### arp-scan Example Scan Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide An example of running arp-scan against a /28 network and the resulting output. ```bash $ arp-scan 10.133.170.16/28 Interface: eth0, type: EN10MB, MAC: a0:b3:cc:e8:0e:94, IPv4: 10.133.170.8 Starting arp-scan 1.10.0 with 16 hosts (https://github.com/royhills/arp-scan) 10.133.170.16 bc:30:5b:e8:da:76 Dell Inc. 10.133.170.17 00:0c:29:25:cc:09 VMware, Inc. 10.133.170.18 a0:b3:cc:e2:1b:e8 Hewlett Packard 10.133.170.19 a0:b3:cc:ea:8c:72 Hewlett Packard 10.133.170.20 a0:b3:cc:df:a6:00 Hewlett Packard 10.133.170.23 94:18:82:ab:1b:8f Hewlett Packard Enterprise 10.133.170.24 28:92:4a:30:76:0b Hewlett Packard 10.133.170.25 00:0c:29:5a:89:4d VMware, Inc. 10.133.170.27 84:34:97:11:8d:40 Hewlett Packard 10.133.170.29 9c:b6:54:bb:dc:e0 Hewlett Packard 10.133.170.31 00:0c:29:c4:89:eb VMware, Inc. 11 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0 16 hosts scanned in 1.833 seconds (8.73 hosts/sec). 11 responded ``` -------------------------------- ### Building and Installing arp-scan from Source Source: https://github.com/royhills/arp-scan/blob/master/README.md Instructions for cloning the repository, configuring, building, and installing arp-scan from its source code. This process requires development tools and libraries like automake, autoconf, make, a C compiler, libpcap, and optionally libcap. ```bash git clone https://github.com/royhills/arp-scan.git cd arp-scan autoreconf --install ./configure make make install ``` -------------------------------- ### Example MAC Address Matching Source: https://github.com/royhills/arp-scan/blob/master/mac-vendor.txt Illustrates how different MAC-Prefix lengths are matched against full MAC addresses. arp-scan prioritizes longer prefix matches. ```text 01:23:45\tmatches 01:23:45:xx:xx:xx\n01:23:45:6\tmatches 01:23:45:6x:xx:xx\n01:23:45:67\tmatches 01:23:45:67:xx:xx ``` -------------------------------- ### arp-scan Output Example for VRRP Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide This example demonstrates the output of the `arp-scan` tool when encountering VRRP IP addresses. It shows how the MAC address, specifically the last octet, can be used to determine the VRID (Virtual Router IDentifier). ```text 192.168.6.20 00:00:5e:00:01:65 VRRP (last octet is VRID) 192.168.6.227 00:00:5e:00:01:72 VRRP (last octet is VRID) 192.168.6.228 00:00:5e:00:01:40 VRRP (last octet is VRID) ``` -------------------------------- ### arp-fingerprint Usage Examples Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Examples demonstrating the usage of the arp-fingerprint tool to identify operating systems based on their ARP packet responses. The `-o` option is used to pass arguments to arp-scan, such as specifying the network interface and enabling numeric output. ```bash $ arp-fingerprint -o "--interface=eth0 --numeric" 192.168.1.1 192.168.1.1 01000100000 Linux 2.2, 2.4, 2.6 ``` ```bash $ arp-fingerprint -o "--interface=eth0 --numeric" 192.168.1.204 192.168.1.204 11110100000 FreeBSD 5.3, Win98, WinME, NT4, 2000, XP, 2003 ``` ```bash $ arp-fingerprint -o "--interface=eth0 --numeric" 192.168.1.251 192.168.1.251 00000100000 Cisco IOS 11.2, 11.3, 12.0, 12.1, 12.2, 12.3, 12.4 ``` ```bash $ arp-fingerprint -o "--interface=eth0 --numeric" 192.168.1.155 192.168.1.155 01000111111 ScreenOS 5.0, 5.1, 5.3, 5.4 ``` -------------------------------- ### Vendor Mappings in mac-vendor.txt Source: https://github.com/royhills/arp-scan/blob/master/mac-vendor.txt Provides examples of vendor mappings found in the mac-vendor.txt file, including QEMU, Bochs, VRRP/CARP, OpenBSD, Microsoft WLBS, HSRP, and the Ethernet broadcast address. ```text 52:54:00\tQEMU\nb0:c4:20\tBochs\n00:00:5e:00:01\tVRRP/CARP (last octet is VRID/VHID)\n00:00:5e:00:02\tIPv6 VRRP (last octet is VRID)\nfe:e1:ba:d\tOpenBSD randomly generated MAC address\n02:bf\tMicrosoft WLBS (last four octets are IP address)\n00:00:0c:07:ac\tHSRP (last octet is group number)\nff:ff:ff:ff:ff:ff\tBroadcast ``` -------------------------------- ### MAC Vendor Decoding Example Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Illustrates how arp-scan displays vendor