pax_global_header 0000666 0000000 0000000 00000000064 14345150431 0014512 g ustar 00root root 0000000 0000000 52 comment=0e6fd36122d50128fffd6f82ca1153f224f8fcd5
arp-scan-1.10.0/ 0000775 0000000 0000000 00000000000 14345150431 0013275 5 ustar 00root root 0000000 0000000 arp-scan-1.10.0/.github/ 0000775 0000000 0000000 00000000000 14345150431 0014635 5 ustar 00root root 0000000 0000000 arp-scan-1.10.0/.github/workflows/ 0000775 0000000 0000000 00000000000 14345150431 0016672 5 ustar 00root root 0000000 0000000 arp-scan-1.10.0/.github/workflows/c-cpp.yml 0000664 0000000 0000000 00000001735 14345150431 0020425 0 ustar 00root root 0000000 0000000 name: Build
on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]
jobs:
build:
runs-on: ${{ matrix.os }}
strategy:
matrix:
os: [ubuntu-latest, macos-latest]
steps:
- uses: actions/checkout@v3
- name: install autotools on macos
run: brew install automake
if: matrix.os == 'macos-latest'
- name: install libpcap on linux
run: |
sudo apt-get update -qq
sudo apt-get install -qq libpcap0.8-dev libcap-dev
if: matrix.os == 'ubuntu-latest'
- name: autoreconf
run: autoreconf --install
- name: configure
run: ./configure
- name: make
run: make
- name: make check
run: make check
- name: make distcheck
run: make distcheck
- name: print info
run: |
uname -a
lsb_release -a || true
sw_vers || true
gcc --version
autoconf --version
automake --version
./arp-scan --version
arp-scan-1.10.0/.github/workflows/code-coverage.yml 0000664 0000000 0000000 00000001630 14345150431 0022120 0 ustar 00root root 0000000 0000000 name: coverage
on:
push:
branches: [ "master" ]
pull_request:
branches: [ "master" ]
# Allows you to run this workflow manually from the Actions tab
workflow_dispatch:
jobs:
coverage:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: install libpcap and lcov
run: |
sudo apt-get update -qq
sudo apt-get install -qq libpcap0.8-dev libcap-dev lcov
- name: autoreconf
run: autoreconf --install
- name: configure with gcov
run: ./configure --enable-gcov
- name: make
run: make
- name: make check
run: make check
- name: create lcov.info
run: lcov --directory . --capture --output-file lcov.info
- name: Coveralls
uses: coverallsapp/github-action@master
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
path-to-lcov: ./lcov.info
arp-scan-1.10.0/.github/workflows/codeql.yml 0000664 0000000 0000000 00000005455 14345150431 0020675 0 ustar 00root root 0000000 0000000 # For most projects, this workflow file will not need changing; you simply need
# to commit it to your repository.
#
# You may wish to alter this file to override the set of languages analyzed,
# or to provide custom queries or build logic.
#
# ******** NOTE ********
# We have attempted to detect the languages in your repository. Please check
# the `language` matrix defined below to confirm you have the correct set of
# supported CodeQL languages.
#
name: "CodeQL"
on:
push:
branches: [ "master" ]
pull_request:
# The branches below must be a subset of the branches above
branches: [ "master" ]
schedule:
- cron: '37 17 * * 2'
jobs:
analyze:
name: Analyze
runs-on: ubuntu-latest
permissions:
actions: read
contents: read
security-events: write
strategy:
fail-fast: false
matrix:
language: [ 'cpp' ]
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
steps:
- name: Checkout repository
uses: actions/checkout@v3
- name: install libpcap
run: |
sudo apt-get update -qq
sudo apt-get install -qq libpcap0.8-dev libcap-dev
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v2
with:
