how can i detect - using bash if possible - that specific (i.e. name or mac address) machine has appeared in local network? IP addresses are dynamically assigned, so I can't rely on "traditional" ping.
Add a comment
|
3 Answers
If you know the MAC address then you can ping it with arping
-
I don't think this works, unintuitively, arping requires an ip address :/– roadmrFeb 18, 2013 at 19:51
-
You can use a MAC address with arping; it just sends an ARP request which the host will reply to if it's present.– jgmFeb 18, 2013 at 19:54
-
$ arping 00:14:bf:21:73:34 arping: unknown host 00:14:bf:21:73:34- Maybe I have the wrong version of arping.– roadmrFeb 18, 2013 at 20:01 -
Not sure seems to work for me
# arping -c 1 e0:f8:47:2a:b2:8c ARPING e0:f8:47:2a:b2:8c 60 bytes from 10.0.0.92 (e0:f8:47:2a:b2:8c): icmp_seq=0 time=1.064 msec– jgmFeb 18, 2013 at 20:06 -
apparently there are two implemenations of arping, which one are you using?– ts01Feb 19, 2013 at 10:28
The easiest solution is to check the DHCP server's logs, if you have access to them.
Otherwise, you can use the traditional ping command to broadcast ping the local LAN and look in your system's local ARP table to see if your target host has replied. This does not require knowing the target's IP address, only its MAC. Example:
ping=`which ping`
iface=eth0 # MAYBE CHANGE THIS
bcast=`ip a ls $iface | awk '/inet? /{ print $4 ; exit }'`
cmd="$ping -bnrc1 $bcast"
target_mac='00:11:22:33:44:55' # DEFINITELY CHANGE THIS
if [[ -u $ping ]] ; then $cmd ; else sudo $cmd ; fi
grep $target_mac /proc/net/arp
This is similar to 'arping' in that it should trigger an ARP reply, only it's noisier. For this reason, add '-r' to limit it to the local LAN, use the directed broadcast address (that awk snippet grabs it, but you may need to adjust 'iface') instead of '255.255.255.255', and send only one ICMP echo request with '-c1'. Turn off reverse DNS resolution with '-n'.
'ping' will only honor the '-b' broadcast option if it is setuid root or you have root privileges, so I've wrapped it in an if/else to catch that.
You need to actively monitor traffic in order to do this. Look at arpalert or arpwatch. arping is also an option but it won't work in this case because it needs the target ip address.
