About royhills/arp-scan
arp-scan is a network scanning tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on a local network. It is available for Linux, BSD, macOS, and Solaris under the GPLv3 license. The tool supports ARP fingerprinting (via the arp-fingerprint script), MAC address vendor lookup using the IEEE OUI database, and flexible host specification. It is commonly used for network inventory, security auditing, and troubleshooting local network segments.
Key Features
Uses ARP protocol for IPv4 host discovery on local networks
ARP fingerprinting capability to identify operating systems and devices
MAC address vendor lookup via IEEE OUI database
Cross-platform support: Linux, BSD, macOS, and Solaris
Open source under GPLv3 license
Flexible target specification with host lists and ranges
Includes arp-fingerprint and get-oui helper scripts
Pros & Cons
Pros
- Free and open source (GPLv3)
- Works across multiple operating systems
- Efficient ARP-based scanning without IP protocol dependencies
- Includes fingerprinting and MAC vendor identification
- Active development and community support on GitHub
Cons
- Limited to IPv4 hosts only
- Requires root or administrative privileges to run
- Only scans local network segments; cannot route across subnets
- No graphical user interface (command-line only)
Best For
Network inventory and asset discoverySecurity auditing and vulnerability assessmentTroubleshooting network connectivity issuesMapping local network topology
FAQ
What is arp-scan?
arp-scan is a command-line network scanning tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on a local network.
What operating systems does arp-scan support?
arp-scan is available for Linux, BSD, macOS, and Solaris.
Is arp-scan free?
Yes, arp-scan is free and open source software released under the GPLv3 license.
How do I install arp-scan?
You can build from source on GitHub using autoreconf, configure, make, and make install. Prerequisites include libpcap 1.5+ and a C99 compiler.
Can arp-scan scan remote networks?
No, arp-scan only discovers hosts on the local network segment because it relies on ARP broadcasts.