Linux – how to answer a who has arp request

arplinuxmac addressnetworking

Ok this is a stupid question i know, but bear with me.

I started a new job and the networking is terrible, there are a bunch of dumb switches on top of dumb switches.

We are running a 10. network but there is something on my network that has a 192 network that keeps sending out alot of who has arp requests as well as other igmp packets. wireshark gives me the mac address but thats it. is there a way I can fake an answer to the who has request so that I can try to find this machine?

Best Answer

You can configure a single machine with a static IP address matching the ARP request and a proper netmask. The netmask has to be short enough to cover both the requested IP and the IP of the machine sending the requests. Most likely a netmask of 255.255.255.0 or 255.255.0.0 will work.

Once you have configured that static IP address on a machine it will start responding to the ARP requests. That should make the rate of the ARP requests drop. This machine will now be able to exchange IP packets with the rogue machine, and you can use other tools like for example nmap to identify what it may be running.