In this lecture I'll show you how to scan your lan using a technique called ARP scanning. To understand
how this scan works
you have to deeply understand the ARP protocol.
I'd recommend you to watch the video again where I've explained in detail what ARP protocol is and how
it works.
ARP Scanning is especially useful if there are hosts on the network that want to remain hidden or
stealthy and they do not respond to any requests like ping, tcp or udp scans.
There are a lot of firewalls that block any incoming packets except ARP. Since ARP is not routable,
his type of scanning works only on your local LAN.
You can find wired or wireless hosts connected to the same LAN.
The first tool I'm going to show you is called arp-scan.
If it's not already installed on your system you can install it using apt or the package manager of
your Linux distribution. To check if ARP scan is installed
you can simply execute arp-scan command as root.
First I am becoming root. All of these are root commands and I am executing the command. I can install
it by executing apt install arp-scan
Let's see the help of the command.
It has a lot of options but one of the most useful is -l or -- local net.
It will deduce the network
address of its own interface and scan the entireLAN.
You don’t have to worry about subnetting or getting the LAN address from the IP address and its network
mask.
Lets start an ARP scanning.As root
I'm executing arp -scan; an uppercase I; the name of the interface.
Let's check the interface.
Its name is enp0s3.
In your case it can have another name.
so arp - scan -
I enp0s3 and -I.
Take care of that to the option for the interface is -I in uppercase
or you can use --interface instead.
It has scanned the network and this is the output.
These are the hosts on my LAN; if you don't specify the interface ARP
scan will search the system interface list for the lowest numbered, configured up interface excluding
loopback. The output looks great ARP scan is very noisy and the admin or an intrusion detection
system could find out very quickly that a scan is running.
If you want to be stealthier you could use another tool called Net discover.
This is both an active and passive ARP reconnaissance tool.
We'll discuss the active and passive modes of operation in a minute.
Let's install NET
Discover if you don't have it already.
It's not installed. apt update &&& apt install netdiscover
sorry only to & signs.
Okay.
It was installed.
Now you can start an arp scan simply by executing net discover as root; netdiscover.
This is the active mode of operation where a Net Discover is actively sending ARP requests packets
in order to discover the other hosts on the network.
We've already noticed some hosts; it's running continuously until you stop it by pressing on Q or control
+c. I'm stopping it. Other useful options are -i and the name of the interface to sniff packets
and if no interface is specified the first one available will be used.
Another useful option is-r. It's used to scan a given range instead of auto scan; for example let's
scan the entire sub network 192.168.0.0
/ 24
It is scanning the entire sumnet. Okay. let's try a passive scan! if you want to run it in passive mode
you just use -p option like this; if you enable the passive mode like shown in the example you
are seeing right now Net Discover does not send anything,
it only sniffs the traffic.
in fact it monitors ARP requests sent by the other hosts on the network, without sending anything.
Remember that ARP request packets are sent to the broadcast address so each host on the LAN receives
these packets.
This technique is really stealthy and prevents you from being noticed by someone.
It's common practice to change your own Mac address before launching a passive scan.