Network link layer equivalent of `ping` to probe a device which fell from the intranet?

You can attack this in various ways. First, try to find the technical manual for the device in question. That will hopefully tell you what exactly it uses for a default configuration.

Then, remove the network switch from the equation if possible. Connect the device directly to a pc of some sort using a crossover cable. That way you can configure the pc to be on the network as you think the device is on, and see if you can talk to it. This also allows you to easily use a tool like tcpdump to watch what the device is sending over the wire. For example if I connect a device directly to the ethernet port on my mac with a crossover cable, I can do this:

# tcpdump -i en0

to see all the traffic coming from the device (note you have to be root, or run that command via sudo).

Watching the tcpdump output should give you a very clear idea of what the non-responsive device is trying to do on the network.

Note that I recommend connecting the device directly to your computer because of the way network switches work. The switch doesn't send traffic to your port if it's not destined for you. Thus the device could be chattering away but since your computer isn't on the same IP network you won't see most of the data. There are ways around this such as switch port mirroring, but in general it's simplest to just bypass the switch entirely.


arping may be what you're looking for?