details decoded from a MAC address. It shows the IP address, MAC address, and the corresponding vendor name, which aids in identifying device manufacturers. ```bash 192.168.1.251 00:04:27:6a:5d:a1 Cisco Systems, Inc. ``` -------------------------------- ### arp-scan Example: Discovering Remote Interface Addresses Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates how to use arp-scan to discover IP addresses of other interfaces on a Linux system. It shows the command to scan specific IP addresses on a given interface and the expected output, including the MAC address and vendor information. ```bash $ arp-scan --interface=eth0 192.168.1.1 10.0.105.225 192.168.1.1 00:c0:9f:09:b8:db QUANTA COMPUTER, INC. 10.0.105.225 00:c0:9f:09:b8:db QUANTA COMPUTER, INC. ``` -------------------------------- ### arp-scan Example with Duplicate Replies Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the output of arp-scan when duplicate ARP replies are detected. The '-N' option disables DNS lookups, and '-r 1' ensures only one ARP request is sent. ```bash % arp-scan -N -r 1 -s 192.168.1.40 192.168.1.0/24 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.2 (ether-scan-engine 1.3) with 256 hosts 192.168.1.33 00:00:5e:00:01:ca USC INFORMATION SCIENCES INST 192.168.1.34 00:0b:46:e4:8d:6d Cisco 192.168.1.34 00:0b:46:e4:8d:6d Cisco (DUP: 2) 192.168.1.45 00:0a:b7:9b:b7:7a Cisco Systems 192.168.1.46 00:0a:b7:9b:b7:01 Cisco Systems ``` -------------------------------- ### arp-scan Example: Disrupting Target System with --arpspa=dest Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the use of the `--arpspa=dest` option with arp-scan against a Windows XP SP2 system. This example shows how setting the ar$spa to the destination IP can cause the target system to log an IP address conflict error. ```bash $ arp-scan --interface=eth0 --arpspa=dest 192.168.124.11 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/) 192.168.124.11 00:0f:1f:5c:d1:13 WW PCBA Test ``` -------------------------------- ### Tcpdump ARP Request Example Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Example output from tcpdump showing an ARP request for a specific IP address, including source and destination MAC addresses and protocol information. ```APIDOC Tcpdump ARP Request: `00:c0:9f:09:b8:db > ff:ff:ff:ff:ff:ff, ethertype ARP (0x0806), length 42: arp who-has 10.0.0.2 tell 10.0.0.1` ``` -------------------------------- ### arp-scan Example: Solaris Non-Responsive System Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Presents a negative example where a Solaris 9 system does not respond to ARP requests for remote interface addresses. This demonstrates that only the local interface IP receives a response, highlighting differences in ARP behavior across operating systems. ```bash $ arp-scan --interface=eth0 192.168.1.150 10.0.0.1 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.2 (ether-scan-engine 1.3) with 2 hosts 192.168.1.150 08:00:20:a0:09:a4 SUN MICROSYSTEMS INC. 3 packets received by filter, 0 packets dropped by kernel Ending arp-scan: 2 hosts scanned in 0.749 seconds (2.67 hosts/sec). 1 responded ``` -------------------------------- ### arp-scan: Example with Broadcast Address Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Illustrates arp-scan's response when the target IP is the broadcast address of the interface. A response is expected. ```bash $ arp-scan --interface=eth0 --arpspa=192.168.1.255 192.168.1.254 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/) 192.168.1.254 00:60:5c:f4:c6:f4 CISCO SYSTEMS, INC. 3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.5.2: 1 hosts scanned in 0.608 seconds (1.64 hosts/sec). 1 responded ``` -------------------------------- ### arp-scan: Example with Different Subnet IP Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates arp-scan behavior when the target IP address belongs to a different subnet than the interface. No response is expected. ```bash $ arp-scan --interface=eth0 --arpspa=192.168.2.0 192.168.1.254 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/) 2 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.5.2: 1 hosts scanned in 0.863 seconds (1.16 hosts/sec). 