languages: ${{ matrix.language }}
# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
# Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
# queries: security-extended,security-and-quality
# Autobuild attempts to build any compiled languages (C/C++, C#, or Java).
# If this step fails, then you should remove it and run the build manually (see below)
- name: Autobuild
uses: github/codeql-action/autobuild@v2
# ℹ️ Command-line programs to run using the OS shell.
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
# If the Autobuild fails above, remove it and uncomment the following three lines.
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
# - run: |
# echo "Run, Build Application using script"
# ./location_of_script_within_repo/buildscript.sh
- name: Perform CodeQL Analysis
uses: github/codeql-action/analyze@v2
arp-scan-1.10.0/.gitignore 0000664 0000000 0000000 00000000606 14345150431 0015267 0 ustar 00root root 0000000 0000000 # Autoconf and automake generated files
.deps/
INSTALL
Makefile
Makefile.in
aclocal.m4
autom4te.cache/
config.guess
config.h
config.h.in
config.h.in~
config.log
config.status
config.sub
configure
depcomp
install-sh
missing
stamp-h1
compile
test-driver
configure.ac~
# Compiler output files
*.o
arp-scan
*.gcno
*.gcda
*.gcov
# IEEE OUI and IAB backup files
ieee-iab.txt.bak
ieee-oui.txt.bak
arp-scan-1.10.0/AUTHORS 0000664 0000000 0000000 00000000012 14345150431 0014336 0 ustar 00root root 0000000 0000000 Roy Hills
arp-scan-1.10.0/COPYING 0000664 0000000 0000000 00000104515 14345150431 0014336 0 ustar 00root root 0000000 0000000 GNU GENERAL PUBLIC LICENSE
Version 3, 29 June 2007
Copyright (C) 2007 Free Software Foundation, Inc.
Everyone is permitted to copy and distribute verbatim copies
of this license document, but changing it is not allowed.
Preamble
The GNU General Public License is a free, copyleft license for
software and other kinds of works.
The licenses for most software and other practical works are designed
to take away your freedom to share and change the works. By contrast,
the GNU General Public License is intended to guarantee your freedom to
share and change all versions of a program--to make sure it remains free
software for all its users. We, the Free Software Foundation, use the
GNU General Public License for most of our software; it applies also to
any other work released this way by its authors. You can apply it to
your programs, too.
When we speak of free software, we are referring to freedom, not
price. Our General Public Licenses are designed to make sure that you
have the freedom to distribute copies of free software (and charge for
them if you wish), that you receive source code or can get it if you
want it, that you can change the software or use pieces of it in new
free programs, and that you know you can do these things.
To protect your rights, we need to prevent others from denying you
these rights or asking you to surrender the rights. Therefore, you have
certain responsibilities if you distribute copies of the software, or if
you modify it: responsibilities to respect the freedom of others.
For example, if you distribute copies of such a program, whether
gratis or for a fee, you must pass on to the recipients the same
freedoms that you received. You must make sure that they, too, receive
or can get the source code. And you must show them these terms so they
know their rights.
Developers that use the GNU GPL protect your rights with two steps:
(1) assert copyright on the software, and (2) offer you this License
giving you legal permission to copy, distribute and/or modify it.
For the developers' and authors' protection, the GPL clearly explains
that there is no warranty for this free software. For both users' and
authors' sake, the GPL requires that modified versions be marked as
changed, so that their problems will not be attributed erroneously to
authors of previous versions.
Some devices are designed to deny users access to install or run
modified versions of the software inside them, although the manufacturer
can do so. This is fundamentally incompatible with the aim of
protecting users' freedom to change the software. The systematic
pattern of such abuse occurs in the area of products for individuals to
use, which is precisely where it is most unacceptable. Therefore, we
have designed this version of the GPL to prohibit the practice for those
products. If such problems arise substantially in other domains, we
stand ready to extend this provision to those domains in future versions
of the GPL, as needed to protect the freedom of users.
Finally, every program is threatened constantly by software patents.
States should not allow patents to restrict development and use of
software on general-purpose computers, but in those that do, we wish to
avoid the special danger that patents applied to a free program could
make it effectively proprietary. To prevent this, the GPL assures that
patents cannot be used to render the program non-free.
