no detection of mac adr of multiple machines having same ip adr in loaclnet about arp-scan HOT 5 CLOSED

Saurabh,

It's unusual to have duplicate IP addresses on a LAN, but they should all respond to an ARP request, so arp-scan should be able to find them.

By default, arp-scan will flag duplicate replies with (DUP: n).

One arp-scan has received a response from an IP address, it consideres it has replied, so you may also need to increase the timeout in case the other systems take a bit longer to reply. SOmething like --timeout=1000 to set the timeout to 1000ms or 1 second, which should be enough to catch all the replies.

Roy

Date: Thu, 22 Oct 2015 13:25:40 -0700
From: [email protected]
To: [email protected]
Subject: [arp-scan] no detection of mac adr of multiple machines having same ip adr in loaclnet (#5)

Hello,

My name is Saurabh Kukade. I am student of computer science student.

I am working on project concerning distributed computing.

So while using arp-scan, i am stucked at certain situation so i am wondering about behavior of arp-scan. I am explaining it below.

Situation.

-> I have 3 separate machines having unique Mac addr.
-> 3 of them has same IP address and they are connected through unmanaged switch.        
-> if i run 'arp-scan -l' on any of machines from among
-> if i run 'arp-scan -l' any of those machines then i don't get mac  addressees of remaining 2 machines.

Problem:
-> My requirement is to get the mac addresses of other machines in my local network which have same ip as my machine.

So, what can i do for this. and i am curious that why arp-scan tool fails to do that.

—
Reply to this email directly or view it on GitHub.

from arp-scan.

yes, i am aware of that it is unusual in lan. but i am working on algorithm which solves this problem if it has multiple same ip on different mac id(s) without using any dhcp server or same others. if you want to know my algorithm problem statement then i can tell you that too.

But, my point is, according to my observations when we run  arp-scan on a machine has  a certain ip then it does not catch other mac addresses which has same ip of that machine.

And if you run arp-scan on another machine which has unique ip in that subnet then it catches duplicate ip's mac addresses along with flag duplicate replies with (DUP: n).

Thanks and Regards,
Saurabh Kukade.

"A computer would deserve to be called intelligent if it could deceive a human into believing that it was human". - Alan Turing.

Date: Thu, 22 Oct 2015 13:37:42 -0700
From: [email protected]
To: [email protected]
CC: [email protected]
Subject: Re: [arp-scan] no detection of mac adr of multiple machines having same ip adr in loaclnet (#5)

Saurabh,

It's unusual to have duplicate IP addresses on a LAN, but they should all respond to an ARP request, so arp-scan should be able to find them.

By default, arp-scan will flag duplicate replies with (DUP: n).

One arp-scan has received a response from an IP address, it consideres it has replied, so you may also need to increase the timeout in case the other systems take a bit longer to reply. SOmething like --timeout=1000 to set the timeout to 1000ms or 1 second, which should be enough to catch all the replies.

Roy

Date: Thu, 22 Oct 2015 13:25:40 -0700

From: [email protected]

To: [email protected]

Subject: [arp-scan] no detection of mac adr of multiple machines having same ip adr in loaclnet (#5)

Hello,

My name is Saurabh Kukade. I am student of computer science student.



I am working on project concerning distributed computing.



So while using arp-scan, i am stucked at certain situation so i am wondering about behavior of arp-scan. I am explaining it below.

Situation.

-> I have 3 separate machines having unique Mac addr.

-> 3 of them has same IP address and they are connected through unmanaged switch.        

-> if i run 'arp-scan -l' on any of machines from among

-> if i run 'arp-scan -l' any of those machines then i don't get mac  addressees of remaining 2 machines.

Problem:

-> My  requirement is to get the mac addresses of other machines in my local network which have same ip as my machine.

So, what can i do for this. and i am curious that why arp-scan tool fails to do that.

—

Reply to this email directly or view it on GitHub.

—
Reply to this email directly or view it on GitHub.

from arp-scan.

I've just tested this on a vmware setup, and it seems to work fine. My setup is like this:

One Debian Wheezy host running arp-scan. Two Debian Lenny hosts as targets, with the same IP address (192.168.195.140). All connected to the same virtual switch.

Here's what I see:

root@debian-wheezy:/home/rsh/arp-scan# ./arp-scan 192.168.195.140
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.2 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.195.140 00:0c:29:8a:67:ae VMware, Inc.
192.168.195.140 00:0c:29:4f:10:19 VMware, Inc. (DUP: 2)

5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.2: 1 hosts scanned in 0.120 seconds (8.33 hosts/sec). 2 responded

Sniffing the ARP packets with tcpdump shows:

18:52:43.244597 ARP, Request who-has 192.168.195.140 tell 192.168.195.149, length 28
18:52:43.244786 ARP, Reply 192.168.195.140 is-at 00:0c:29:8a:67:ae, length 46
18:52:43.244790 ARP, Reply 192.168.195.140 is-at 00:0c:29:4f:10:19, length 46

Note that once all the hosts have responded, arp-scan will wait up to a maximum of the --timeout value. By default this is 500ms, which should be sufficient in almost all cases, but it might be worth trying to raise this to 1 second with --timeout=1000 just in case the systems are taking a long time to respond.

from arp-scan.

I'm closing this as there's been no comment for about 9 months. Please re-open the issue if the problem persists.

from arp-scan.

Yes... for sure

from arp-scan.