I have a security device that it doesn't respond to icmp and arp request. but i know its MAC address. I want to scan the device with nmap but always says "host down" and does not start port scan (even with -Pn). Also i defined i new arp record for the device but it didn't helped.


Nmap by default performs ARP scan at the discovery stage but if you want to disable it explicitly then you have to specify --disable-arp-ping. As you said that You have specified -Pn then it's for sure that port scanning will be done and Host is up should be reported.

Please also tell your Nmap's version so that we can help you even more.

  • but why the nmap scan with 00:00:00:00:00:00 mac address? (I have added an ARP record manualy for target ip address) – Giac Sep 27 '16 at 10:22
  • Could you please state your query clearly ? I think something like this is happening with you. – Abhishek Singh Sep 27 '16 at 13:56
  • i want to scan a security device with nmap and as i mentioned it doesn't respond to arp/icmp. i couldn't scan the target without --disable-arp-ping yesterday (nmap didn't start port scan). but today i added --disable-arp-ping and it start scaning (after adding new arp entry for target). but all the packet has been sent with zero mac address (device doesn't reply to syn requests), so i don't know all the ports is closed or it's due to wrong mac address. I want to know why it doesn't use the available mac address in arp table? – Giac Sep 27 '16 at 15:13
  • Well, this looks odd could You try using --spoof-mac <mac-address> and tell the results. Also update your Nmap to the latest version in case it is very old. – Abhishek Singh Oct 3 '16 at 18:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.