The precise terms and conditions for copying, distribution and
modification follow.
TERMS AND CONDITIONS
0. Definitions.
"This License" refers to version 3 of the GNU General Public License.
"Copyright" also means copyright-like laws that apply to other kinds of
works, such as semiconductor masks.
"The Program" refers to any copyrightable work licensed under this
License. Each licensee is addressed as "you". "Licensees" and
"recipients" may be individuals or organizations.
To "modify" a work means to copy from or adapt all or part of the work
in a fashion requiring copyright permission, other than the making of an
exact copy. The resulting work is called a "modified version" of the
earlier work or a work "based on" the earlier work.
A "covered work" means either the unmodified Program or a work based
on the Program.
To "propagate" a work means to do anything with it that, without
permission, would make you directly or secondarily liable for
infringement under applicable copyright law, except executing it on a
computer or modifying a private copy. Propagation includes copying,
distribution (with or without modification), making available to the
public, and in some countries other activities as well.
To "convey" a work means any kind of propagation that enables other
parties to make or receive copies. Mere interaction with a user through
a computer network, with no transfer of a copy, is not conveying.
An interactive user interface displays "Appropriate Legal Notices"
to the extent that it includes a convenient and prominently visible
feature that (1) displays an appropriate copyright notice, and (2)
tells the user that there is no warranty for the work (except to the
extent that warranties are provided), that licensees may convey the
work under this License, and how to view a copy of this License. If
the interface presents a list of user commands or options, such as a
menu, a prominent item in the list meets this criterion.
1. Source Code.
The "source code" for a work means the preferred form of the work
for making modifications to it. "Object code" means any non-source
form of a work.
A "Standard Interface" means an interface that either is an official
standard defined by a recognized standards body, or, in the case of
interfaces specified for a particular programming language, one that
is widely used among developers working in that language.
The "System Libraries" of an executable work include anything, other
than the work as a whole, that (a) is included in the normal form of
packaging a Major Component, but which is not part of that Major
Component, and (b) serves only to enable use of the work with that
Major Component, or to implement a Standard Interface for which an
implementation is available to the public in source code form. A
"Major Component", in this context, means a major essential component
(kernel, window system, and so on) of the specific operating system
(if any) on which the executable work runs, or a compiler used to
produce the work, or an object code interpreter used to run it.
The "Corresponding Source" for a work in object code form means all
the source code needed to generate, install, and (for an executable
work) run the object code and to modify the work, including scripts to
control those activities. However, it does not include the work's
System Libraries, or general-purpose tools or generally available free
programs which are used unmodified in performing those activities but
which are not part of the work. For example, Corresponding Source
includes interface definition files associated with source files for
the work, and the source code for shared libraries and dynamically
linked subprograms that the work is specifically designed to require,
such as by intimate data communication or control flow between those
subprograms and other parts of the work.
The Corresponding Source need not include anything that users
can regenerate automatically from other parts of the Corresponding
Source.
The Corresponding Source for a work in source code form is that
same work.
2. Basic Permissions.
All rights granted under this License are granted for the term of
copyright on the Program, and are irrevocable provided the stated
conditions are met. This License explicitly affirms your unlimited
permission to run the unmodified Program. The output from running a
covered work is covered by this License only if the output, given its
content, constitutes a covered work. This License acknowledges your
rights of fair use or other equivalent, as provided by copyright law.
You may make, run and propagate covered works that you do not
convey, without conditions so long as your license otherwise remains
in force. You may convey covered works to others for the sole purpose
of having them make modifications exclusively for you, or provide you
with facilities for running those works, provided that you comply with
the terms of this License in conveying all material for which you do
not control copyright. Those thus making or running the covered works
for you must do so exclusively on your behalf, under your direction
and control, on terms that prohibit them from making any copies of
your copyrighted material outside their relationship with you.
Conveying under any other circumstances is permitted solely under
the conditions stated below. Sublicensing is not allowed; section 10
makes it unnecessary.
