nanog mailing list archives
Re: Sending ARP request to unicast MAC instead of broadcast MAC address?
From: James Hess <mysidia () gmail com>
Date: Wed, 16 Jun 2010 18:20:54 -0500
On Wed, Jun 16, 2010 at 5:57 PM, Chris Woodfield <rekoil () semihuman com> wrote:
OK, this sounds Really Wacky (or, Really Hacky if you're into puns) but there's a reason for it, I swear...
Will typical OSS UNIX kernels (Linux, BSD, MacOS X, etc) reply to a crafted ARP request that, instead of having FF:FF:FF:FF:FF:FF as its destination MAC address, is instead sent to the already-known unicast MAC address of the host?
In general, hosts respond to these in just the same way as they would respond to a broadcast arp request.
Next, what would be your utility of choice for crafting such a packet? Or is this something one would need to code up by hand in a lower-level language?
arping from the iputils package will switch to unicast requests after the first unicast ARP response is received, and send the rest of the pings using unicast arp, assuming you don't use the -b option -- -JH
Current thread:
- Sending ARP request to unicast MAC instead of broadcast MAC address? Chris Woodfield (Jun 16)
- Re: Sending ARP request to unicast MAC instead of broadcast MAC address? James Hess (Jun 16)
- Re: Sending ARP request to unicast MAC instead of broadcast MAC address? Ingo Flaschberger (Jun 16)
- Re: Sending ARP request to unicast MAC instead of broadcast MAC address? Crist Clark (Jun 17)
- Re: Sending ARP request to unicast MAC instead of broadcast MAC address? Chris Woodfield (Jun 17)
- Re: Sending ARP request to unicast MAC instead of broadcast MAC address? Steven King (Jun 17)