Monthly Archives: May 2016

Linux

Use arp-scan to find devices in your local network

Leave a comment

arp-scan is an extremely useful tool to find devices connected to your local area network.
For installation, just use apt-get install arp-scan
and then, run as root:

root@i3-c753 ~ # arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 65536 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.0.160 00:0b:82:6f:6a:92 Grandstream Networks, Inc.
192.168.1.1 00:90:27:ed:9d:c1 INTEL CORPORATION
192.168.1.5 00:0b:82:68:65:69 Grandstream Networks, Inc.
192.168.1.4 5c:8a:38:5c:63:8f (Unknown)
192.168.1.7 f0:92:1c:65:76:d1 (Unknown)
192.168.1.8 f8:b1:56:ac:16:03 (Unknown)
192.168.1.12 90:1b:0e:08:c7:9e (Unknown)
192.168.1.17 00:0b:82:6f:66:d6 Grandstream Networks, Inc.
192.168.1.23 ec:a8:6b:ae:64:56 (Unknown)
192.168.1.31 00:04:a3:e6:c2:9c Microchip Technology, Inc.
192.168.1.38 00:14:53:b5:bc:db ADVANTECH TECHNOLOGIES CO.,LTD

Very fast, right? Unfortunately, as you noticed, some MAC addresses are displayed as “(unknown)” because default MAC database lookup table is not updated in default installation.
For this issue, authors of arp-scan gave us a very beautiful python script: “get-oui”
Here is how we can update the database (The server is slow, pls wait a few mins):

root@i3-c753 ~ # get-oui
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
Wide character in print at /usr/bin/get-oui line 135.
root@i3-c753 ~ # ll ieee-oui.txt
-rw-r--r-- 1 root root 667448 May 29 23:35 ieee-oui.txt
root@i3-c753 ~ # cp ieee-oui.txt /usr/share/arp-scan/
ieee-iab.txt ieee-oui.txt mac-vendor.txt
root@i3-c753 ~ # cp ieee-oui.txt /usr/share/arp-scan/
root@i3-c753 ~ #

After that here is the result:

root@i3-c753 ~ # arp-scan -l
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 65536 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.1 00:90:27:ed:9d:c1 Intel Corporation
192.168.1.5 00:0b:82:68:65:69 Grandstream Networks, Inc.
192.168.1.4 5c:8a:38:5c:63:8f Hewlett Packard
192.168.1.7 f0:92:1c:65:76:d1 Hewlett Packard
192.168.1.8 f8:b1:56:ac:16:03 Dell Inc.
192.168.1.12 90:1b:0e:08:c7:9e Fujitsu Technology Solutions GmbH
192.168.1.17 00:0b:82:6f:66:d6 Grandstream Networks, Inc.
192.168.1.23 ec:a8:6b:ae:64:56 Elitegroup Computer Systems Co.,Ltd.
192.168.1.31 00:04:a3:e6:c2:9c Microchip Technology Inc.
192.168.1.38 00:14:53:b5:bc:db ADVANTECH TECHNOLOGIES CO.,LTD

As a final small note, if you want to find the Vendor of an unknown MAC address, you can use my small script:

cat /usr/bin/macfind.sh
#!/bin/bash

curl --data-urlencode "mac=$1" http://api.macvendors.com/