the local LAN, use the directed broadcast address (that awk snippet grabs it, but you may need to adjust 'iface') instead of '', and send only one ICMP echo request with '-c1'. Turn off reverse DNS resolution with '-n'.

'ping' will only honor the '-b' broadcast option if it is setuid root or you have root privileges, so I've wrapped it in an if/else to catch that.

share|improve this answer

You need to actively monitor traffic in order to do this. Look at arpalert or arpwatch. arping is also an option but it won't work in this case because it needs the target ip address.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.