From my router (running OpenBSD) I can do:

arp-scan --interface=em1 --localnet

And get a list of all IP addresses and corresponding MAC addresses on my network.

But is it possible to scan for a system that is physically connected to the network (layer 1) and has a MAC address (layer 2) but not an IP address (layer 3)?

If so, what would be the command to scan my network for MAC addresses, regardless if they have or don't have an IP?

And for testing purposes, I have a raspberry pi. I'm not sure what network configuration would work to bring up the interface but not either give it a static IP or use DHCP, but I'm interested to learn if it's possible.

My goal here is to understand networking edge cases. (Ie, NIC is connected, has a MAC address, but no IP)

  • Do you have a managed switch connected to the subnet/vlan in question? You could use the Mac/Cam table to see what Macs are connected to each port. Jan 8, 2021 at 18:46
  • Advanced IP Scanner or Angry IP Scanner might be helpful to you: community.spiceworks.com/topic/…
    – Gloria Gu
    Jan 11, 2021 at 8:48

2 Answers 2


I don't see how this would be practically possible.

You can, of-course, listen (particularly on the router) for all traffic and pick up any mac addresses that are transmitting anything - but this won't reveal any traffic for a device that is sitting silently not sending out any traffic.


One networked device is not likely to see the MAC addresses of other devices, not without some software on the device that specifically makes this known. An Ethernet switch directs packets to the device it was intended, unless every device on the network is announcing its presence to others, such as with ARP, then there is no knowing. Even then the Ethernet card is likely to ignore any packets not directed to it. With an Ethernet hub, or switch configured to act like a hub, a device can't even sniff the traffic to other devices to find the MAC addresses of other devices on the network. Then the Ethernet controller has to run in "promiscuous mode" to pass those packets on to the OS, otherwise the controller will just ignore those packets.

That's at least half right, it's been a while since I had to think of networks on this level.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.