arp-scan

Fast ARP-based host discovery and MAC fingerprinting.

KaliParrotLinuxmedium

pkg: arp-scan

arp-scan sends ARP requests to enumerate hosts on the local segment and identify vendors from MAC OUIs.

Syntax

arp-scan [--interface=iface] {--localnet | CIDR}

Example

arp-scan --localnet

Scans the directly-connected network for all responding hosts.

Options & flags

What each switch does. Toggle them in the builder below to assemble a command.

--localnetScan the directly-connected network.
--interface <eth0>Interface to use.
(CIDR) <10.0.0.0/24>Explicit range to scan.
-gDo not print duplicate packets.

Command builder

Tick options (and fill any values) to build a ready-to-copy command.

arp-scan

Usage examples

arp-scan --localnet

Discover hosts on the local segment.

arp-scan -I eth0 10.0.0.0/24

Scan a specific range.

Advantages
  • Very fast LAN discovery
  • Reliable where ICMP is filtered
  • MAC/vendor identification
Disadvantages
  • Local segment only
  • Requires root
  • Generates ARP noise
Tags
#arp#lan

Official docs: arp-scan

Related commands

Frequently asked questions

What is arp-scan used for?
arp-scan sends ARP requests to enumerate hosts on the local segment and identify vendors from MAC OUIs.
What is an example arp-scan command?
A common example is: arp-scan --localnet — Scans the directly-connected network for all responding hosts.
Is arp-scan part of Kali Linux?
Yes. arp-scan ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install arp-scan.
What category of security tool is arp-scan?
arp-scan is a Information Gathering tool with a medium-risk profile when run against a live target.

Try recon tools live

Run real scans against a domain you control, stage by stage.

Open the lab →