Help request arp-scan doesn't work

[BarryK]

Some of you guys know a lot more about networking than me.
I haven't had a LAN setup for quite a long time, have just used my phone as a hotspot.

I got out my TOTOLINK router, and plugged in two computers via ethernet, with wifi WAN to my phone.
It works ok, get Internet access from both computers.

This command is supposed to report everything in the local network:

Code: Select all

# arp-scan --localnet
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 1.964 seconds (130.35 hosts/sec). 0 responded

Going back a couple of years, when I had the LAN setup, it did work. From the arp-scan man page, this is an example:

Code: Select all

# arp-scan --localnet
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.4 with 8 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.84.179     00:02:b3:63:c7:57       Intel Corporation
10.0.84.177     00:d0:41:08:be:e8       AMIGO TECHNOLOGY CO., LTD.
10.0.84.180     00:02:b3:bd:82:9b       Intel Corporation
10.0.84.181     00:02:b3:1f:73:da       Intel Corporation
4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.4: 8 hosts scanned in 0.820 seconds (9.76 hosts/sec).  4 responded

I know that nmap can also do ARP scans, so I ran this, and it does work:

Code: Select all

#  nmap -PR -sn 192.168.1.5/24
Starting Nmap 7.80 ( https://nmap.org ) at 2022-11-15 21:26 +08
Nmap scan report for 192.168.1.1
Host is up (0.00019s latency).
MAC Address: F4:28:53:78:BD:20 (Zioncom Electronics (Shenzhen))
Nmap scan report for 192.168.1.4
Host is up (0.00015s latency).
MAC Address: 00:24:21:5C:B2:AF (Micro-star Int'l)
Nmap scan report for 192.168.1.5
Host is up.
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.25 seconds

...yes, that information is correct, 192.168.1.1 is the router, 192.168.1.4 is the other computer.

I got the info how to use nmap from here:

https://tryhackme.com/room/nmap01

So, the question is, what is wrong with arp-scan?
It used to work, what has gone wrong?

If you have a LAN, does arp-scan work for you?

[FeodorF]

@BarryK , same problem over here. Dunfell 2.7 same problem. If I remember right it used to work with the Buster series 2.5.x .
I found Buster 2.3.3 in my toolbox.

Code: Select all

# arp-scan --localnet
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9.5 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.178.1	38:10:d5:f4:4b:18	AVM Audiovisuelles Marketing und Computersysteme GmbH

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.5: 256 hosts scanned in 2.509 seconds (102.03 hosts/sec). 1 responded
# arp-scan --version
arp-scan 1.9.5

Copyright (C) 2005-2016 Roy Hills, NTA Monitor Ltd.
arp-scan comes with NO WARRANTY to the extent permitted by law.
You may redistribute copies of arp-scan under the terms of the GNU
General Public License.
For more information about these matters, see the file named COPYING.

libpcap version 1.8.1

[BarryK]

Feodor,
Thanks for the report.

I have compiled arp-scan 1.9.8, with some patches from debian, and it works.

Code: Select all

# arp-scan --localnet
Interface: eth0, type: EN10MB, MAC: a4:ae:11:16:23:28, IPv4: 192.168.1.5
Starting arp-scan 1.9.8 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.1	f4:28:53:78:bd:20	Zioncom Electronics (Shenzhen) Ltd.
192.168.1.4	00:24:21:5c:b2:2f	MICRO-STAR INT'L CO., LTD.

Attached, with a false ".gz"
So just rename it to "arp-scan" and copy to /usr/bin/, replacing the old one. And of course make sure the exec permission flags are set.

This fixes one bug in EasyShare, but I suspect there might be at least one more.
Will keep investigating.

Note, you can start EasyShare in a terminal, by running "easyshare" and can then see any error messages to the terminal.

[FeodorF]

Hi, @BarryK, there is one thing missing in v.1.9.8 . The identification by name is missing. Have you taken that out on purpose? Did a quick "easyshare" test too. There is no folder assigned for file sharing at /tmp/easyshare/M_slf

Code: Select all

# arp-scan --localnet
Interface: eth0, type: EN10MB, MAC: 44:87:fc:f7:8e:a5, IPv4: 192.168.178.145
Starting arp-scan 1.9.8 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.178.1	38:10:d5:f4:4b:18	(Unknown)

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.8: 256 hosts scanned in 2.028 seconds (126.23 hosts/sec). 1 responded
# 
# easyshare
Loading kernel modules ...
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.secure_redirects = 1
net.ipv4.conf.all.log_martians = 1
Flushing Tables ...
Firewall completely flushed!  Now running with no firewall.
192.168.178.0/24
eth0
Doit
copying firewall
EXIT="Exit on timeout"
/usr/sbin/firewall_ng: line 1387:  5750 Getötet                urxvt -bg yellow -fg black -geometry 60X10+1+1 --hold -e /etc/init.d/rc.firewall start

PrinterSharing.png (21.48 KiB) Viewed 540 times

FileSharing.png (25.88 KiB) Viewed 533 times

[BarryK]

Feodor,
Yes, there are also some more files for arp-scan, in /usr/share/arp-scan

PET with all the files:

https://distro.ibiblio.org/easyos/amd64 ... -amd64.pet

EasyShare has more things wrong with it:

https://bkhome.org/news/202211/easyshar ... e-tlc.html

I'll keep at it.