Comments (11)
sorry to dig up this old issue
No problem at all. That's why I leave unresolved issues open.
One limitation to be aware of is that arp-scan only uses the first IP address on the interface. It's possible to have many IP addresses on one interface with modern kernels.
With that limitation in mind I don't think there's any reason why it can't be added if there's actually a use case. I've probably sofened my stance a little now that most of the large long-standing requests have been addressed :-)
from arp-scan.
Thanks for suggesting this. It makes sense, and is easy to do.
Commit 9d62503 includes the interface MAC address in the interface summary output. Does this do what you're looking for?
from arp-scan.
Thanks a lot for the quick response!
Yes, this is definitely better. But - although it would probably be more complicated - wouldn't it make sense also to include a line with the local MAC and used IP address, when this address is in the requested scan range (e.g. with --localnet)? (And then maybe move the MAC address to the --verbose display together with the used IP.)
from arp-scan.
Yes, adding the interface IP address would be a good idea. I'll see if there's an easy way to do this on the same "Interface:" line, as I want to avoid adding additional output lines to avoid problems for people who have scripts that parse the output.
from arp-scan.
Honestly, I don't see the reason why the scan of a given IP range should exclude yourself if you're in that range. But for compatibility, I'd suggest an additional option (like --includeself or -S
) to add the line about the local MAC/IP to the list.
Adding the information about the local MAC and IP to the "Interface:" line (or an additional line after it) will be nice, but then maybe only when --verbose
is specified.
Actually, thinking about scripts, it would be even nicer if there was an option to silence the 'header' and 'footer' lines and leave only the scan result lines. But I'm afraid I'm starting to ask too much ;)
from arp-scan.
The reason that a scan doesn't include your own IP is a feature / limitation of the ARP protocol, not arp-scan. arp-scan will include all IPs in the range including your own if applicable. But no operating systems I'm aware of will respond to an ARP request where the source and destination and both a local interface.
For script processing, the --plain option will disable the header and footer leaving just the scan result lines. I hope that anyone parsing output with a script would use this option, but you never know.
from arp-scan.
I wasn't aware of the --plain option, it seems to be relatively new (or rather the version in Debian 9 is too old) and is exactly what I had in mind. Thanks!
So what about adding a feature to circumvent the limitation of the APR protocol? :)
from arp-scan.
Debian only builds from the last official release, not from the latest git version. I should probably plan for a new release at some point, as there have been many changes since the debian version.
I've added the IP address in the latest commit: b6d684f I've also changed the output slightly to ensure it fits on one line.
I probably won't include the host's own IP in the output though, as that would go against the spirit of the tool.
from arp-scan.
It's a tricky thing with distro package maintainers. Debian 10, which was released two months ago already has 1.9.5. Debian 9, released in 2017, still has version 1.9 (4 years old at the time of release). For CentOS 7 there is an EPEL package of 1.9.2. Don't know about CentOS 8 yet.
One last attempt at persuading you: I think I understand the argument about 'the spirit of the tool': you can't actually arp-scan the local machine, so any info about it would be kind of 'fake'. On the other hand, I believe the tool is most often used to show the active devices in the local network, and the local machine is part of this network and is active. For this use case I think it should be acceptable to have an extra switch to include the local info in the output (also with --plain).
Anyway, thanks a lot for your time and effort! Wish you all the best!
P.S. One more thing I noticed: the documentation link http://www.nta-monitor.com/wiki/ doesn't work any more. It takes you to https://nta.intertek.com/.
from arp-scan.
Thanks for your comments. Regarding displaying local machine IP/MAC, arp-scan has this information now (as displayed on the Interface: line). It wouldn't be a problem to add a new switch to display it, so I'll consider this.
Regarding the wiki, the comapny NTA Monitor Ltd which used to host the wiki was acquired by Intertek plc in 2018, and the web site got moved. I think I have a backup of the old site, so I just need to look at an appropriate site to host the wiki and update the documentation accordingly.
I'm leaving this ticket open for now so I remember these issues when I next visit the arp-scan code.
from arp-scan.
Hi Roy, sorry to dig up this old issue, but this feature is something I'm looking for, I'll explain my use case.
I have a bit of software that scans the network using arp-scan to find IP addresses associated with a list of mac addresses it knows about.
But, I want to test this locally on a single machine without changing the code, but even if I put another interface in the same subnet on the host it never appears in the arp-scan results.
I don't think there's any workaround for this ( I've tried a few things ) but thought I'd add fuel for thought with this particular scenario.
from arp-scan.
Related Issues (20)
- get-oui from Fedora package arp-scan-1.9.7-7.fc37 fails with unhelpful message due to unmet dependency HOT 1
- Show MAC in arp-fingerprint HOT 6
- arp-scan does not look in /usr/share/arp-scan if trying to open ieee-oui.txt failes with EACCESS HOT 15
- Binary packaging status for version 1.10.0 HOT 2
- Potential memory leak in arp-scan/arp-scan.c HOT 2
- Command Line Argument for turning off Promiscuous Mode HOT 7
- Feature Request: Output options: Add sorting HOT 6
- "Target list from interface network X netmask Y" is displayed with --plain option HOT 1
- Parallel arp-scan missing devices HOT 2
- Will this reposity be moved to cmake? HOT 2
- how to update `ieee-oui.txt` on macOS? HOT 3
- Add windows support
- Find portable function to get interface MAC address
- Add support for Cisco ISL VLANs in addition to 802.1Q HOT 1
- many hosts respond to single arp packet HOT 4
- Duplicate ARP responses from Intel Wi-Fi 6E AX211 on Windows 11 HOT 1
- Change release tags from lightweight to annotated
- Doesn't work on WSl2 NAT network mode HOT 1
- Speed up on single mac target HOT 2
- file permission denied HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from arp-scan.