0 responded ``` -------------------------------- ### arp-scan Timing Calculation Example Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the calculation for a single-pass scan time based on the number of hosts, packet interval, timeout, and overhead. This helps in estimating scan duration for different network sizes and configurations. ```bash time = n*i + t + o With 65,536 hosts, default bandwidth of 256,000 bits/second (2ms interval), default timeout of 100ms, single pass (--retry=1), and 1 second overhead: scan_time = 65536 * 0.002 + 0.1 + 1 = 132.172 seconds (approx. 2 minutes 12 seconds) ``` -------------------------------- ### arp-scan: Identifying Interfaces with Sequential MAC Addresses Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Illustrates how arp-scan output can reveal systems with multiple network interfaces by observing sequential MAC addresses. This is common for devices with multiple network cards or ports, as shown in the example output. ```bash 192.168.4.94 00:a0:8e:33:81:f0 Nokia Internet Communications 10.5.40.2 00:a0:8e:33:81:f1 Nokia Internet Communications 192.168.4.30 00:a0:8e:33:81:f8 Nokia Internet Communications 192.168.5.30 00:a0:8e:33:81:fc Nokia Internet Communications 192.168.5.45 00:a0:8e:33:81:fd Nokia Internet Communications 192.168.5.145 00:a0:8e:33:81:ff Nokia Internet Communications ``` -------------------------------- ### arp-scan: Example with Network Address Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Shows arp-scan successfully identifying a host when the target IP is the network address of the interface. A response is expected. ```bash $ arp-scan --interface=eth0 --arpspa=192.168.1.240 192.168.1.254 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/) 192.168.1.254 00:60:5c:f4:c6:f4 CISCO SYSTEMS, INC. 3 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.5.2: 1 hosts scanned in 0.618 seconds (1.62 hosts/sec). 1 responded ``` -------------------------------- ### Specify Network Interface with arp-scan Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide This example shows how to specify a particular network interface for arp-scan using the --interface or -I option. This is useful when a system has multiple network interfaces and you want to target a specific one for host discovery. The command scans the network associated with the specified interface. ```bash $ arp-scan --localnet -I eth1 Interface: eth1, type: EN10MB, MAC: 50:65:f3:f0:70:a5, IPv4: 10.0.1.82 Target list from interface network 10.0.1.80 netmask 255.255.255.252 Starting arp-scan 1.10.1 with 4 hosts (https://github.com/royhills/arp-scan) 10.0.1.81 04:5e:a4:90:ae:40 SHENZHEN NETIS TECHNOLOGY CO.,LTD 1 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.1: 4 hosts scanned in 1.555 seconds (2.57 hosts/sec). 1 responded ``` -------------------------------- ### arp-scan Example: Cisco Router VLAN Sub-interfaces Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Illustrates the use of arp-scan with a Cisco router that has 802.1Q VLAN sub-interfaces. This example shows how arp-scan can discover IP addresses across different VLANs by specifying multiple target IP addresses. ```bash $ arp-scan --interface=eth0 192.168.1.251 172.18.0.1 172.18.2.1 192.168.1.251 00:04:27:6a:5d:a1 Cisco Systems, Inc. 172.18.0.1 00:04:27:6a:5d:a1 Cisco Systems, Inc. 172.18.2.1 00:04:27:6a:5d:a1 Cisco Systems, Inc. ``` -------------------------------- ### arp-scan: Example with Invalid IP Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates arp-scan behavior when the target IP address is outside the interface's network. No response is expected. ```bash $ arp-scan --interface=eth0 --arpspa=192.168.1.239 192.168.1.254 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/) 2 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.5.2: 1 hosts scanned in 0.865 seconds (1.16 hosts/sec). 0 responded ``` -------------------------------- ### TCPDUMP Output Showing Duplicate ARP Replies Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Provides a tcpdump output example illustrating duplicate ARP replies. It shows an ARP request followed by two identical ARP replies from the same MAC address. ```shell 00:0b:db:1c:59:e7 > ff:ff:ff:ff:ff:ff, ethertype ARP, length 42: arp who-has 192.168.1.99 tell 192.168.1.102 0001 0800 0604 0001 000b db1c 59e7 c0a8 0166 0000 0000 0000 c0a8 0163 00:e0:b6:06:9d:1d > 00:0b:db:1c:59:e7, ethertype ARP, length 60: arp reply 192.168.1.99 is-at 00:e0:b6:06:9d:1d 0001 0800 0604 0002 00e0 b606 9d1d c0a8 0163 000b db1c 59e7 c0a8 0166 0000 0000 0000 0000 0000 0000 0000 0000 0000 00:e0:b6:06:9d:1d > 00:0b:db:1c:59:e7, ethertype ARP, length 60: arp reply 192.168.1.99 is-at 00:e0:b6:06:9d:1d 0001 0800 0604 0002 00e0 b606 9d1d c0a8 0163 000b db1c 59e7 c0a8 0166 0000 0000 0000 0000 0000 0000 0000 0000 0000 ``` -------------------------------- ### arp-scan: Identifying Secondary IP Addresses Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates how arp-scan can identify multiple IP addresses sharing the same MAC address, indicating they reside on the same network interface. This is shown with example output and corresponding Linux interface configuration. ```bash $ arp-scan --interface=eth0 192.168.1.68 192.168.1.69 Interface: eth0, datalink type: EN10MB (Ethernet) Starting arp-scan 1.5.2 with 2 hosts (http://www.nta-monitor.com/tools/arp-scan/) 192.168.1.68 00:0b:db:1c:59:e7 Dell ESG PCBA Test 192.168.1.69 00:0b:db:1c:59:e7 Dell ESG PCBA Test ``` ```text eth0 Link encap:Ethernet HWaddr 00:0B:DB:1C:59:E7 inet addr:192.168.1.68 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 RX packets:14874 errors:0 dropped:0 overruns:0 frame:0 TX packets:4822 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:1274872 (1.2 MiB) TX bytes:361344 (352.8 KiB) Interrupt:7 eth0:1 Link encap:Ethernet HWaddr 00:0B:DB:1C:59:E7 inet addr:192.168.1.69 Bcast:192.168.1.255 Mask:255.255.255.0 UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1 Interrupt:7 ``` -------------------------------- ### arp-scan Configuration Options Source: https://github.com/royhills/arp-scan/blob/master/README.md Details on configuring the arp-scan build process, including the `--with-libcap` option to control POSIX.1e capabilities support. Running `./configure --help` provides a full list of available options. ```bash ./configure --help ./configure --with-libcap[=auto/yes/no] ``` -------------------------------- ### arp-scan Command Line Options Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Provides details on key command-line options for the arp-scan utility, focusing on frame padding and framing types. ```APIDOC arp-scan: --padding= Adds arbitrary padding data to outgoing ARP requests. The padding is appended to the ARP packet to meet the minimum Ethernet frame size of 46 bytes. -L, --llc Sends ARP requests using IEEE 802.2 LLC/SNAP Framing instead of the default Ethernet-II framing. This is defined in RFC 1042. --verbose Reports non-zero padding on ARP responses. Useful for identifying systems that do not pad with zeros. ``` -------------------------------- ### arp-scan Usage and Manual Pages Source: https://github.com/royhills/arp-scan/blob/master/README.md Provides commands to access usage information and detailed manual pages for arp-scan and related utilities. These are essential for understanding the functionality and parameters of the tool. ```bash arp-scan --help ``` ```bash man arp-scan ``` ```bash man arp-fingerprint ``` ```bash man get-oui ``` ```bash man mac-vendor ``` -------------------------------- ### arp-scan --plain Output Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the use of the `--plain` option to omit header and footer information for script-friendly output. ```bash $ arp-scan -l --plain 192.168.1.2 00:50:56:e4:9a:83 VMware, Inc. 192.168.1.1 00:50:56:c0:00:08 VMware, Inc. 192.168.1.254 00:50:56:f6:22:db VMware, Inc. ``` -------------------------------- ### arp-scan with custom padding and verbose output Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates using arp-scan to send ARP requests with custom padding data and to report non-zero padding in responses. This is useful for testing how different network devices handle padding. ```bash $ arp-scan --padding=0102030405060708 --verbose 192.168.1.0/24 | grep Padding 192.168.1.147 00:11:24:84:a1:b2 