Arp-Scan Command Tutorial With Examples
Network scanning is one of the steps of penetration testing. There are different and popular tools to scan network line masscan, nmap etc. Arp-scan is a tool specifically designed to scan network with layer 2 or mac or Ethernet arp packets.
We can install
arp-scan tool with the following command.
$ sudo apt install arp-scan -y
We can print help information with the
$ arp-scan -h
Usage: arp-scan [options] [hosts...]
Scan Local Network
Most basic usage of arp-scan is scanning local network with a single options named
-l . This will scan whole local network with arp packets. While using arp-scan we need root privileges.
$ arp-scan --localnet
Specify Network Interface
Enterprise environments requires more than one network interface for backup, load balancing etc. In this situations we need to specify network interface. We will use
-i option. In the example we will use network interface named
$ arp-scan --interface=ens3 --localnet
Set Source Mac Address
During the scan process our exisiting mac address will be used. This may create some clue about the scan. We can change the source mac address during scan. This will make all sent packets have different mac address than our hardware mac address. We will use
$ arp-scan -T aa:bb:cc:dd:ee:ff
Set Destination Mac Address
Another useful option is setting destination mac address with
$ arp-scan -S aa:bb:cc:dd:ee:ff
In real world networks single interface can host multiple networks. This is generally done using some multiplexing protocol named Virtual Local Area Network or simply VLAN. If the interface is trunk which means interface hosts multiple VLANS we may need to specify VLAN id. We will use
-Q option to specify VLAN id. In the example we will only scan
VLAN 10 .
$ arp-scan -i ens3 -Q 10
Write Received Packets To Pcap
If the responses return by the scanned hosts are important for us we can save them in
pcap format. Pcap format is supported by tools like tcpdump, wireshark etc. We will us
-W options to specify pcap file.
$ sudo arp-scan --localnet -W scan.pcap
We can read pcap file with tcpdump like below.
$ tcpdump -r scan.pcap
To get more information about tcpdump read following tutorial.