How to reverse arp using nping for Windows

Question

I would like to send a reverse ARP to resolve an IP address given a MAC address using nping for Windows.

The documentation is not clear on how this should work and I'm unable to find any examples online. Can anybody assist?

Here is what I have tried:

C:\>nping --arp --arp-type rarp-request --arp-target-mac 00-AA-BB-CC-DD-EE
WARNING: No targets were specified, so 0 hosts pinged.

C:\>nping --arp --arp-type rarp-request --arp-target-mac 00-AA-BB-CC-DD-EE 10.10.10.10
Starting Nping 0.6.47
SENT (0.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (1.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (2.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE
SENT (3.1560s) RARP who is 00:AA:BB:CC:DD:EE? Tell 00:AA:BB:CC:DD:EE

Max rtt: N/A | Min rtt: N/a | Avg rtt: N/A
Raw packets sent: 5 (210B) | Rcvd: 0 (0B) | Lost: 5 (100.00%)

Solution

Sorry for not answering your question with using nping only. I believe you can achieve what you’re looking for by typing :

nping --rate=5 172.16.5.0-255 & arp -a | findstr "ec-f4-bb-6a-91-9c"

The first command pings all hosts in your subnet to update your ARP table, the second prints the table and filters the mac you're looking for.

Please note that you can not reverse lookup a host that belongs to a different subnet.

Comments

[YLearn]

Please do not double post. Rather pick the site that you feel will give you the best answer and post there.

[PaulH]

That is a good method of performing an ARP scan, but that's not the same as a reverse-ARP.

[Don OzOn]

Agree but my understanding is that the protocol (rarp) is obsolete, so you would have to come with a workaround like mine to get what you want.

[Don OzOn]

In the same fashion if you do not want to update your ARP table : netsh dhcp server \\<DHCP_Server> scope <NetworkAddr> show clients 1 | findstr <MAC>