1

The solution I want to solve is to discover newly connected ip (and preferably mac and vendor) on the local network.

So far I've tried arp-scan and nmap.

I like arp-scan mainly because it's fast and pretty easy to create output from a bash script to a file.

However, it doesn't seem to discover more than one of the connected computers, where there is is actually 3. nmap makes a better job but it's more complex to create the wanted output and it's way slower.

This is run in a bash script (in a loop):

sudo arp-scan --interface=wlan0 --localnet | sed '1, 2d' | head -n -3 > ipDump.lst 

The pipes are just for formatting and to print it to a file (ipDump.lst).

I'm quite stuck in only discovering one computer.

My questions:

What I'm I doing wrong with arp-scan?

Is there any other program that fits my needs better?

Is my best solution nmap and if so: how should I configure it to be fast (I don't need port information or any other info) and create output that can pratically be outputed as ip adresses on each row to a file?

2 Answers 2

2

There is an arpwatch daemon which does this quite well. It can be configured to provide a variety of notifications. Normally, these would be delivered by email to the relevant administrator.

You may want to disable notifications, for the first few hours or days (depending on the network) while the arpwatch database is built.

It is possible to identify systems which have disappeared from the arpwatch state file. One of the columns contains the last time the device was seen.

0

If your goal is to have a program hang out and wait for new computers to arrive then listening to the ARP traffic is the way to go.

When a computer boots it should send out a "ARP Who Has" broadcast which you should receive on your computer as the "who has" announcement is broadcast to all computers on that Ethernet segment.

You can configure tcpdump (or other applications) to just dump these arp requests to a file and then read the file at your leisure (pcap format). To only get relevant ARP packets you would need to set the filter correctly for the packet type you are looking for. If you need the IP associated with the MAC address that was broadcasted you would need to generate your own ARP request.

4
  • Great explanation. So you are saying that the arp broadcast is triggered only when the computer boots? How about when it connects to a new network? Because generally, the computers will be booted and then connect to my network. Oct 2, 2014 at 7:59
  • @Victor: MAC broadcasts typically occur on boot, when connecting to a new network, and when negotiating an IP address. Every NIC that expects to receive traffic must do this on an Ethernet based network as it is a way of broadcasting to other computers and switches that the device exists at a particular address. That broadcast allows the switch to add the device to it's MAC address table, and in turn the broadcast is broadcasted to all other ports on the switch to allow the broadcast to propagate to the rest of the network.
    – Clarus
    Oct 2, 2014 at 16:38
  • Alright, just realized why I couldn't see some of the computers. It was becase of when the broadcasting is done (as explained above). I started my script when the computers were already connected (which won't be the case in a working enviroment) so there was no data recieved at the listener. I should probably read up a bit on networking (recomendations on pedagogical pdf:s or tutorials etc is welcome). Btw, what does NIC stands for? Oct 2, 2014 at 17:45
  • @Victor: NIC == Network Interface Card; I liked Beej's guide to network programming, but it may be a little off topic for what you are looking for. I mostly learned by mistake having written most of a network stack at this point.
    – Clarus
    Oct 2, 2014 at 22:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .