On linux there's arp
command:
arp -n
Address HWtype HWaddress Flags Mask Iface
192.168.1.100 ether 00:55:d1:c5:f8:1b C eth0
and
arp-scan -I eth0 -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.2 00:1b:fc:35:6a:9b ASUSTek COMPUTER INC.
192.168.1.54 c8:d3:a6:34:d2:1d (Unknown)
192.168.1.14 f0:25:b9:c2:6a:29 (Unknown)
Why I can't see correctly my devices?
I also have done:
nmap -sn 192.168.1.0/24
with arp
command I see 1 device, with arp-scan
I see other devices.
Does arp
command read the cache, while arp-scan
does a new scan (without reading any cache?)
Best Answer
"Arp manipulates the kernel's ARP cache in various ways."
It's very nature is to read from a cache. From http://linux.about.com/library/cmd/blcmdl8_arp.htm