3. Protecting Users' Legal Rights From Anti-Circumvention Law.
No covered work shall be deemed part of an effective technological
measure under any applicable law fulfilling obligations under article
11 of the WIPO copyright treaty adopted on 20 December 1996, or
similar laws prohibiting or restricting circumvention of such
measures.
When you convey a covered work, you waive any legal power to forbid
circumvention of technological measures to the extent such circumvention
is effected by exercising rights under this License with respect to
the covered work, and you disclaim any intention to limit operation or
modification of the work as a means of enforcing, against the work's
users, your or third parties' legal rights to forbid circumvention of
technological measures.
4. Conveying Verbatim Copies.
You may convey verbatim copies of the Program's source code as you
receive it, in any medium, provided that you conspicuously and
appropriately publish on each copy an appropriate copyright notice;
keep intact all notices stating that this License and any
non-permissive terms added in accord with section 7 apply to the code;
keep intact all notices of the absence of any warranty; and give all
recipients a copy of this License along with the Program.
You may charge any price or no price for each copy that you convey,
and you may offer support or warranty protection for a fee.
5. Conveying Modified Source Versions.
You may convey a work based on the Program, or the modifications to
produce it from the Program, in the form of source code under the
terms of section 4, provided that you also meet all of these conditions:
a) The work must carry prominent notices stating that you modified
it, and giving a relevant date.
b) The work must carry prominent notices stating that it is
released under this License and any conditions added under section
7. This requirement modifies the requirement in section 4 to
"keep intact all notices".
c) You must license the entire work, as a whole, under this
License to anyone who comes into possession of a copy. This
License will therefore apply, along with any applicable section 7
additional terms, to the whole of the work, and all its parts,
regardless of how they are packaged. This License gives no
permission to license the work in any other way, but it does not
invalidate such permission if you have separately received it.
d) If the work has interactive user interfaces, each must display
Appropriate Legal Notices; however, if the Program has interactive
interfaces that do not display Appropriate Legal Notices, your
work need not make them do so.
A compilation of a covered work with other separate and independent
works, which are not by their nature extensions of the covered work,
and which are not combined with it such as to form a larger program,
in or on a volume of a storage or distribution medium, is called an
"aggregate" if the compilation and its resulting copyright are not
used to limit the access or legal rights of the compilation's users
beyond what the individual works permit. Inclusion of a covered work
in an aggregate does not cause this License to apply to the other
parts of the aggregate.
6. Conveying Non-Source Forms.
You may convey a covered work in object code form under the terms
of sections 4 and 5, provided that you also convey the
machine-readable Corresponding Source under the terms of this License,
in one of these ways:
a) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by the
Corresponding Source fixed on a durable physical medium
customarily used for software interchange.
b) Convey the object code in, or embodied in, a physical product
(including a physical distribution medium), accompanied by a
written offer, valid for at least three years and valid for as
long as you offer spare parts or customer support for that product
model, to give anyone who possesses the object code either (1) a
copy of the Corresponding Source for all the software in the
product that is covered by this License, on a durable physical
medium customarily used for software interchange, for a price no
more than your reasonable cost of physically performing this
conveying of source, or (2) access to copy the
Corresponding Source from a network server at no charge.
c) Convey individual copies of the object code with a copy of the
written offer to provide the Corresponding Source. This
alternative is allowed only occasionally and noncommercially, and
only if you received the object code with such an offer, in accord
with subsection 6b.
d) Convey the object code by offering access from a designated
place (gratis or for a charge), and offer equivalent access to the
Corresponding Source in the same way through the same place at no
further charge. You need not require recipients to copy the
Corresponding Source along with the object code. If the place to
copy the object code is a network server, the Corresponding Source
may be on a different server (operated by you or a third party)
that supports equivalent copying facilities, provided you maintain
clear directions next to the object code saying where to find the
Corresponding Source. Regardless of what server hosts the
Corresponding Source, you remain obligated to ensure that it is
available for as long as needed to satisfy these requirements.
e) Convey the object code using peer-to-peer transmission, provided
you inform other peers where the object code and Corresponding
Source of the work are being offered to the general public at no
charge under subsection 6d.
