Offensive Security Researcher & Quantum Cryptography Analyst

arp-scan: Complete Guide to ARP-Based Network Discovery and Host Enumeration Using Kali Linux

Abdul Wahab Junaid
arp-scan: Complete Guide to ARP-Based Network Discovery and Host Enumeration Using Kali Linux

1. Tool Introduction

arp-scan is a command-line Layer 2 network discovery tool that uses the Address Resolution Protocol (ARP) to identify all active devices on a local Ethernet segment, even those that block ICMP or filter higher-layer traffic. Because ARP is required for basic IPv4 communication on a LAN, devices cannot easily hide from an ARP scan the way they can from a ping sweep. arp-scan sends ARP request packets to a target range and displays the IP address, MAC address, and (via its bundled IEEE OUI database) the hardware vendor for every host that replies. It is maintained by Roy Hills and is a standard component of the Kali Linux toolset.

2. Installation

sudo apt update
sudo apt install arp-scan -y

Verify:

arp-scan --version

Expected output:

arp-scan 1.10.0

3. Syntax

arp-scan [OPTIONS] [target range/host list]

4. Command-Line Options (Full Reference)

5. Basic Usage

sudo arp-scan --interface=eth0 --localnet

Expected output:

Interface: eth0, type: EN10MB, MAC: 08:00:27:aa:bb:cc, IPv4: 192.168.1.50
Starting arp-scan 1.10.0
192.168.1.1     aa:bb:cc:11:22:33   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.
192.168.1.15    11:22:33:44:55:66   Apple, Inc.

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.8 seconds

6. Practical Examples

Example 1 — Scan entire local subnet automatically

sudo arp-scan -l -I eth0

192.168.1.1     aa:bb:cc:11:22:33   Netgear
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.
2 packets received by filter, 0 dropped

Example 2 — Scan a specific CIDR range

sudo arp-scan --interface=eth0 10.10.10.0/24

10.10.10.1   00:11:22:33:44:55   Cisco Systems
10.10.10.5   66:77:88:99:aa:bb   VMware, Inc.

Example 3 — Scan targets from a file list

sudo arp-scan -I eth0 --file=hosts.txt

10.10.10.7    aa:11:bb:22:cc:33   Raspberry Pi Foundation
10.10.10.9    11:22:33:44:55:66   Hewlett Packard

Example 4 — Increase retries and timeout for a lossy network

sudo arp-scan -I eth0 --retry=3 --timeout=1000 192.168.1.0/24

192.168.1.20   cc:dd:ee:ff:00:11   Samsung Electronics

Example 5 — Randomize scan order for stealth

sudo arp-scan -I eth0 --random 192.168.1.0/24

192.168.1.44   aa:bb:cc:dd:ee:22   Ubiquiti Networks
192.168.1.3    11:22:aa:bb:cc:dd   Espressif Inc.

Example 6 — Plain output for scripting

sudo arp-scan -I eth0 --plain --localnet

192.168.1.1     aa:bb:cc:11:22:33   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.

Example 7 — Add VLAN tag to ARP requests

sudo arp-scan -I eth0 --vlan=100 192.168.100.0/24

192.168.100.5   aa:11:22:33:44:55   Juniper Networks

Example 8 — Numeric output without vendor lookups

sudo arp-scan -I eth0 --numeric --localnet

192.168.1.1     aa:bb:cc:11:22:33
192.168.1.10    de:ad:be:ef:00:01

Example 9 — Spoof source MAC and IP

sudo arp-scan -I eth0 --srcaddr=00:11:22:33:44:55 --srcip=192.168.1.99 192.168.1.0/24

192.168.1.1   aa:bb:cc:11:22:33   TP-Link Corporation

Example 10 — Include round-trip time in results

sudo arp-scan -I eth0 --rtt --localnet

192.168.1.1     aa:bb:cc:11:22:33   0.842 ms   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   1.203 ms   Dell Inc.

7. Common Use Cases

8. Automation with Bash

#!/bin/bash
# arp_inventory.sh - scan local subnet and log new devices
IFACE="eth0"
OUTFILE="arp_inventory.csv"
TMPFILE=$(mktemp)

sudo arp-scan -I "$IFACE" --localnet --plain --numeric > "$TMPFILE"

if [ -f "$OUTFILE" ]; then
    echo "[*] Comparing against previous inventory..."
    diff "$OUTFILE" "$TMPFILE" || echo "[!] Changes detected in network inventory"
fi

cp "$TMPFILE" "$OUTFILE"
rm "$TMPFILE"
echo "[+] Inventory updated: $OUTFILE"

9. Tips and Best Practices

10. Troubleshooting

11. References

Exit mobile version