2

I would like to send a reverse ARP to resolve an IP address given a MAC address using nping for Windows.

The documentation is not clear on how this should work and I'm unable to find any examples online. Can anybody assist?

Here is what I have tried:

C:\>nping --arp --arp-type rarp-request --arp-target-mac 00-AA-BB-CC-DD-EE
WARNING: No targets were specified, so 0 hosts pinged.

C:\>nping --arp --arp-type rarp-request --arp-target-mac 00-AA-BB-CC-DD-EE 10.10.10.10
Starting Nping 0.6.47
SENT (0.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (1.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (2.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (3.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE

Max rtt: N/A | Min rtt: N/a | Avg rtt: N/A
Raw packets sent: 5 (210B) | Rcvd: 0 (0B) | Lost: 5 (100.00%)
PaulH
  • 181
  • 1
  • 3
  • 8
  • Please do not [double post](http://superuser.com/q/877768/212612). Rather pick the site that you feel will give you the best answer and post there. – YLearn Feb 14 '15 at 02:47

1 Answers1

2

Sorry for not answering your question with using nping only. I believe you can achieve what you’re looking for by typing :

nping --rate=5 172.16.5.0-255 & arp -a | findstr "ec-f4-bb-6a-91-9c"

The first command pings all hosts in your subnet to update your ARP table, the second prints the table and filters the mac you're looking for.

Please note that you can not reverse lookup a host that belongs to a different subnet.

Robert Houghton
  • 187
  • 5
Florian Bidabé
  • 334
  • 3
  • 10
  • That is a good method of performing an ARP scan, but that's not the same as a reverse-ARP. – PaulH Feb 19 '15 at 15:29
  • Agree but my understanding is that the protocol (rarp) is obsolete, so you would have to come with a workaround like mine to get what you want. – Florian Bidabé Feb 20 '15 at 01:24
  • In the same fashion if you do not want to update your ARP table : netsh dhcp server \\ scope show clients 1 | findstr – Florian Bidabé Feb 20 '15 at 03:24