Apple Computer Padding=555555555555555555555555555555555555 192.168.1.153 00:10:db:26:4d:52 Juniper Networks, Inc. Padding=888888888888888888888888888888888888 192.168.1.158 08:00:20:a0:09:a4 SUN MICROSYSTEMS INC. Padding=555555555555555555555555555555555555 192.168.1.190 00:00:aa:84:eb:0c XEROX CORPORATION Padding=01020304050607080000000000000000000000000000 192.168.1.192 00:30:c1:cd:3a:13 HEWLETT-PACKARD Padding=010203040506070800000000000000000000 192.168.1.249 00:90:27:57:c1:f3 INTEL CORPORATION Padding=000000000000000000000000000089322ba2 192.168.1.250 00:06:d7:55:0f:40 Cisco Systems, Inc. Padding=00000000000000000000000000000000000005060708 ``` -------------------------------- ### arp-scan Command Line Options Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Details key command-line options for arp-scan, including parameters for controlling scan behavior, network usage, and output formatting. These options allow for fine-tuning the scanning process. ```APIDOC arp-scan Options: --retry=COUNT Set the number of times an ARP packet will be re-sent to a target host if no response is received. Default is 1. --bandwidth=RATE Set the bandwidth (in bits per second) that arp-scan will use for outgoing ARP packets. Default is 256000. --interval=MICROSECONDS Set the time interval (in microseconds) between outgoing ARP packets. This is an alternative to --bandwidth. --timeout=MILLISECONDS Set the timeout value (in milliseconds) for waiting for ARP replies. Default is 100. --quiet Suppress the display of vendor details decoded from MAC addresses. ``` -------------------------------- ### arp-scan 1.10.1-git Script and Build Enhancements Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Covers general improvements in arp-scan 1.10.1, including changes to the `get-oui` script, updated CARP and IPv6 VRRP support, build system requirements (autoconf >= 2.70), C99 compiler support, and user agent string modifications for OUI downloads. ```perl # get-oui script: Displays underlying system error on download failure. # Change HTTP user agent string to mimic Chrome on Windows 10/x64 for IEEE site requests. ``` -------------------------------- ### LWP::UserAgent for OUI/IAB Fetching Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md The `get-oui` and `get-iab` scripts in version 1.9.2 use `LWP::UserAgent` instead of `LWP::Simple` to fetch raw content, avoiding Unicode/UTF-8 issues. ```perl use LWP::UserAgent; my $ua = LWP::UserAgent->new; my $response = $ua->get($url); print $response->decoded_content; ``` -------------------------------- ### Updating Vendor Data with get-oui Script Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the usage of the `get-oui` script to update the `ieee-oui.txt` file with the verbose option. This script fetches the latest MAC/Vendor mappings from IEEE registries. ```shell $ get-oui -v Opening ieee-oui.txt for output Processing IEEE IAB registry data from https://standards-oui.ieee.org/iab/iab.csv Downloaded 381510 bytes 4575 IAB entries written to ieee-oui.txt Processing IEEE MAM registry data from https://standards-oui.ieee.org/oui28/mam.csv Downloaded 510751 bytes 4633 MAM entries written to ieee-oui.txt Processing IEEE OUI registry data from https://standards-oui.ieee.org/oui/oui.csv Downloaded 3107922 bytes 33371 OUI entries written to ieee-oui.txt Processing IEEE OUI36 registry data from https://standards-oui.ieee.org/oui36/oui36.csv Downloaded 483060 bytes 5308 OUI36 entries written to ieee-oui.txt Total of 47887 MAC/Vendor mappings written to ieee-oui.txt ``` -------------------------------- ### arp-scan: Detecting Proxy ARP Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Shows how arp-scan can detect proxy ARP behavior, where a router replies with its MAC address for IP addresses on different interfaces. The example highlights the characteristics of proxy ARP responses: all IPs in a network responding with the same router MAC address. ```bash $ arp-scan 172.18.0.0/28 Interface: eth0, type: EN10MB, MAC: a0:b3:cc:e8:0e:94, IPv4: 10.133.170.8 Starting arp-scan 1.10.0 with 16 hosts (https://github.com/royhills/arp-scan) 172.18.0.0 