arp-scan
Fast ARP-based host discovery and MAC fingerprinting.
KaliParrotLinuxmedium
pkg: arp-scan
arp-scan sends ARP requests to enumerate hosts on the local segment and identify vendors from MAC OUIs.
Syntax
arp-scan [--interface=iface] {--localnet | CIDR}
Example
arp-scan --localnet
Scans the directly-connected network for all responding hosts.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
arp-scan
Usage examples
arp-scan --localnet
Discover hosts on the local segment.
arp-scan -I eth0 10.0.0.0/24
Scan a specific range.
Advantages
- Very fast LAN discovery
- Reliable where ICMP is filtered
- MAC/vendor identification
Disadvantages
- Local segment only
- Requires root
- Generates ARP noise
Tags
#arp#lan
Official docs: arp-scan ↗
Related commands
Frequently asked questions
What is arp-scan used for?
arp-scan sends ARP requests to enumerate hosts on the local segment and identify vendors from MAC OUIs.
What is an example arp-scan command?
A common example is: arp-scan --localnet — Scans the directly-connected network for all responding hosts.
Is arp-scan part of Kali Linux?
Yes. arp-scan ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install arp-scan.
What category of security tool is arp-scan?
arp-scan is a Information Gathering tool with a medium-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.