arp-scan

No entries match these filters. Clear filters

1. 2023-01-28 Roy Hills <royhills@hotmail.com> Jan 28, 2023 · release notes

   arp-scan adds pledge(2) support for restricted-service mode on OpenBSD

   • Enables pledge(2) calls to restrict the process surface after initial setup, available only on systems with the pledge() syscall (currently OpenBSD).

   1 detail in Everything

2. 2023-01-07 Roy Hills <royhills@hotmail.com> Jan 7, 2023 · release notes

   arp-scan adds -m flag to arp-fingerprint to include target MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet. in output

   └──▷ TRY IT
   Capture both device fingerprint and MAC address in a single arp-fingerprint run.
   copy

   $ arp-fingerprint -m <target_ip>

3. 1.10.0 Dec 13, 2022 · release notes

   arp-scan 1.10.0 adds --format output control and POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems..1e capabilities support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.10.0 https://github.com/royhills/arp-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.10.0

   └──▷ USE IT
   Scan the local network using capabilities instead of SUID root permissions
   shell copy

   sudo setcap cap_net_raw+p arp-scan && ./arp-scan --interface=eth0 <target>

   • Adds --format option to specify flexible output format for scan results
   • Enables POSIX.1e capabilities support via libcap for Linux builds instead of requiring SUID root

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --iabfile option has been removed; use --format or default OUI loading with the updated ieee-oui.txt file
   • !The get-iab script has been replaced with a stub and is no longer functional
4. 2022-10-31 Roy Hills <royhills@hotmail.com> Oct 31, 2022 · release notes

   arp-scan now uses a unified IEEE registry format via get-oui

   • get-oui now fetches registry data from all four IEEE registries (MA-L, MA-M, MA-S and IAB), formats it appropriately for arp-scan, and concatenates the result into the ieee-oui file.

   1 detail in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --iabfile option has been removed from arp-scan.
   • !get-iab is no longer supported and now calls die.
5. 1.9.9 Oct 9, 2022 · release notes

   arp-scan 1.9.9 adds native POSIXPOSIXA family of standards for operating-system interfaces, including process, file and shell behavior. Software that uses these interfaces is easier to move between compatible systems..1e capabilities support via libcap.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.9.9 https://github.com/royhills/arp-scan.git
   # already have the repo? check out this version:
   $ git checkout 1.9.9

   • Adds native POSIX.1e capabilities support for improved privilege management
   • Introduces limit_capabilities(), set_capability(), and drop_capabilities() functions to control Linux capabilities

   2 details in Everything

6. 2022-10-07 Roy Hills <royhills@hotmail.com> Oct 7, 2022 · release notes

   arp-scan 2022-10-07 adds --resolve (-d) to display hostnames instead of IPs

   └──▷ USE IT
   Scan a local subnet and output DNS names instead of raw IPs for easier identification of devices.
   shell copy

   arp-scan --interface=eth0 --localnet --resolve

   • Adds --resolve (-d) flag to arp-scan to resolve and display hostnames for responding hosts
   • Implements a new getopt parser in my_getopt.c/my_getopt.h, replacing the system dependency

   2 details in Everything

7. 2022-09-28 Roy Hills <royhills@hotmail.com> Sep 28, 2022 · release notes

   Adds --limit (-M) flag to stop scanning after a set number of responses

   • Adds the --limit (-M) option to exit after a specified number of target hosts respond

   1 detail in Everything

8. 2021-09-09 Roy Hills <royhills@hotmail.com> Sep 9, 2021 · release notes

   Adds --retry-send and --retry-send-interval flags to handle transient send failures during high-rate ARP scans

   └──▷ TRY IT
   Increase retry attempts and interval when scanning high-density networks to prevent scan failure due to temporary resource starvation.
   copy

   $ arp-scan --retry-send=10 --retry-send-interval=50ms 192.168.1.0/24

   • Adds --retry-send flag (default 3) to specify the number of retries when ARP packet send fails with EAGAIN
   • Adds --retry-send-interval flag (default 10ms) to set the delay between retries

   2 details in Everything

9. 10.3 Aug 30, 2016 · release notes

   arp-scan 10.3 adds -l option to arp-fingerprint and expands OS detection patterns

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 10.3 https://github.com/royhills/arp-scan.git
   # already have the repo? check out this version:
   $ git checkout 10.3

   └──▷ TRY IT
   Identify only major vendors like Apple or Microsoft to quickly filter for specific device classes on a local network.
   copy

   $ arp-fingerprint -l 192.168.1.0/24

   • Adds fingerprint patterns for FreeBSD 10.3, DragonflyBSD 4.6, Windows10, Linux 4.0, Linux 4.6, OpenBSD 5.9, and NetBSD 7.0.

