Arp-Scan Command Tutorial With Examples
Network scanning is one of the steps of penetration testing. There are different and popular tools to scan network line masscan, nmap etc. Arp-scan is a tool specifically designed to scan network with layer 2 or mac or ethernet arp packets.
Install
1 | $ sudo apt install arp-scan -y |
Help
1 | $ arp-scan -h |
Syntax
1 | Usage: arp-scan [options] [hosts...] |
Scan Local Network
Most basic usage of arp-scan is scanning local network with a single options named --localnet or-l . This will scan whole local network with arp packets. While using arp-scan we need root privileges.
1 | $ arp-scan --localnet |
Specify Network Interface
Enterprise environments requires more than one network interface for backup, load balancing etc. In this situations we need to specify network interface. We will use -i option. In the example we will use network interface named ens3 .
1 | $ arp-scan --interface=ens3 --localnet |
Set Source Mac Address
During the scan process our exisiting mac address will be used. This may create some clue about the scan. We can change the source mac address during scan. This will make all sent packets have different mac address than our hardware mac address. We will use --destaddr or -T option.
1 | $ arp-scan -T aa:bb:cc:dd:ee:ff |
Set Destination Mac Address
Another useful option is setting destination mac address with --srcaddr or -S option.
1 | $ arp-scan -S aa:bb:cc:dd:ee:ff |
Specify Vlan
In real world networks single interface can host multiple networks. This is generally done using some multiplexing protocol named Virtual Local Area Network or simply VLAN. If the interface is trunk which means interface hosts multiple VLANS we may need to specify VLAN id. We will use --vlan or -Q option to specify VLAN id. In the example we will only scan VLAN 10 .
1 | $ arp-scan -i ens3 -Q 10 |
Write Received Packets To Pcap
If the responses return by the scanned hosts are important for us we can save them in pcap format. Pcap format is supported by tools like tcpdump, wireshark etc. We will us -pcapsavefile or -W options to specify pcap file.
1 | $ sudo arp-scan --localnet -W scan.pcap |
We can read pcap file with tcpdump like below.
1 | $ tcpdump -r scan.pcap |
To get more information about tcpdump read following tutorial.
http://www.poftut.com/tcpdump-tutorial-with-examples/
