3

When I run the arp command I get the following:

mark@mark-P8Z77-I-0:~$ arp
Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.128            ether   08:86:3b:c8:d8:09   C                     eth0
192.168.1.4              ether   e0:91:f5:7c:7c:34   C                     eth0
192.168.1.110            ether   9c:d3:6d:b1:d3:49   C                     eth0
192.168.1.101            ether   94:10:3e:48:60:0d   C                     eth0
mark-N3050T              ether   d0:17:c2:ad:ff:58   C                     eth0
192.168.1.117            ether   b8:27:eb:ad:2e:72   C                     eth0
192.168.1.129                    (incomplete)                              eth0
192.168.1.103            ether   ec:1a:59:cb:42:25   C                     eth0
192.168.1.111            ether   54:4a:16:02:54:a8   C                     eth0
192.168.1.127            ether   84:ba:3b:05:6d:45   C                     eth0
192.168.1.106            ether   a4:77:33:2b:29:40   C                     eth0
192.168.1.122            ether   00:18:dd:04:6a:cc   C                     eth0
mark-N53Jf               ether   48:5d:60:71:7f:be   C                     eth0
gateway                  ether   28:c6:8e:20:a8:e5   C                     eth0

All three hostnames that are present in the report can also be pinged using ping hostname The arp table, /proc/net/arp contains only ip addresses:

mark@mark-P8Z77-I-0:~$ cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
192.168.1.128    0x1         0x2         08:86:3b:c8:d8:09     *        eth0
192.168.1.4      0x1         0x2         e0:91:f5:7c:7c:34     *        eth0
192.168.1.110    0x1         0x2         9c:d3:6d:b1:d3:49     *        eth0
192.168.1.101    0x1         0x2         94:10:3e:48:60:0d     *        eth0
192.168.1.138    0x1         0x2         d0:17:c2:ad:ff:58     *        eth0
192.168.1.117    0x1         0x2         b8:27:eb:ad:2e:72     *        eth0
192.168.1.129    0x1         0x0         00:00:00:00:00:00     *        eth0
192.168.1.103    0x1         0x2         ec:1a:59:cb:42:25     *        eth0
192.168.1.111    0x1         0x2         54:4a:16:02:54:a8     *        eth0
192.168.1.127    0x1         0x2         84:ba:3b:05:6d:45     *        eth0
192.168.1.106    0x1         0x2         a4:77:33:2b:29:40     *        eth0
192.168.1.122    0x1         0x2         00:18:dd:04:6a:cc     *        eth0
192.168.1.121    0x1         0x2         48:5d:60:71:7f:be     *        eth0
192.168.1.1      0x1         0x2         28:c6:8e:20:a8:e5     *        eth0

What service does the arp command and ping use to resolve the hostname?

I have tried several but the closest I get is avahi-browse. However it reports more hostnames on my network than arp reports and all have .local appended to the name.

Also two of the three hostnames that arp reports are remote ubuntu systems. I do not recall performing any special configuration on those systems to permit this behavior. The "gateway" hostname is provided by the router. One of the connected systems is a raspian system.

How would I configure the raspian for this behavior? How are the hostnames transferred?

What command would I use to resolve these hostnames?

A final note: The hostnames seem to come and go based on how stale the data is but I have not fully investigated this. I only know that I need to ping from a given (ubuntu) host for it to capture hostnames of other systems. I have not scoped out what queries most rapidly fill this information.

After reviewing the comments as of 8:00PM EST Dec. 18. I can share the following information: The hosts line in /etc/nsswitch.conf:

hosts:          files mdns4_minimal [NOTFOUND=return] resolve [!UNAVAIL=return] dns mdns4 myhostname

no remote hosts are listed in /etc/hosts

avahi-resolve-address resolves the following:

192.168.1.1    Failed to resolve: Timeout reached (is "gateway")
192.168.1.117 raspberrypi.local    (shows in arp report as 192.168.1.117)
192.168.1.138 mark-3050T.local    (shows in arp as mark-3050T)
192.168.1.130 is currently offline but is similar to 192.168.1.130

Though mark-N3050T is reported by arp, pinging it fails. ping mark-N3050T.local fails but ping 192.168.1.138 succeeds ping gateway succeeds. ping raspberrypi.local succeeds even though raspberrypi is not reported by arp

When I was writing my original post ping mark-N3050T would work so some ageing is occurring that removes this hostname. I have not found the command that will refresh the hostname. The difference between arp and ping is that arp is resolving an IP address to a hostname while ping is performing the opposite. However, I would expect symmetry in the answers.

I am only pursuing this to increase my understanding of how LAN networking works. I do appreciate anyone who is willing to assist me.

Improve this question

2 Answers 2

Reset to default
9

Here is the sequence:

  • At first arp gets it's data (cache) from /proc/net/arp, Linux exposes it's ARP cache via the psuedo procfs filesystem's /proc/net/arp file for the userland. The kernel does not store any domain name, only IP addresses; this is analogous to using arp -n

  • Now when you want arp to get you the hostnames, arp will simply follow the glibc's nsswitch configuration, precisely /etc/nsswitch.conf, and will try to get you the hostnames using the very sequence mentioned in that file e.g. an example is hosts: files mdns4 dns, in this case arp will:

    • Check the /etc/hosts file
    • Then mdns (Multicast DNS)
    • General DNS

    Just to note, if you see .local at the end of a domain name, then it's (presumably) resolved by mdns (unless you actually have such a TLD).

Improve this answer
1
  • 1
    Thanks. You describe what I largely suspected. However, I cannot seem to find commands that return the same information that arp returns. For example, on my main machine I can ping "mark-N3050T", "mark-N53Jf", and "gateway". I can also ping "raspberrypi.local" but not "raspberrypi", neither hostname being returned by arp. If i use avahi-browse to see what information mndns4-minimum might use I see .local for mark-N3050T, mark-N53Jf and raspberrypi. I do not see anything for gateway. I probably need to sniff my network more carefully to see how the hostnames are being exchanged.
    – mrh53
    Dec 19, 2016 at 1:10
1

address resolution protocol (ARP) broadcasts an ARP request packet to all hosts on the network saying

Source=MAC-ADDRESS B
Destination=????    
who-has IP A Tell IP B

where IP A is the ip your looking for and IP B is your IP Address, if the receving computer's ip address matches it sends a unicast ARP reply back to your computer with 

Source=MAC-ADDRESS A
Destination=MAC-ADDRESS B    
IP A is-at MAC-Address A

and thats all arp dose

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .