netdev - Re: Duplicate IP false alerts from arping

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <j2m1f8bbe3c1004162111mf87a7fbck9e8eafb36be48687@mail.gmail.com>
Date:	Sat, 17 Apr 2010 09:41:25 +0530
From:	unni krishnan <unnikrishnan.a@...il.com>
To:	netdev@...r.kernel.org
Cc:	linux-net@...r.kernel.org
Subject: Re: Duplicate IP false alerts from arping

Hi,

I am trying to find a duplicate IP in the network using arping.

 -------------------------
 [root@...1 ~]# ping -c 3 192.168.1.212
 PING 192.168.1.212 (192.168.1.212) 56(84) bytes of data.
 64 bytes from 192.168.1.212: icmp_seq=1 ttl=64 time=1.33 ms
 64 bytes from 192.168.1.212: icmp_seq=2 ttl=64 time=0.280 ms
 64 bytes from 192.168.1.212: icmp_seq=3 ttl=64 time=0.306 ms

 --- 192.168.1.212 ping statistics ---
 3 packets transmitted, 3 received, 0% packet loss, time 1999ms
 rtt min/avg/max/mdev = 0.280/0.641/1.339/0.494 ms
 [root@...1 ~]# arping -D -I eth0 -c 5 192.168.1.212 ; echo $?
 ARPING 192.168.1.212 from 0.0.0.0 eth0
 0
 -------------------------


 As per arping that IP is duplicate. But if I go ahead and ifdown the
 IP in the known location I cant ping that IP ( That means that IP is
 not duplicated ? ). This is the result after shutting down the IP.

 --------------------------
 [root@...1 ~]# ping -c 3 192.168.1.212
 PING 192.168.1.212 (192.168.1.212) 56(84) bytes of data.
 From 192.168.1.63 icmp_seq=1 Destination Host Unreachable
 From 192.168.1.63 icmp_seq=2 Destination Host Unreachable
 From 192.168.1.63 icmp_seq=3 Destination Host Unreachable

 --- 192.168.1.212 ping statistics ---
 3 packets transmitted, 0 received, +3 errors, 100% packet loss, time 2001ms
 , pipe 3
 [root@...1 ~]# arping -D -I eth0 -c 5 192.168.1.212 ; echo $?
 ARPING 192.168.1.212 from 0.0.0.0 eth0
 Sent 5 probes (5 broadcast(s))
 Received 0 response(s)
 0
 [root@...1 ~]#
 --------------------------

 My question is, in this case IP 192.168.1.212 is not duplicated. But
 still arping gives duplicate status. Why it is like that ?

 --
 Regards,
 Unni
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html