There is no way to avoid sending an ARP request for each target IP address you intend to communicate with on your local link. This is because IP communication over an ARP-type link (like Ethernet or 802.11a/b/g/n) requires an ARP request and response to determine the hardware address (MAC) associated with the IP address you intend to contact.
As mentioned in the comments, Nmap has an option called
--disable-arp-ping. However, this does not disable sending ARP requests; it simply offloads that responsibility to the scanner's OS, requiring network-layer (IP) responses to consider the target host "up". This actually results in more traffic being sent. It is really only useful in cases where ARP responses are being spoofed.
There are host discovery options using NSE scripts that do not require sending ARP requests to every possible target address, but they are likely to miss at least some hosts:
broadcast-ping will send an ICMP Echo Request to the interface's broadcast address. Some systems will respond to these, but not all.
targets-sniffer will sniff network traffic for a configurable time period and add any observed addresses to the target queue. This requires the targets to be sending traffic to the scanner, usually broadcast traffic.
lltd-discovery are two of many scripts that send broadcast or multicast traffic to elicit responses from particular services on a network.
targets-ipv6-multicast-* scripts can be used to discover IPv6 addresses on your local network. In addition to directly scanning these IPv6 addresses, you can sometimes use other discovery scripts to gather the host's IPv4 addresses from various listening services.
- Other scripts like
dns-zone-transfer can gather lists of targets from certain services, but require you to know which hosts are running these services.