arp-scan

arp-scan is designed for discovering devices on local networks by leveraging the Address Resolution Protocol (ARP). It scans specified IP ranges or local networks, identifying active hosts and their associated MAC addresses. The tool also fingerprints systems based on ARP responses and maps MAC addresses to vendor information using OUI databases.

Common use cases include network inventory, identifying unauthorized devices, and reconnaissance during penetration testing. It excels in local network environments where ARP operates at layer 2, making it faster and more reliable than higher-layer scanning tools for discovering local hosts.

The tool supports Linux and BSD systems under the GPL license and requires raw socket privileges, typically achieved through root access or POSIX capabilities. It provides extensive customization for packet crafting, timing, output formatting, and bandwidth control.

arp-scan creates raw Ethernet frames containing ARP request packets and transmits them to target IP addresses using raw sockets. It requires CAP_NET_RAW privileges on Linux or root access. The tool supports custom ARP fields (ar$sha, ar$spa, ar$op etc.), Ethernet headers (--srcaddr, --destaddr), VLAN tagging, and LLC encapsulation.

Responses are captured via libpcap, decoded, and matched to sent requests. Duplicate responses are tracked, RTT is calculated if enabled, and MAC addresses are looked up in OUI/mac-vendor files for vendor identification. Output can be formatted with custom templates using field variables like ${ip}, ${mac}, ${vendor}.