Re: Looking for arp scanner

From: Glenn Dawson (glenn_at_antimatter.net)
Date: 06/30/05

  • Next message: fbsd_user: "ipfw2 & flush state table" 
    Date: Wed, 29 Jun 2005 16:30:30 -0700
To: Vince Hoffman <jhary@unsane.co.uk>, Fabian Anklam <greatnorthern@gmail.com>

    At 03:45 PM 6/29/2005, Vince Hoffman wrote:

    >On Wed, 29 Jun 2005, Fabian Anklam wrote:
    >
    >>On 6/29/05, Glenn Dawson <glenn@antimatter.net> wrote:
    >>>At 02:18 PM 6/29/2005, Fabian Anklam wrote:
    >>>>Hi there,
    >>>>
    >>>>I've browsing freshports.org for an arp scanner and found only
    >>>>arpscan, which is marked broken and knowlan, which hasn't been updated
    >>>>in years. What's the tool of choice to map out IP-Adresses on a subnet
    >>>>when you know that quite a few hosts are firewalled from ping?
    >>>
    >>>Try nmap. It has a variety of different ways to "look" for systems on a
    >>>given subnet.
    >>Thanks. Tried nmap. As I said, some systems that i want to have in my
    >>output are locally firewalled and I doubt the -sP switch catches
    >>them. Port scans are out of the question.
    >
    >Thinking about it even if the host blocks ping then it will have to reply
    >to an arp request. so make a short script to clear the arp cache ('arp -a
    >-d' as root) then do your nmap -sP xxx.xxx.xxx.xxx/yyy and do an arp -a
    >which will list all the arp entries in your arp cache (should be every
    >host that responded to an arp request when you did the ping scan but maybe
    >pipe it through grep to only get the arps for ips in that range)
    >
    >also arping may be of use.

    I suppose if you need to be totally passive, you could do:

    tcpdump -i fxp0 arp

    (assuming of course that your network interface is on fxp0)
    and let it run for a bit. Eventually you'll catch all the active hosts on
    the network.

    -Glenn

    >Vince
    >
    >>
    >>>-Glenn
    >>>
    >>>
    >>>>Thanks, Fabian
    >>>>_______________________________________________
    >>>>freebsd-questions@freebsd.org mailing list
    >>>>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    >>>>To unsubscribe, send any mail to
    >>>>"freebsd-questions-unsubscribe@freebsd.org"
    >>>
    >>_______________________________________________
    >>freebsd-questions@freebsd.org mailing list
    >>http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    >>To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"
    >_______________________________________________
    >freebsd-questions@freebsd.org mailing list
    >http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    >To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

    _______________________________________________
    freebsd-questions@freebsd.org mailing list
    http://lists.freebsd.org/mailman/listinfo/freebsd-questions
    To unsubscribe, send any mail to "freebsd-questions-unsubscribe@freebsd.org"

  • Next message: fbsd_user: "ipfw2 & flush state table"

    Relevant Pages

    • RE: mac to ip address tools
      ... Say host A on your net is trying to communicate with host B. Host A ... needs to know the MAC address for host B (or the MAC address for the ... ARP replies are no good for you - those are ... About 100 machines using the same MAC address: ...
      (Pen-Test)
    • Re: [2.4 PATCH] bugfix: ARP respond on all devices
      ... >ARP is designed to find the next hop on a LAN. ... If the host has an IP ... >to have a default gateway configured. ... >would anyone know where the packet came from since the network is not ...
      (Linux-Kernel)
    • RE: Using ARP to map a network
      ... destination IP hosts are on the same L2, and by definition, L3 network. ... host ARP table on NET X should only show entries for those machines on its ... same subnet the host had conversations with. ... Cisco's recommendation (from a security point of view) is to disable proxy ...
      (Pen-Test)
    • Re: traffic analysis
      ... "The server is on a /20-network, and this leads to high amounts of ... 140MB a day sounds a lot to me, and your host should not contribute a lot to this kind of "background traffic": ... ARP packets are sent on the local network only, ARP is used to maintain the arp table which matches hardware addresses and ip addresses. ... If your host's firewall does not drop packets to closed ports then it will send a response packet. ...
      (freebsd-questions)
    • Re: arpwatch
      ... The _protocol_standard_ dictates that an ARP request is ... broadcast ARP requests, as well as accept unicast or broadcast ARP ... ARP request sent directly to the target host via unicast ...
      (Security-Basics)