FARPD(8)

📦
version 0.2 · 2 versions
, in debian trixie, ubuntu questing, ubuntu resolute, ubuntu stonking

💖 farpd — the ARP reply daemon, bestie edition ✨

okay so picture this: you're on a LAN, you wanna claim a bunch of IP addresses that nobody's using, and you want a whole host to just… vibe there and answer ARP requests for them. that's farpd, and it's lowkey iconic. it's a daemon, it lives in section 8 of the manual, and it's literally built for network monitoring and simulation. 🦋

🌸 SYNOPSIS 🌸

farpd [-d] [-i interface] [net ...]

✨ DESCRIPTION ✨

farpd replies to any ARP request for an IP address that matches the destination net you gave it, and it answers with the hardware MAC address of the interface you specified. but — and this is the important part, don't skip it — it only does that after it checks whether another host is already claiming that address. it's not out here stealing addresses from real hosts, it's polite about it. 🫶

Any IP address that farpd has claimed is eventually forgotten, either after a period of inactivity or after a hard timeout. and if the real owner shows up? it relinquishes the address immediately. it gives it back. no drama. 💅

that whole thing is what lets a single host claim all the unassigned addresses on a LAN — for network monitoring or for simulation. it's giving main character energy for your whole subnet. 👑

farpd exits on an interrupt or termination signal. bye bestie. 😭

Note, and this one's important iykyk: the program name farpd was changed in Debian GNU/Linux from the original name arpd, so it wouldn't name-clash with other ARP daemons. same program, different name, no cap.

The options are as follows:

  • -d — do not daemonize, and turn on verbose debugging messages. great for watching it do its thing in the foreground like a little science experiment. 🔬
  • -i interface — listen on interface. If you don't specify one, farpd goes searching through the system interface list for the lowest numbered, configured "up" interface (and it skips loopback, obviously, loopback doesn't count). 🎀
  • net — the IP address or network to claim, given in CIDR notation, or an IP address range. like 10.0.0.3, 10.0.0.0/16, or 10.0.0.5-10.0.0.15. if you don't specify any, farpd will attempt to claim any IP address it sees an ARP request for. and yes, you can specify multiple addresses. the more the merrier fr fr. 🌈

🎀 FILES 🎀

  • /var/run/farpd.pid

💜 SEE ALSO 💜

  • pcapd(8)
  • synackd(8)

go read those too, they're the friend group. 🧚

🔥 BUGS 🔥

bestie. sit down. 🫖

farpd will respond too slowly to ARP requests for some applications. here's why: in order to make sure it doesn't claim an IP address that already exists, it sends two ARP requests and waits for a reply. that's the responsible thing to do, but it costs time.

This slowness affects the nmap network scanning tool, and possibly others, which uses ARP by default when scanning local networks. The answers from farpd will arrive after the tool has timed out waiting for the ARP replies, and consequently, IP addresses claimed by farpd will not be discovered. 😭💀

so like… it works, it's just slow, and some scanners will completely miss it. noted.

👑 AUTHORS 👑

  • Dug Song ⟨dugsong@monkey.org⟩
  • Niels Provos ⟨provos@citi.umich.edu⟩

and that's the whole page babes — this one came out of ARPD(8), dated August 4, 2001, and you found it right here in the manual. slay. 💖✨🎀

📦 where this page comes from