   1 detail in Everything

10. 1.4 Nov 24, 2013 · release notes

    arp-scan 1.4 adds --iabfile, --macfile, and --localnet for enhanced vendor resolution and subnet scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.4

    └──▷ TRY IT
    Scan the entire local subnet using a manually maintained vendor mapping file for custom entries.
    copy

    $ arp-scan --localnet --macfile /path/to/custom-mac-vendor.txt

    Use a specific IEEE IAB database file for vendor identification.
    copy

    $ arp-scan --iabfile /path/to/iab-listings.txt <interface>

    • Adds --iabfile option to specify a custom IEEE IAB listing file, controlled by the new get-iab update script.
    • Adds --macfile option to specify a manual MAC/Vendor mapping file (e.g. mac-vendor.txt).
    • Adds --localnet option to scan all IP addresses on the specified interface network and mask.

    3 details in Everything

11. 1.5 Nov 24, 2013 · release notes

    arp-scan v1.5 adds native support for FreeBSD, OpenBSD, NetBSD, and macOS (Darwin).

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.5 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.5

12. 1.6 Nov 24, 2013 · release notes

    arp-scan 1.6 adds Sun Solaris support and new ARP fingerprint patterns.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.6 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.6

    • Adds Sun Solaris support (tested on Solaris 9 SPARC), extending the operational surface of DLPI-based systems
    • New arp-fingerprint patterns for IOS 11.2, 11.3, and 12.4; ScreenOS 5.1-5.4; Cisco VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. Concentrator 4.7; AIX 4.3 and 5.3; Nortel Contivity 6.00 and 6.05; Cisco PIX 5.1 through 7.0

    2 details in Everything

13. 1.7 Nov 24, 2013 · release notes

    arp-scan 1.7 adds --pcapsavefile, VLAN tagging, LLC framing, and new ARP fingerprint patterns

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.7 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.7

    └──▷ TRY IT
    Capture ARP traffic to a pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file for later inspection with wireshark on an isolated network segment.
    copy

    $ arp-scan --interface=eth0 --localnet -W captured_arp.pcap

    Identify Cisco IP phones by triggering LLC/SNAP framing in ARP requests, which some legacy devices respond to differently.
    copy

    $ arp-scan --interface=eth0 --llc 192.168.1.0/24

    • Adds --pcapsavefile (-W) flag to save ARP response packets to a pcap file for offline analysis in tools like tcpdump or wireshark
    • Adds --llc (-L) flag to send outgoing ARP requests using RFC 1042 LLC/SNAP framing instead of default Ethernet-II
    • Adds new arp-fingerprint patterns for Cisco 79xx IP Phone SIPSIPSession Initiation Protocol, an IETF signaling standard for setting up and tearing down real-time voice and video calls over IP networks, giving cyber tools a structured way to intercept, fuzz, or analyze VoIP traffic. versions 5.x, 6.x, 7.x, and 8.x

    3 details in Everything

14. 1.8 Nov 24, 2013 · release notes

    arp-scan 1.8 adds support for trailer ARP replies, VLAN/LLC packets, and macOS builds

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.8 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.8

    • Adds support for trailer ARP replies (early BSD Unix VAX format)
    • Adds support for ARP packets with both 802.1Q802.1QAn IEEE standard that adds a 4-byte VLAN tag to Ethernet frames, letting a single physical link carry traffic for multiple isolated networks. Cyber tools use it to capture or inject traffic on specific VLANs. VLAN tag and LLC/SNAP framing
    • Adds --help flag to explicitly control full help output display
    • Enables compilation on Apple Mac OS X with Xcode 2.5+

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Help output is no longer displayed on usage errors; only shown when explicitly requested
15. 1.9 Nov 24, 2013 · release notes

    arp-scan 1.9 adds --rtt for round-trip time display, Dragonfly BSD support, and ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. build

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.9 https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 1.9

    └──▷ USE IT
    Scan a local subnet and display the round-trip time for each ARP reply to measure network latency.
    shell copy

    arp-scan --localnet --rtt

    Scan a specific interface and display round-trip times, using the new default 500ms timeout for better reliability on slower links.
    shell copy

    arp-scan -I eth0 --rtt

    • Adds --rtt (alias -D) option to display packet round-trip time in scan results
    • Added new arp-fingerprint patterns for GNU/Hurd, Amazon Kindle (Linux 2.6), BeOS, Windows 8, Recent Linux, FreeBSD, NetBSD, OpenBSD and RiscOS
    • Added support for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. 64-bit CPUsCPUsThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. via autoconf 2.69 and automake 1.11

