arp-scan 简介

arp-scan是Kali Linux自带的一款ARP扫描工具。该工具可以进行单一目标扫描，也可以进行批量扫描。批量扫描的时候，用户可以通过CIDR地址范围或者列表文件的方式指定。该工具允许用户定制ARP包，构建非标准数据包。同时，该工具会自动解析Mac地址，给出MAC对应的硬件厂商，帮助用户确认目标。

什么是ARP
地址解析协议（Address Resolution Protocol），其基本功能为通过目标设备的IP地址，查询目标设备的MAC地址，以保证通信的顺利进行。 它是IPv4中网络层必不可少的协议，是根据IP地址获得物理地址MAC的一个TCP/IP协议。通过ARP，在局域网可以很容易构成一个ARP欺骗，从而得到有用数据信息。

查看网段所有的主机

[root@oradba arp-scan-1.8]$ arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8 with 256 hosts ( http://www.nta-monitor.com/tools/arp-scan/)
192.168.100.1   00:24:1d:17:d6:e3       GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.100.4   00:26:b9:51:68:ef       Dell Inc   //网卡
192.168.100.5   20:cf:30:6f:6f:c6       ASUSTek COMPUTER INC.
192.168.100.6   48:5b:39:86:1c:62       ASUSTek COMPUTER INC.
192.168.100.7   48:5b:39:86:1c:3a       ASUSTek COMPUTER INC.

有多个网卡可以指定选择哪个网卡

[root@gateway ~]$ arp-scan --interface=eth1 -l
Interface: eth1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.100.1   00:24:1d:17:d6:e3       GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.100.4   00:26:b9:51:68:ef       Dell Inc
192.168.100.5   20:cf:30:6f:6f:c6       ASUSTek COMPUTER INC.
192.168.100.6   48:5b:39:86:1c:62       ASUSTek COMPUTER INC.
192.168.100.7   48:5b:39:86:1c:3a       ASUSTek COMPUTER INC.
192.168.100.8   bc:30:5b:ad:74:22       Dell Inc.
192.168.100.9   00:26:b9:8e:16:17       Dell Inc
192.168.100.15  00:26:b9:35:cf:63       Dell Inc
192.168.100.17  00:0c:29:08:6a:06       VMware, Inc.
192.168.100.18  00:0c:29:08:6a:06       VMware, Inc.
192.168.100.19  00:0c:29:08:6a:06       VMware, Inc.
192.168.100.20  00:0c:29:08:6a:06       VMware, Inc.
192.168.100.22  00:24:1d:17:d6:e3       GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.100.23  84:2b:2b:59:31:4f       Dell Inc.
192.168.100.24  00:26:b9:8e:16:17       Dell Inc

指定某一段IP地址

[root@gateway ~]$ arp-scan --interface=eth1 192.168.100.0/29
Interface: eth1, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8 with 8 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.100.1   00:24:1d:17:d6:e3       GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.100.4   00:26:b9:51:68:ef       Dell Inc
192.168.100.5   20:cf:30:6f:6f:c6       ASUSTek COMPUTER INC.
192.168.100.6   48:5b:39:86:1c:62       ASUSTek COMPUTER INC.
192.168.100.7   48:5b:39:86:1c:3a       ASUSTek COMPUTER INC.

用于更新MAC地址，便于在扫描时知道使用的是那个厂商的网卡

[root@gateway ~]$ get-oui -v
Fetching OUI data from http://standards.ieee.org/regauth/oui/oui.txt
Fetched 2642079 bytes
Opening output file ieee-oui.txt
16445 OUI entries written to file ieee-oui.txt
[root@gateway ~]# get-iab -v
Fetching IAB data from http://standards.ieee.org/regauth/oui/iab.txt
Fetched 608631 bytes
Opening output file ieee-iab.txt
3995 IAB entries written to file ieee-iab.txt

其它用法可以参照arp-scan --help