Using nmap on a very large (/16) switched network can lead to an excessive number of ARP requests which can be detected by simple ARP counters listening to broadcasted ARP requests.

  1. Is there a way to avoid ARP host discovery on local network ?

  2. During port scan (TCP SYN), instead of slow down the scan speed (-T2 or less), is there any nmap parameters or external tools to fill and freeze the ARP cache ? Is it an effective way to handle L2 detection risk ?

  • When scanning the local network, nmap will indeed use ARP requests to determine whether an host is online or not. Your concern about possible detection of an unusual ARP request amount makes sense, but I'm not sure to understand exactly which ARP cache you plan to "fill and freeze" to avoid that? – WhiteWinterWolf Apr 23 '15 at 9:27
  • The main idea is to be completly "blank" in the POV of the ARP requests. So it could be 1. do not send ARP request for host discovery in local network and 2. do not send ARP requests when doint port scan. – Kartoch Apr 23 '15 at 10:22
  • I've edited the question to reflect our comment. – Kartoch Apr 23 '15 at 10:35
  • For 1: have you read the manual? (nmap.org/book/man-host-discovery.html): --disable-arp-ping – Michael Apr 23 '15 at 10:50

There is no way to avoid sending an ARP request for each target IP address you intend to communicate with on your local link. This is because IP communication over an ARP-type link (like Ethernet or 802.11a/b/g/n) requires an ARP request and response to determine the hardware address (MAC) associated with the IP address you intend to contact.

As mentioned in the comments, Nmap has an option called --disable-arp-ping. However, this does not disable sending ARP requests; it simply offloads that responsibility to the scanner's OS, requiring network-layer (IP) responses to consider the target host "up". This actually results in more traffic being sent. It is really only useful in cases where ARP responses are being spoofed.

There are host discovery options using NSE scripts that do not require sending ARP requests to every possible target address, but they are likely to miss at least some hosts:

  • broadcast-ping will send an ICMP Echo Request to the interface's broadcast address. Some systems will respond to these, but not all.
  • targets-sniffer will sniff network traffic for a configurable time period and add any observed addresses to the target queue. This requires the targets to be sending traffic to the scanner, usually broadcast traffic.
  • broadcast-dns-service-discovery and lltd-discovery are two of many scripts that send broadcast or multicast traffic to elicit responses from particular services on a network.
  • The targets-ipv6-multicast-* scripts can be used to discover IPv6 addresses on your local network. In addition to directly scanning these IPv6 addresses, you can sometimes use other discovery scripts to gather the host's IPv4 addresses from various listening services.
  • Other scripts like ntp-monlist or dns-zone-transfer can gather lists of targets from certain services, but require you to know which hosts are running these services.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.