arp-scan Usage

Discover hosts on a local network via ARP.

arp-scan -I nic_name 192.168.1.1-192.168.1.255
arp-scan -I nic_name -l                          # use the interface's own netblock

Same idea with nmap (slower, but better at OUI lookups):

nmap -e nic_name -sn hosts

Scan hosts from a file and save to a pcap (read it back with tcpdump -r path/to/file):

arp-scan -I nic_name -W path/to/pcapfile -f path/to/hostsfile

Add padding after the packet data (for “short” files only):

arp-scan -I nic_name -A HEXVALUE hosts
arp-scan -I nic_name -A $(xxd FILE | cut -d ' ' -f 2-8 | tr -d ' \n') hosts

Spoof source IP and MAC (the ARP header still shows the real MAC):

arp-scan -I nic_name -s 12.34.56.78 -S 01:02:03:04:05:06 hosts

Find which host holds a given MAC:

arp-scan -I nic_name -T mac_address hosts

Find hosts listening to multicast:

arp-scan -I nic_name -T 01:00:5E:00:00:00 hosts

Find hosts in promiscuous mode:

arp-scan -I nic_name -T 01:00:01:02:03:04 hosts