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Now requires libpcap 0.9.3 or later
16. 2013-11-02 Roy Hills <Roy.Hills@nta-monitor.com> Nov 2, 2013 · release notes

    arp-scan adds -x/--plain to suppress headers and output one line per host

    └──▷ TRY IT
    Produce clean, one-line-per-host output for easier scripting or parsing.
    copy

    $ arp-scan --localnet -x

    • Adds --plain (-x) option to supress printing of header and footer text in arp-scan output

    1 detail in Everything

17. 2011-12-30 Roy Hills <Roy.Hills@nta-monitor.com> Dec 30, 2011 · release notes

    arp-scan now checks current directory for MAC/vendor mapping files before system-wide location

18. 802.1q Feb 26, 2011 · release notes

    arp-scan gains check-packet script support for validating custom ARP requests with 802.1Q802.1QAn IEEE standard that adds a 4-byte VLAN tag to Ethernet frames, letting a single physical link carry traffic for multiple isolated networks. Cyber tools use it to capture or inject traffic on specific VLANs. VLAN tags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 802.1q https://github.com/royhills/arp-scan.git
    # already have the repo? check out this version:
    $ git checkout 802.1q

    └──▷ TRY IT
    Verify that a crafted ARP packet matches the expected 802.1Q VLAN and LLC/SNAP structure before deployment.
    copy

    $ ./check-packet pkt-custom-request-vlan-llc.dat

19. 2011-02-21 Roy Hills <Roy.Hills@nta-monitor.com> Feb 21, 2011 · release notes

    arp-scan adds detailed help mode, non-IP ARP response detection, and BlackBerry OS fingerprint

    └──▷ TRY IT
    Get full help text showing all available options instead of the brief summary.
    copy

    $ arp-scan --help

20. 2011-02-03 Roy Hills <Roy.Hills@nta-monitor.com> Feb 3, 2011 · release notes

    arp-scan drops root requirement when --writepkttofile is used

    └──▷ USE IT
    Run arp-scan as a normal user to dump packets to a file without needing sudo privileges.
    shell copy

    arp-scan --writepkttofile outfile.pcap -l

    • Drops the need for root privileges when --writepkttofile is specified by bypassing link-layer sockets and pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. handles.
    • Replaces get_host_address() with inet_pton() in add_host_pattern() and add_host() for more efficient IP pattern handling.

    2 details in Everything

21. 2011-02-02 Roy Hills <Roy.Hills@nta-monitor.com> Feb 2, 2011 · release notes

    arp-scan adds --readpktfromfile capability to read from pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. savefiles

    • --readpktfromfile now reads from a pcap savefile rather than from a raw file.
    • New test files pkt-simple-response.pcap, pkt-padding-response.pcap, pkt-vlan-response.pcap, and pkt-llc-response.pcap for check-decode.

    2 details in Everything

22. 2011-01-31 Roy Hills <Roy.Hills@nta-monitor.com> Jan 31, 2011 · release notes

    arp-scan adds Windows 7 fingerprint support and updates verbose output display.

    • arp-fingerprint added fingerprint for Windows 7
    • Changed what gets displayed for the different verbose levels in arp-scan.c

    2 details in Everything

23. 2008-07-11 Roy Hills <Roy.Hills@nta-monitor.com> Jul 11, 2008 · release notes

    arp-scan 1.6.4 auto-selects interface via --interface or pcap_lookupdev if unspecified

24. 2008-05-03 Roy Hills <Roy.Hills@nta-monitor.com> May 3, 2008 · release notes

    arp-scan 2008-05-03 adds --pcapsavefile to export ARP traffic to pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic.

    └──▷ USE IT
    Capture raw ARP traffic for offline analysis with a packet analyzer
    shell copy

    arp-scan --interface=eth0 --pcapsavefile=/tmp/arp_traffic.pcap 192.168.1.0/24

    • Adds --pcapsavefile (-W) option to save received ARP responses in a specified pcap file for later analysis

    1 detail in Everything

25. 2007-12-10 Roy Hills <Roy.Hills@nta-monitor.com> Dec 10, 2007 · release notes

    arp-scan adds --vlan (-Q) to send tagged ARP packets and improves CLI error handling.

    └──▷ TRY IT
    Send ARP requests on a specific VLAN to discover devices isolated in that network segment.
    copy

    $ arp-scan --vlan=100 192.168.1.0/24

    • Adds --vlan (-Q) flag to send ARP packets with an 802.1Q802.1QAn IEEE standard that adds a 4-byte VLAN tag to Ethernet frames, letting a single physical link carry traffic for multiple isolated networks. Cyber tools use it to capture or inject traffic on specific VLANs. VLAN tag
    • Improves argument parsing for flags like --snap by rejecting non-numeric values

    2 details in Everything