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.1 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.2 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.3 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.4 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.5 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.6 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.7 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.8 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.9 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.10 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.11 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.12 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.13 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.14 00:fc:ba:77:0f:4d Cisco Systems, Inc 172.18.0.15 00:fc:ba:77:0f:4d Cisco Systems, Inc 16 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.0 16 hosts scanned in 0.608 seconds (26.32 hosts/sec). 16 responded ``` -------------------------------- ### arp-scan --format Option Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Introduces the `--format` option for specifying custom output formats. ```APIDOC arp-scan --format - Allows flexible custom output formatting. - Example usage for custom formats can be provided here. ``` -------------------------------- ### libpcap for Interface IP and ARP Packet Sending Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Starting with version 1.9, arp-scan uses libpcap functions to obtain the interface IP address and send ARP packets, reducing the need for link-layer specific functions. Requires libpcap 0.9.3 or later. ```c pcap_lookupnet(handle, &net, &mask, errbuf); // ... construct and send ARP packet using libpcap functions ``` -------------------------------- ### arp-scan Verbose Output Levels Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Demonstrates the different levels of verbose output for arp-scan, from general debugging to detailed packet information. The -v, -vv, and -vvv options provide increasing levels of detail. ```bash $ arp-scan -v --localnet Interface: ens33, type: EN10MB, MAC: 00:0c:29:d3:97:e8, IPv4: 192.168.14.128 Using 192.168.14.0:255.255.255.0 for localnet Starting arp-scan 1.10.1-git with 256 hosts (https://github.com/royhills/arp-scan) 192.168.14.2 00:50:56:e4:9a:83 VMware, Inc. 192.168.14.1 00:50:56:c0:00:08 VMware, Inc. 192.168.14.163 00:0c:29:8d:a1:4d VMware, Inc. 192.168.14.254 00:50:56:e1:a0:41 VMware, Inc. --- Pass 1 complete --- Pass 2 complete 6 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.1-git: 256 hosts scanned in 2.057 seconds (124.45 hosts/sec). 4 responded ``` ```bash $ arp-scan -vv 192.168.14.1 Interface: ens33, type: EN10MB, MAC: 00:0c:29:d3:97:e8, IPv4: 192.168.14.128 DEBUG: pcap filter string: "ether dst 00:0c:29:d3:97:e8 and (arp or (ether[14:4]=0xaaaa0300 and ether[20:2]=0x0806) or (ether[12:2]=0x8100 and ether[16:2]=0x0806) or (ether[12:2]=0x8100 and ether[18:4]=0xaaaa0300 and ether[24:2]=0x0806))" DEBUG: Loaded 47430 IEEE OUI/Vendor entries from ieee-oui.txt. DEBUG: Loaded 8 MAC/Vendor entries from mac-vendor.txt. DEBUG: pkt len=64 bytes, bandwidth=256000 bps, interval=2000 us Starting arp-scan 1.10.1-git with 1 hosts (https://github.com/royhills/arp-scan) --- Sending packet #1 to host 192.168.14.1 tmo 500000 --- Received packet #1 from 192.168.14.1 192.168.14.1 00:50:56:c0:00:08 VMware, Inc. --- Removing host 192.168.14.1 - Received 60 bytes 5 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.10.1-git: 1 hosts scanned in 0.140 seconds (7.14 hosts/sec). 