3

On linux there's arp command:

arp -n

Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.100            ether   00:55:d1:c5:f8:1b   C                     eth0

and

arp-scan -I eth0 -l

Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.2 00:1b:fc:35:6a:9b   ASUSTek COMPUTER INC.
192.168.1.54    c8:d3:a6:34:d2:1d   (Unknown)
192.168.1.14    f0:25:b9:c2:6a:29   (Unknown)

Why I can't see correctly my devices?

I also have done:

nmap -sn 192.168.1.0/24

with arp command I see 1 device, with arp-scan I see other devices.

Does arp command read the cache, while arp-scan does a new scan (without reading any cache?)

  • 2
    Indeed, arp man page says "arp - manipulate the system ARP cache". So, there is no scan involved nor whatever. You only see the entries in the cache used recently. – lgeorget Jun 30 '14 at 13:44
  • Thanks Igeorget. Understood. So, what's the command to see devices actually alive? – Pol Hallen Jun 30 '14 at 13:45
  • I'm pretty sure arp-scan does what you want but usually, people[who?] tend to use higher-level scans[citation required], such as those performed by nmap. – lgeorget Jun 30 '14 at 13:53
6

"Arp manipulates the kernel's ARP cache in various ways."

It's very nature is to read from a cache. From http://linux.about.com/library/cmd/blcmdl8_arp.htm

3

arp-scan is a completely different utility that actually scans. The linux 'arp' command only reads directly from the kernel's ARP cache. You can fake a scan using ping to populate the arp table.

Both are working exactly as they should be.

Not sure what you mean by "why I can't see correctly my devices?" those outputs are as they should be.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.