I would like to know if it's possible to use Nmap in order to scan hosts according to their mac address.

Or if it's not possible to do it directly, is there an option (i didn't find) to select only hosts with a specific mac address?

  • What would you scan them for, their IP or routing information? Point is: There is not much to find scanning in usual networks, as services usually of interest are provided at a higher level of the ISO/OSI model. – Tobi Nary Mar 17 '16 at 10:27

Keep in mind that nmap is an IP based scanner. Based on the information that you have provided, I would suggest using nmap to perform a host discovery i.e. identifying active hosts in a network. This step will give you a list of active IP addresses.

You can use ARP to resolve the IP addresses (Obtained during host discovery) to MAC addresses (Assuming its all in the same local area network). Once you have identified the MAC addresses that you wish to scan, feed the corresponding IP addresses to nmap for scanning.

In short:

Host Discovery > IP to MAC conversion > Identify target IP addresses using MAC > Port scanning

Refer this for more information on using nmap.

| improve this answer | |

Mac address are changed Hop by Hop. Mac address used in networking at data link layer. When you launch a scan your mac address changed by your gateway Mac and the same the target MAC address changed by their gateway.

| improve this answer | |
  • This does not answer the question – schroeder Mar 29 '16 at 16:45
  • Any way MAC address scanning not possible over WAN. It may possible only in a LAN. To scan mac address. We can use arp – Venkatesh Chinta Mar 31 '16 at 9:37

With nmap, you do scan for services at the IP layer (3) of the ISO/OSI model. Mac addresses are layer 2.

This would not keep you from resolving mac addresses to IP addresses using

arp -na

and working your way from there, though.

| improve this answer | |

no, NMAP is a OSI Layer 3 scanner and it needs IP address, see official docs

| improve this answer | |
  • This is not entirely true for the local network - see -PR in the official docs: nmap.org/book/man-host-discovery.html What is true is that there is no interface to specify MAC addresses in the scan. – schroeder Mar 29 '16 at 19:40
  • @schroeder IMHO an unavailable feature does not counts, isn't it? – Alexey Vesnin Mar 29 '16 at 20:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.