[Feature Request] Stop scanning if N hosts are reachable about arp-scan HOT 8 CLOSED

OK, that makes sense. If you've got a network where you expect N hosts to be reachable, and don't care about potentially missing any extra hosts, then it would be sensible to exit after N responses have been received and avoid the pointless retries.

I'll see if it's possible to add this, as it's a valid feature that could also be useful for other use cases. And even if it isn't, it won't bother anyone who doesn't want this functionality.

from arp-scan.

I was going to say that returning nonzero should indicate an error, but then I realised that diff does exactly this. So I've pasted your expression in and it seems to work as intended. Commit 29d8b91

I think the behaviour should work for your use case, and it won't affect anyone that doesn't use this option anyway.

from arp-scan.

I don't fully understand the suggestion.

You use the example of scanning 192.168.8.0/24 and stopping if a response is received from 192.168.1.10. But this is unlikely to occur as host address 192.168.1.10 isn't within network 192.168.8.0/24.

Are you suggesting that there should be an option to stop after N responses are received from any hosts within the scanned network? Could you expand on the use case where this is useful?

from arp-scan.

@royhills

Thanks for the response.

I don't fully understand the suggestion.

Well I might be suggesting something not practically very useful. So you may ignore the suggestion :)

You use the example of scanning 192.168.8.0/24 and stopping if a response is received from 192.168.1.10. But this is unlikely to occur as host address 192.168.1.10 isn't within network 192.168.8.0/24.

Sorry for typo. I meant 192.168.8.10.

Are you suggesting that there should be an option to stop after N responses are received from any hosts within the scanned network?

No. I'm suggesting that there should be an option to stop after any responses are received from N hosts within the scanned network.

Could you expand on the use case where this is useful?

For instance there are 5 hosts (with random DHCP assigned IPs) on a /24 network. And I want to periodically check if those are up. So if the 5 hosts respond within 500ms, arp-scan should stop scanning and should not wait for timeout (e.g. 5 seconds) from the rest of 249 hosts. If timeout is reached but less than 5 hosts respond, an error should be returned.

Actually I have been using nmap, nping, fping etc. until recently I found arp-scan. And the good thing is it's quick. The only delaying factor is the unnecessary timeout when you are concerned with only a fixed number of hosts. What I'm asking for is partially offered by fping --reachable=N, but that too doesn't stop scanning when --reachable=N becomes true.

from arp-scan.

This would be a very useful feature.

from arp-scan.

Thank you for the reminder.

I've added a --limit option (short option -M) in commit 284eea5 which I think implements the feature you're looking for.

The documentation hasn't been updated, and I need to consider how duplicates should be handled, so I'm keeping this request open.

from arp-scan.

I've changed the handling of duplicate response packets in commit 686133f so now the number of responders reflects the number of hosts that responded not the number of packets that were received. This change makes the --limit option work correctly when duplicate responses are received.

from arp-scan.

Thank you.

How about return (host_limit == 0 || responders >= host_limit) ? 0 : 1; from main()?

from arp-scan.