What's new

multiple entries using ‘arp-scan’ but not reflected in ‘arp’ command

  • SNBForums Code of Conduct

    SNBForums is a community for everyone, no matter what their level of experience.

    Please be tolerant and patient of others, especially newcomers. We are all here to share and learn!

    The rules are simple: Be patient, be nice, be helpful or be gone!

Undareth

Occasional Visitor
To expand, I get multiple arp entries when conducting the ‘arp-scan’ command on my eth0 interface for my router.

However none of these entries are seen when using ‘arp’. I've transcribed a rough example from my ssh session.
Code:
arp-scan - I eth0 -l
Results(Ive fudged the network IDs, The Host IDs are correct):
123.244.255.128  
123.244.255.129
123.244.255.130
123.244.255.132
123.244.255.133
123.244.255.134
123.244.255.135

arp -i eth0
123.244.255.129

Router model is RTAC86U. To add, none of these entries are my router's actual host id (Host id is 123.244.255.131)
 
Last edited:
  • Like
Reactions: GWB
Two different functions that you can read from their respective man pages:

arp-scan sends ARP packets to hosts on the local network... https://linux.die.net/man/1/arp-scan
Arp manipulates or displays the kernel's IPv4 network neighbour cache. https://www.man7.org/linux/man-pages/man8/arp.8.html
Would this mean there are other hosts on that interface's network*,if looking at the arp-scan output. If so, is this something to be concerned about (duplicate hosts being generated or something to that effect).
 
Without seeing the real data I can't be sure. But I suspect this could be the proxy-arp situation described in the documentation. I see it on my gateway network:
Code:
xxx.4.152.1      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.2      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.3      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.4      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.5      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.6      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.7      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.8      00:01:5c:7a:fa:47       CADANT INC.
xxx.4.152.9      00:01:5c:7a:fa:47       CADANT INC.
 

Similar threads

Sign Up For SNBForums Daily Digest

Get an update of what's new every day delivered to your mailbox. Sign up here!
Top