arping Times Out When You Pass a MAC Address — What the Command Actually Expects

arping is not failing because of your network — the command is being given something it was never designed to accept. It takes an IP address or hostname as its target and discovers the MAC address behind that IP. A MAC address (or a partial one) is meaningless to it, so it looks for a host that does not exist, gets no reply, and reports timeouts until it gives up.

What arping actually does

Regular ping works at layer 3: it sends an ICMP echo request to an IP address and waits for an echo reply. arping works one layer lower. It broadcasts an ARP request on the local segment — essentially "who has this IP?" — and any device holding that IP answers with its hardware address. The output shows the MAC address and response time of the target:

sudo arping -c 4 10.0.0.1
ARPING 10.0.0.1
60 bytes from a0:ad:9f:6a:a8:b0 (10.0.0.1): index=0 time=605.134 usec
60 bytes from a0:ad:9f:6a:a8:b0 (10.0.0.1): index=1 time=511.415 usec
60 bytes from a0:ad:9f:6a:a8:b0 (10.0.0.1): index=2 time=539.026 usec
60 bytes from a0:ad:9f:6a:a8:b0 (10.0.0.1): index=3 time=598.665 usec

This makes it useful for checking whether a device is physically reachable on the LAN even when ICMP is firewalled, and for detecting duplicate IP assignments (two different MACs answering for one address).

Why the original command times out

The target 12:34:56:78:9A is a MAC-style string, and arping has no mode that takes a MAC as input. It falls back to treating the string as a hostname, asks the resolver for it, finds nothing reachable, and simply waits. Two additional problems hide in that argument:

• It is not even a complete MAC. A hardware address has six octets; this one has five, so no tool could act on it as given.
• MAC-to-IP is a lookup, not a broadcast. A MAC address alone cannot be pinged. Something on your network has to already know which IP owns that MAC — a neighbor table, a DHCP lease file, or an active scan.

Running it correctly

Give arping an IP or a name that resolves to one, and run it with elevated privileges, because crafting and sniffing raw ARP frames requires root or CAP_NET_RAW (the package may be installed setuid on Ubuntu, but using sudo is the reliable habit):

sudo arping -c 4 10.0.0.1        # by IP
sudo arping -c 4 router.local    # by hostname
sudo arping -c 4 -I eth1 10.0.0.1  # force a specific interface

Successful output ends with a statistics block like 4 packets transmitted, 4 packets received, 0% unanswered. If a host answers on the LAN but ping fails to it, the device is alive and simply dropping ICMP — a common firewall behavior.

When you only know the MAC address

Reverse the workflow: collect IP-to-MAC pairs first, then arping the IP. Several options:

• Check the kernel's neighbor table — any host you have recently talked to appears here with both its IP and MAC:

  ip neigh show
  

• Sweep the local segment with a tool built for this. arp-scan sends ARP requests to every address in the attached subnet and prints the full IP/MAC/vendor mapping:

  sudo arp-scan --local
  

• Ping the subnet and re-read the table. A quick ping -b to the broadcast address or a short address-range ping populates ip neigh with fresh entries.
• Consult your router — DHCP lease lists in the router's admin UI show hostname, IP, and MAC together.

Once you know the IP behind the MAC, arping that IP to confirm the device responds at layer 2.

Other reasons arping times out

If you are passing a valid IP and still seeing nothing but timeouts, work through this list:

• Missing privileges. Without root the tool may not be able to open a raw socket; always test with sudo.
• Wrong interface. On multi-homed machines the ARP request may leave an interface with no path to the target; pin it with -I <iface>.
• Target on another subnet. ARP does not cross routers. arping only reaches devices on the same layer-2 segment, so it cannot probe a host behind a router the way ping can.
• Wireless isolation or a switch blocking broadcast traffic can also suppress replies even though unicast traffic flows.

Frequently Asked Questions

Can arping look up an IP from a MAC address?

No. It works strictly in the IP-to-MAC direction. To go the other way, use ip neigh, arp-scan, or your router's DHCP lease table to find the pairing first.

Why does arping need sudo when ping does not?

It builds and reads raw Ethernet frames containing ARP packets, which requires raw socket access. Modern ping has been given restricted capabilities by distributions; arping typically still needs root or a setuid/capabilities setup.

Does arping work over Wi-Fi?

Yes, as long as the target is on the same broadcast domain. Specify your wireless interface with -I if the machine has several interfaces.

What is the difference between arping and ping for troubleshooting?

Use ping to test end-to-end IP reachability, including across routers. Use arping to test raw layer-2 reachability on the local segment and to reveal the hardware address behind an IP — handy when ICMP is filtered or when you suspect an IP conflict.

My two printers share one IP and arping shows two MACs — is that bad?

Yes. Two different MAC addresses answering for one IP indicates an address conflict. Find the DHCP scope or static assignment causing the overlap and give one of the devices its own address.