Arp-scan option summary

From NTA-Wiki

Jump to: navigation, search

This page gives a brief overview of the various arp-scan options. It does not go into detail - for that, see the help output or read the man pages.


Target selection options

Long OptionShort OptionDescription
--file-fRead the list of targets from the specified file
--localnet-lGenerate the list of targets from the outgoing interface address and netmask
--random-RRandomise the target list so hosts are scanned in a random order
--numeric-NOnly allow IP addresses, no hostnames. Never perform DNS lookup

If neither the --file or --localnet options are specified, then targets must be specified as arguments. The target argument can either be a list of addresses or names, an IP network in the form <network>/<bits> or <network>:<netmask>, or a range of IP addresses in <start>-<end> format.

Network interface options

Long OptionShort OptionDescriptionDefault
--interface-ISpecify the network interface to useFirst up, configured, non-loopback interface
--snap-nSpecify the frame capture length64 Bytes

Outgoing Ethernet Frame Options

Long OptionShort OptionHeader FieldDefault
--destaddr-TDestination AddressFF:FF:FF:FF:FF:FF (Ethernet broadcast)
--srcaddr-SSource AddressOutgoing interface address
--prototype-yProtocol Type0x0806 (ARP)
--padding-AN/ANo padding (added by network driver)
--llc-LN/AEthernet-II Framing
--vlan-QN/ANo 802.1Q tag

Outgoing ARP Packet Options

Long OptionShort OptionARP FieldDefault
--arphrd-Har$hrd1 (Ethernet)
--arppro-par$pro0x0800 (IPv4)
--arphln-aar$hln6 (Ethernet address length)
--arppln-Par$pln4 (IPv4 address length)
--arpop-oar$op1 (ARP Request)
--arpsha-uar$shaOutgoing interface h/w address
--arpspa-sar$spaOutgoing interface IP address
--arptha-war$thazero (00:00:00:00:00:00)

The ARP field ar$tpa is set to the target IP address.

Outgoing packet timing options

Long OptionShort OptionDescriptionDefault
--retry-rTotal number of ARP request attempts for each target address2
--timeout-tTimeout in milliseconds500
--interval-iInter-packet intervalCalculated from bandwidth
--bandwidth-BOutbound Bandwidth256,000 bits/sec
--backoff-bTimeout backoff factor1.5

Received packet decoding and display options

Long OptionShort OptionDescription
--quiet-qDon't decode Vendor string
--ignoredups-gDon't display duplicate ARP responses
--ouifile-OSpecify location of IEEE OUI MAC/Vendor file
--iabfile-FSpecify location of IEEE OUI MAC/Vendor file
--macfile-mSpecify location of manual MAC/Vendor file
--pcapsavefile-WWrite received packets to pcap savefile
--rtt-DDisplay the packet round-trip time

Miscellanous Options

Long OptionShort OptionDescription
--help-hDisplay usage message and exit
--verbose-vDisplay extra debugging information
--version-VDisplay arp-scan program version and exit
Personal tools