Looking for arp scanner

[Glenn Dawson]

At 03:45 PM 6/29/2005, Vince Hoffman wrote:


>On Wed, 29 Jun 2005, Fabian Anklam wrote:
>
>>On 6/29/05, Glenn Dawson <glenn at antimatter.net> wrote:
>>>At 02:18 PM 6/29/2005, Fabian Anklam wrote:
>>>>Hi there,
>>>>
>>>>I've browsing freshports.org for an arp scanner and found only
>>>>arpscan, which is marked broken and knowlan, which hasn't been updated
>>>>in years. What's the tool of choice to map out IP-Adresses on a subnet
>>>>when you know that quite a few hosts are firewalled from ping?
>>>
>>>Try nmap.  It has a variety of different ways to "look" for systems on a
>>>given subnet.
>>Thanks. Tried nmap. As I said, some systems that i want to have in my
>>output are locally firewalled and  I doubt the -sP switch catches
>>them. Port scans are out of the question.
>
>Thinking about it even if the host blocks ping then it will have to reply 
>to an arp request. so make a short script to clear the arp cache ('arp -a 
>-d' as root) then do your nmap -sP xxx.xxx.xxx.xxx/yyy and do an arp -a
>which will list all the arp entries in your arp cache (should be every 
>host that responded to an arp request when you did the ping scan but maybe 
>pipe it through grep to only get the arps for ips in that range)
>
>also arping may be of use.

I suppose if you need to be totally passive, you could do:

tcpdump -i fxp0 arp

(assuming of course that your network interface is on fxp0)
and let it run for a bit.  Eventually you'll catch all the active hosts on 
the network.

-Glenn


>Vince
>
>>
>>>-Glenn
>>>
>>>
>>>>Thanks, Fabian
>>>>_______________________________________________
>>>>freebsd-questions at freebsd.org mailing list
>>>>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>>>>To unsubscribe, send any mail to 
>>>>"freebsd-questions-unsubscribe at freebsd.org"
>>>
>>_______________________________________________
>>freebsd-questions at freebsd.org mailing list
>>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>>To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"
>_______________________________________________
>freebsd-questions at freebsd.org mailing list
>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
>To unsubscribe, send any mail to "freebsd-questions-unsubscribe at freebsd.org"