Can one ping a NIC by MAC

Question

I have an NIC card on a Debian machine somewhere. The machine is turned off, but I need to know whether the NIC card is turned on so that I can send a wake-on-lan magic packet later (from another Debian machine) to wake it up. I have the MAC address of the card. Is there any way I can ping the ethernet card by MAC to see whether it is on?

I tried creating an ARP entry:

arp -s 192.168.2.2 00-0c-0d-ef-02-03
ping 192.168.2.2

That didn't work, since the NIC card does not have this ip address. So the NIC card would receive the ping request but would not reply to it. Is there any way around this?

I am using the etherwake package to send a wake-on-lan message.

Answer 1

You might have better luck using the tool arping instead. The tool ping works at the layer 3 level of the OSI model, whereas arping works at layer 2.

You still need to know the IP of the system however with this tool. There are 2 versions of it, the standard one included with most Unixes (Alexey Kuznetsov's) is the version that can only deal with IP addresses. The other version (Thomas Habets') supposedly can query using MAC addresses.

$ sudo arping 192.168.1.1 -c 1
ARPING 192.168.1.1 from 192.168.1.218 eth0
Unicast reply from 192.168.1.1 [00:90:7F:85:BE:9A]  1.216ms
Sent 1 probes (1 broadcast(s))
Received 1 response(s)

arping works similarly to ping except instead of sending ICMP packets, it sends ARP packets.

Getting a system's IP using just the MAC

Here are a couple of methods for doing the reverse lookup of MAC to IP.

1. nmap

   $ nmap -sP 192.168.1.0/24
   

   Then look in your arp cache for the corresponding machine arp -an.

2. fping

   $ fping -a -g 192.168.1.0/24 -c 1
   

   Then look in your arp cache, same as above.

3. ping

   $ ping -b -c1 192.168.1.255
   

   Then look in your arp cache, same as above.

4. nbtscan (windows only hosts)

   $ nbtscan 192.168.1.0/24
   
   Doing NBT name scan for addresses from 192.168.1.0/24
   
   IP address       NetBIOS Name     Server    User             MAC address      
   ------------------------------------------------------------------------------
   192.168.1.0 Sendto failed: Permission denied
   192.168.1.4      MACH1            <server>  <unknown>        00-0b-12-60-21-dd
   192.168.1.5      MACH2            <server>  <unknown>        00-1b-a0-3d-e7-be
   192.168.1.6      MACH3            <server>  <unknown>        00-21-9b-12-b6-a7
   

Answer 2

You cannot ping a normal NIC because NIC alone does not send any replies.

Only a running computer is able send replies

Normal network interface cards do not send any replies by themselves. They always need a running software on the computer to do so.

When the CPU of the computer is powered down then there is no running software which would send a reply to a ping.

Wake-on-LAN is unidirectional

Wake-on-LAN allows the computer to let just the NIC be partially powered on to receive Ethernet frames and look for the magic wake-up sequence in them but the NIC will still not send any reply. Wake-on-LAN is strictly unidirectional. There are no responses sent.

Exceptions

There are certain special NICs which could send replies by themselves like for example ones implementing a complete TCP handshake offload.

Answer 3

The ether-wake command will work by mac address, so surely you (a) won't need an IP address and (b) can send the command without harm (if it's already awake, waking it will have no impact?)

You can see the list of your existing arp cache by using arp -an and grepping for your MAC to get the IP of the target host. However, because arp is a cache, it may have been "timed out" of the cache (and still be 'awake'). You then may have to use a brute force method to find it's IP, such as:

 sudo nmap -sP 192.168.2.0/24 | less  

(and then look for 00:0c:0d:ef:02:03) - provided firewalls and other such things don't get in the way!

Answer 4

My application was a server RSYNCing into a workstation to get the workstation's Document directory... but the workstation did not have a guaranteed IP address but did have a known MAC address (IP address was done by DHCP). this code uses ping ONLY.

export COUNTER=1
while [ $COUNTER -lt 255 ]
do
    #ping $1$COUNTER -c 1 -w 400 | grep -B 1 "Lost = 0" &
    # activate all 254 addresses  in the subnet..  dont really need to grep the ping output
    ping 192.168.0.$COUNTER -c 1 -w 4 2> /dev/null | grep -B 1 ' 0\% packet loss' > /dev/null &
    COUNTER=$(( $COUNTER + 1 ))
done
# wait till 254 background processes finished
wait
# the arp cache will automatically flush it's incomplete entries in about 10 minutes...
#echo "finished"

#
#SRC_SERVER_IP="192.168.0.160:873"
SRC_SERVER_IP=$(arp -a | grep "00:22:4d:81:8f:76" | awk '{print $2}' | sed 's/[()]//g')":873"

if [ $SRC_SERVER_IP == ":873"   ] ; then
    echo  "ws1.example.com is not on the network...  exiting..."
    exit 0
fi

Answer 5

Here is a simple script to ping via mac address. Just save and run e.g
macping aa:bb:cc:dd:ee:ff

You can also daisy chain the result to conditionally do other things, e.g:

macping aa:bb:cc:dd:ee:ff && echo do something if online || echo do something if offline

-

#!/bin/bash
network=192.168.1.1/24

if [ "$#" -ne 1 ]; then echo Usage example: $0 aa:bb:cc:dd:ee:ff; exit 2; fi;

nmap -sP $network >& /dev/null
ip=$(arp -n | grep $1 | awk ' { print $1 }')
ping $ip -n -q -c 2 -i 0.2 -w 1 >& /dev/null
if [ $? -eq 0 ]; then
    echo Device is online \($ip\)
else
    echo Device is offline
    exit 1
fi;

Answer 6

This doesn't rely on differing versions of arping nor on complex bash scripts:

ping $(arp-scan --localnet | grep 80:1f:02:fa:90:b7  | awk ' { printf $1 } ')

I've used arp-scan rather than arp as it seems to run a lot faster.