Linux – arp (where’re the network devices?)

arplinux

On linux there's arp command:

arp -n

Address                  HWtype  HWaddress           Flags Mask            Iface
192.168.1.100            ether   00:55:d1:c5:f8:1b   C                     eth0

and

arp-scan -I eth0 -l

Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.2 00:1b:fc:35:6a:9b   ASUSTek COMPUTER INC.
192.168.1.54    c8:d3:a6:34:d2:1d   (Unknown)
192.168.1.14    f0:25:b9:c2:6a:29   (Unknown)

Why I can't see correctly my devices?

I also have done:

nmap -sn 192.168.1.0/24

with arp command I see 1 device, with arp-scan I see other devices.

Does arp command read the cache, while arp-scan does a new scan (without reading any cache?)

Best Answer

"Arp manipulates the kernel's ARP cache in various ways."

It's very nature is to read from a cache. From http://linux.about.com/library/cmd/blcmdl8_arp.htm

Related Question