NAME¶
farpd —
ARP reply daemon
SYNOPSIS¶
farpd |
[ -d
]
[-i
interface
]
[net ... ] |
DESCRIPTION¶
farpd replies to any ARP request for an IP
address matching the specified destination
net with the hardware MAC address of the
specified
interface, but only after
determining if another host already claims it.
Any IP address claimed by
farpd is eventually
forgotten after a period of inactivity or after a hard timeout, and is
relinquished if the real owner shows up.
This enables a single host to claim all unassigned addresses on a LAN for
network monitoring or simulation.
farpd exits on an interrupt or termination
signal.
Note: The program name
farpd has been changed
in Debian GNU/Linux from the original name (
arpd) to avoid name clash
with other ARP daemons.
The options are as follows:
-d- Do not daemonize, and enable verbose debugging messages.
-i
interface- Listen on interface. If unspecified,
farpd searches the system interface
list for the lowest numbered, configured ``up'' interface (excluding
loopback).
- net
- The IP address or network (specified in CIDR notation) or IP address
ranges to claim (e.g. ``10.0.0.3'', ``10.0.0.0/16'' or
``10.0.0.5-10.0.0.15''). If unspecified,
farpd will attempt to claim any IP
address it sees an ARP request for. Mutiple addresses may be
specified.
FILES¶
- /var/run/farpd.pid
-
SEE ALSO¶
pcapd(8),
synackd(8)
BUGS¶
farpd will respond too slowly to ARP requests
for some applications. In order to ensure that it does not claim existing IP
addresses it will send two ARP request and wait for a reply. This slowness
affects the
nmap network scanning tool, and possibly others, which uses
by default ARP when scanning local networks. The answers from
farpd will come after the tool has timeout
waiting for the ARP replies and, consequently, IP addresses claimed by
farpd will not be discovered.
Additionally,
farpd sends the ARP replies to
the broadcast address of the network and not to the host that send the ARP
request. Some systems and applications (notably
nmap) will not handled
these requests and expect directed ARP replies (i.e. targeted specifically to
the host that sent the request and not to the network)
AUTHORS¶
Dug Song ⟨dugsong@monkey.org⟩, Niels Provos
⟨provos@citi.umich.edu⟩
