1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
|
.\"
.\" Copyright (c) 2001 Dug Song <dugsong@monkey.org>
.\"
.Dd August 4, 2001
.Dt ARPD 8
.Sh NAME
.Nm farpd
.Nd ARP reply daemon
.Sh SYNOPSIS
.Nm farpd
.Op Fl d
.Op Fl i Ar interface
.Op Ar net ...
.Sh DESCRIPTION
.Nm
replies to any ARP request for an IP address matching the specified
destination
.Ar net
with the hardware MAC address of the specified
.Ar interface ,
but only after determining if another host already claims it.
.Pp
Any IP address claimed by
.Nm
is eventually forgotten after a period of inactivity or after a
hard timeout, and is relinquished if the real owner shows up.
.Pp
This enables a single host to claim all unassigned addresses on a
LAN for network monitoring or simulation.
.Pp
.Nm
exits on an interrupt or termination signal.
.Pp
Note: The program name
.Nm
has been changed in Debian GNU/Linux from the original name
(\fBarpd\fR) to avoid name clash with other ARP daemons.
.Pp
The options are as follows:
.Bl -tag -width Ds
.It Fl d
Do not daemonize, and enable verbose debugging messages.
.It Fl i Ar interface
Listen on
.Ar interface .
If unspecified,
.Nm
searches the system interface list for the lowest numbered, configured
``up'' interface (excluding loopback).
.It Ar net
The IP address or network (specified in CIDR notation) or IP address
ranges to claim
(e.g. ``10.0.0.3'', ``10.0.0.0/16'' or ``10.0.0.5-10.0.0.15''). If unspecified,
.Nm
will attempt to claim any IP address it sees an ARP request for.
Mutiple addresses may be specified.
.El
.Sh FILES
.Bl -tag -width /var/run/arpd.pid
.It Pa /var/run/farpd.pid
.El
.Sh SEE ALSO
.Xr pcapd 8 ,
.Xr synackd 8
.Sh BUGS
.Nm
will respond too slowly to ARP requests for some applications. In
order to ensure that it does not claim existing IP addresses it will send two
ARP request and wait for a reply. This slowness affects the \fBnmap\fR network
scanning tool, and possibly others, which uses by default ARP when scanning
local networks. The answers from
.Nm
will come after the tool has timeout waiting for the ARP replies and,
consequently, IP addresses claimed by
.Nm
will not be discovered.
.Sh AUTHORS
Dug Song
.Aq dugsong@monkey.org ,
Niels Provos
.Aq provos@citi.umich.edu
|
