Arp-scan

lastmod 2023-04-12created 2016-10-2313 edits

arp scanning and fingerprinting tool

arp-scan is a command-line tool that uses the ARP protocol to discover and fingerprint IP hosts on the local network. It is available for Linux and BSD under the GPL licence

How to install

sudo apt update
sudo apt install arp-scan

How to use

Scan all devices on the network:

$ sudo arp-scan -I wlan0 192.168.1.0/24

The output looks like this.

Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.6 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.10    00:90:f5:33:e2:f2       CLEVO CO.
192.168.1.254   00:14:7f:72:cd:05       Thomson Telecom Belgium

2 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.6: 256 hosts scanned in 1.406 seconds (182.08 hosts/sec).  2 responded

Scanning the local network

Here is an example showing arp-scan being run against the local network:

sudo arp-scan --interface=eth0 --localnet

Finding IP conflicts

Finding an IP conflict is as simple as a single command, arp-scan -l. You may also wish to specify the -I option, which will allow you to pick an interface.

sudo arp-scan -I eth0 -l

See also

• ARP
• ARP Spoofing
• arping - checks network connectivity using ARP requests.
• arpscan
• WS-Discovery (WSDL)
• pcap
• nmap

Favorite site

• royhills/arp-scan: The ARP Scanner
• How to find unused IP Address on a network?