Usually we use the ping command to check if a machine exists at the address we ping, if we get a reply (Pong!) we know there’s a machine at that address. The traditional ping works using the ICMP protocol and sends icmp-echo-request (Ping) and icmp-echo-reply (Pong) packets. A machine can choose to ignore the echo requests and don’t reply in order to hide itself.
We can use the ARP protocol which is used to resolve MAC addresses of hosts to ping machine on a local area network. We can use that technique to map a LAN in a less obvious way and hope to avoid detection by a diligent sysadmin.
Here’s a Python script that uses the Scapy library to preform a ARP ping on a single target.
#!/usr/bin/python
# Sends an arp resolution request on broadcast for an IP address
# If reply is received within timeout the host is alive
# aviran.org
from scapy.all import *
import sys
Timeout=2
if len(sys.argv) != 2:
print "Usage: arp_ping.py IP"
sys.exit(1)
answered,unanswered = srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst=sys.argv[1]),timeout=Timeout,verbose=False)
if len(answered) > 0:
print answered[0][0].getlayer(ARP).pdst, "is up"
elif len(unanswered) > 0:
print unanswered[0].getlayer(ARP).pdst, " is down"