arp-scan: Complete Guide to ARP-Based Network Discovery and Host Enumeration Using Kali Linux

1. Tool Introduction

arp-scan is a command-line Layer 2 network discovery tool that uses the Address Resolution Protocol (ARP) to identify all active devices on a local Ethernet segment, even those that block ICMP or filter higher-layer traffic. Because ARP is required for basic IPv4 communication on a LAN, devices cannot easily hide from an ARP scan the way they can from a ping sweep. arp-scan sends ARP request packets to a target range and displays the IP address, MAC address, and (via its bundled IEEE OUI database) the hardware vendor for every host that replies. It is maintained by Roy Hills and is a standard component of the Kali Linux toolset.

2. Installation

sudo apt update
sudo apt install arp-scan -y

Verify:

arp-scan --version

Expected output:

arp-scan 1.10.0

3. Syntax

arp-scan [OPTIONS] [target range/host list]

4. Command-Line Options (Full Reference)

• --interface=<IFACE> / -I — Specify network interface
• --localnet / -l — Scan the entire local network based on interface config
• --file=<FILE> / -f — Read target list from a file
• --retry=<COUNT> / -r — Number of retries for each host
• --timeout=<MS> / -t — Timeout waiting for a reply (milliseconds)
• --interval=<MS> / -i — Time delay between sending packets
• --backoff=<FACTOR> / -B — Backoff factor for retry timing
• --srcaddr=<MAC> / -s — Set source MAC address
• --arpsha=<MAC> — Set ARP source hardware address
• --srcip=<IP> / -S — Set source IP address
• --destaddr=<MAC> / -T — Set destination MAC address (default broadcast)
• --arpspa=<IP> — Set ARP source protocol (IP) address
• --prototype=<HEX> / -Q — Set ARP protocol type field
• --arphrd=<TYPE> / -H — Set ARP hardware type
• --arpop=<OP> / -o — Set ARP operation code (default: request)
• --vlan=<ID> / -v — Add 802.1Q VLAN tag
• --random / -R — Randomize target scan order
• --limit=<PPS> / -L — Limit output to first N hosts
• --bandwidth=<BPS> / -B — Limit output bandwidth
• --plain / -x — Plain output, no header/footer banner
• --quiet / -q — Suppress non-essential output
• --ignoredups / -D — Don’t display duplicate packets
• --verbose / -V — Increase verbosity
• --rtt — Include round-trip time in output
• --macfile=<FILE> / -m — Use a custom MAC/OUI vendor file
• --numeric / -N — Don’t resolve MAC vendor names
• --ouifile=<FILE> — Specify IEEE OUI file location
• --help / -h — Show help/usage

5. Basic Usage

sudo arp-scan --interface=eth0 --localnet

Expected output:

Interface: eth0, type: EN10MB, MAC: 08:00:27:aa:bb:cc, IPv4: 192.168.1.50
Starting arp-scan 1.10.0
192.168.1.1     aa:bb:cc:11:22:33   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.
192.168.1.15    11:22:33:44:55:66   Apple, Inc.

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.8 seconds

6. Practical Examples

Example 1 — Scan entire local subnet automatically

sudo arp-scan -l -I eth0

192.168.1.1     aa:bb:cc:11:22:33   Netgear
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.
2 packets received by filter, 0 dropped

Example 2 — Scan a specific CIDR range

sudo arp-scan --interface=eth0 10.10.10.0/24

10.10.10.1   00:11:22:33:44:55   Cisco Systems
10.10.10.5   66:77:88:99:aa:bb   VMware, Inc.

Example 3 — Scan targets from a file list

sudo arp-scan -I eth0 --file=hosts.txt

10.10.10.7    aa:11:bb:22:cc:33   Raspberry Pi Foundation
10.10.10.9    11:22:33:44:55:66   Hewlett Packard

Example 4 — Increase retries and timeout for a lossy network

sudo arp-scan -I eth0 --retry=3 --timeout=1000 192.168.1.0/24

192.168.1.20   cc:dd:ee:ff:00:11   Samsung Electronics

Example 5 — Randomize scan order for stealth

sudo arp-scan -I eth0 --random 192.168.1.0/24

192.168.1.44   aa:bb:cc:dd:ee:22   Ubiquiti Networks
192.168.1.3    11:22:aa:bb:cc:dd   Espressif Inc.

Example 6 — Plain output for scripting

sudo arp-scan -I eth0 --plain --localnet

192.168.1.1     aa:bb:cc:11:22:33   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   Dell Inc.

Example 7 — Add VLAN tag to ARP requests

sudo arp-scan -I eth0 --vlan=100 192.168.100.0/24

192.168.100.5   aa:11:22:33:44:55   Juniper Networks

Example 8 — Numeric output without vendor lookups

sudo arp-scan -I eth0 --numeric --localnet

192.168.1.1     aa:bb:cc:11:22:33
192.168.1.10    de:ad:be:ef:00:01

Example 9 — Spoof source MAC and IP

sudo arp-scan -I eth0 --srcaddr=00:11:22:33:44:55 --srcip=192.168.1.99 192.168.1.0/24

192.168.1.1   aa:bb:cc:11:22:33   TP-Link Corporation

Example 10 — Include round-trip time in results

sudo arp-scan -I eth0 --rtt --localnet

192.168.1.1     aa:bb:cc:11:22:33   0.842 ms   TP-Link Corporation
192.168.1.10    de:ad:be:ef:00:01   1.203 ms   Dell Inc.

7. Common Use Cases

• Reliable local-network host enumeration that bypasses ICMP/firewall filtering, since ARP cannot be blocked without breaking basic connectivity.
• Rogue device detection on corporate LANs.
• MAC vendor identification to fingerprint device types (printers, IoT, servers) at a glance.
• Verifying network segmentation/VLAN configuration using the --vlan tag option.

8. Automation with Bash

#!/bin/bash
# arp_inventory.sh - scan local subnet and log new devices
IFACE="eth0"
OUTFILE="arp_inventory.csv"
TMPFILE=$(mktemp)

sudo arp-scan -I "$IFACE" --localnet --plain --numeric > "$TMPFILE"

if [ -f "$OUTFILE" ]; then
    echo "[*] Comparing against previous inventory..."
    diff "$OUTFILE" "$TMPFILE" || echo "[!] Changes detected in network inventory"
fi

cp "$TMPFILE" "$OUTFILE"
rm "$TMPFILE"
echo "[+] Inventory updated: $OUTFILE"

9. Tips and Best Practices

• Always run with sudo, since raw ARP frame construction requires root privileges.
• Use --localnet for a quick, automatic sweep of the interface’s configured subnet without manually typing a CIDR range.
• Combine with --rtt to help distinguish local hosts from potential ARP-relay/proxy devices based on unusually high response times.
• Use --random and a larger --interval when scanning environments with active network monitoring to reduce the “burst” signature of the scan.
• Keep the bundled IEEE OUI database updated (arp-fingerprint, or reinstall the package) for accurate vendor identification.

10. Troubleshooting

• No hosts found on a known-populated network: confirm you’re on the correct interface with -I and that the interface has an IP address in the target subnet.
• “arp-scan: You need to be root to run this program”: re-run with sudo.
• Slow scans on large ranges: reduce --retry and --timeout values, or scan smaller sub-ranges.
• Vendor field shows “Unknown”: the OUI database may be outdated; update via the distribution package manager or get-oui/get-iab update scripts included with arp-scan.

11. References

• Official site and source: https://github.com/royhills/arp-scan
• Kali Linux tool page: https://www.kali.org/tools/arp-scan/
• Man page: man arp-scan (installed locally)