1 responded ``` -------------------------------- ### Plain Output Option Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Version 1.9.2 introduced the `--plain` or `-x` option to suppress header and footer text, displaying only one output line per responding host. ```c if (plain_output) { printf("%s\n", ip_address); } else { printf("%s\t%s\n", ip_address, mac_address); } ``` -------------------------------- ### arp-scan Command Line Options Source: https://github.com/royhills/arp-scan/wiki/arp-scan-User-Guide Provides a reference for key arp-scan command-line options, including `--interface` for specifying the network interface and `--arpspa=dest` for setting the ARP sender protocol address (ar$spa) to the destination IP address. ```APIDOC arp-scan: --interface= Specify the network interface to use for sending and receiving ARP requests. --arpspa=dest Set the ARP sender protocol address (ar$spa) field in the ARP request to the same IP address as the target. This can disrupt target system operation by triggering IP address conflict warnings. ``` -------------------------------- ### arp-scan Command-Line Options Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md This snippet details various command-line options available in arp-scan, including those for saving packet data, specifying VLAN tags, using LLC/SNAP framing, and managing MAC/Vendor files. It also covers options for scanning local networks and specifying source addresses. ```bash arp-scan --help arp-scan --pcapsavefile arp-scan --vlan arp-scan --llc arp-scan --iabfile arp-scan --macfile arp-scan --localnet arp-scan --srcaddr ``` -------------------------------- ### arp-scan Build Notes for Package Maintainers Source: https://github.com/royhills/arp-scan/blob/master/README.md Notes for package maintainers regarding building arp-scan, specifically focusing on dependency requirements like libcap and libpcap for enhanced capabilities on Linux systems. ```APIDOC Package Maintainer Notes: - Raise a GitHub issue or create a pull request for applicable upstream patches. - On Linux, build with libcap POSIX.1e capabilities support. - Install libcap and libpcap development headers before running configure. - Makefile.am installs arp-scan with CAP_NET_RAW capabilities or as suid root if capabilities are not available. ``` -------------------------------- ### Perl Script Dependencies Source: https://github.com/royhills/arp-scan/blob/master/README.md Lists the required Perl interpreter and modules for running arp-scan's Perl scripts, specifically `arp-fingerprint` and `get-oui`. These modules are LWP::UserAgent and Text::CSV. ```perl # Requires perl interpreter, LWP::UserAgent, and Text::CSV modules ``` -------------------------------- ### Flexible Output Formatting Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Allows users to define custom output formats using fields, text escapes, and alignment. Supports XML and JSON formats. ```APIDOC --format=FIELD_SPEC Allows flexible output formatting. Fields can be specified with text and \ escapes, e.g., '${ip}\t${mac}\t${vendor}'. Supports optional left/right alignment with width, e.g., '|${ip;-15}|${mac}|'. Example XML format: ${ip}${mac}${vendor} Example JSON format: {"ipAddress":"${ip}", "macAddress":"${mac}", "vendor":"${vendor}"}, Refer to arp-scan manpage for a complete list of field names and examples. ``` -------------------------------- ### MAC/Vendor Mapping File Updates Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Details changes to the MAC/Vendor mapping files, including the consolidation of IEEE registries into `ieee-oui.txt` and the removal of `ieee-iab.txt` and `--iabfile` option. The `get-oui` script now requires the Perl module `Text::CSV`. ```perl # get-oui script now uses IEEE .csv files and requires Text::CSV module # Example usage (conceptual): # perl get-oui --output=ieee-oui.txt ``` -------------------------------- ### POSIX.1e Capabilities Support Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Enables arp-scan to use CAP_NET_RAW capability instead of root permissions on Linux. Requires libcap-dev. Configuration is done via `--with-libcap`. ```bash setcap cap_net_raw+p /path/to/arp-scan ``` ```bash ./configure --with-libcap ``` -------------------------------- ### arp-scan Version 1.9.8 New Features Source: https://github.com/royhills/arp-scan/blob/master/NEWS.md Introduces support for Linux IP aliases, permits regular MAC addresses in `mac-vendor.txt`, adds a `--limit` option to control the number of hosts scanned, and a `--resolve` option to resolve IP addresses to hostnames. ```APIDOC --limit=n Exits after 'n' hosts have responded. Exits with status 1 if fewer than 'n' hosts respond. --resolve Resolves responding IP addresses to hostnames. ```