A separable portion of the object code, whose source code is excluded
from the Corresponding Source as a System Library, need not be
included in conveying the object code work.
A "User Product" is either (1) a "consumer product", which means any
tangible personal property which is normally used for personal, family,
or household purposes, or (2) anything designed or sold for incorporation
into a dwelling. In determining whether a product is a consumer product,
doubtful cases shall be resolved in favor of coverage. For a particular
product received by a particular user, "normally used" refers to a
typical or common use of that class of product, regardless of the status
of the particular user or of the way in which the particular user
actually uses, or expects or is expected to use, the product. A product
is a consumer product regardless of whether the product has substantial
commercial, industrial or non-consumer uses, unless such uses represent
the only significant mode of use of the product.
"Installation Information" for a User Product means any methods,
procedures, authorization keys, or other information required to install
and execute modified versions of a covered work in that User Product from
a modified version of its Corresponding Source. The information must
suffice to ensure that the continued functioning of the modified object
code is in no case prevented or interfered with solely because
modification has been made.
If you convey an object code work under this section in, or with, or
specifically for use in, a User Product, and the conveying occurs as
part of a transaction in which the right of possession and use of the
User Product is transferred to the recipient in perpetuity or for a
fixed term (regardless of how the transaction is characterized), the
Corresponding Source conveyed under this section must be accompanied
by the Installation Information. But this requirement does not apply
if neither you nor any third party retains the ability to install
modified object code on the User Product (for example, the work has
been installed in ROM).
The requirement to provide Installation Information does not include a
requirement to continue to provide support service, warranty, or updates
for a work that has been modified or installed by the recipient, or for
the User Product in which it has been modified or installed. Access to a
network may be denied when the modification itself materially and
adversely affects the operation of the network or violates the rules and
protocols for communication across the network.
Corresponding Source conveyed, and Installation Information provided,
in accord with this section must be in a format that is publicly
documented (and with an implementation available to the public in
source code form), and must require no special password or key for
unpacking, reading or copying.
7. Additional Terms.
"Additional permissions" are terms that supplement the terms of this
License by making exceptions from one or more of its conditions.
Additional permissions that are applicable to the entire Program shall
be treated as though they were included in this License, to the extent
that they are valid under applicable law. If additional permissions
apply only to part of the Program, that part may be used separately
under those permissions, but the entire Program remains governed by
this License without regard to the additional permissions.
When you convey a copy of a covered work, you may at your option
remove any additional permissions from that copy, or from any part of
it. (Additional permissions may be written to require their own
removal in certain cases when you modify the work.) You may place
additional permissions on material, added by you to a covered work,
for which you have or can give appropriate copyright permission.
Notwithstanding any other provision of this License, for material you
add to a covered work, you may (if authorized by the copyright holders of
that material) supplement the terms of this License with terms:
a) Disclaiming warranty or limiting liability differently from the
terms of sections 15 and 16 of this License; or
b) Requiring preservation of specified reasonable legal notices or
author attributions in that material or in the Appropriate Legal
Notices displayed by works containing it; or
c) Prohibiting misrepresentation of the origin of that material, or
requiring that modified versions of such material be marked in
reasonable ways as different from the original version; or
d) Limiting the use for publicity purposes of names of licensors or
authors of the material; or
e) Declining to grant rights under trademark law for use of some
trade names, trademarks, or service marks; or
f) Requiring indemnification of licensors and authors of that
material by anyone who conveys the material (or modified versions of
it) with contractual assumptions of liability to the recipient, for
any liability that these contractual assumptions directly impose on
those licensors and authors.
All other non-permissive additional terms are considered "further
restrictions" within the meaning of section 10. If the Program as you
received it, or any part of it, contains a notice stating that it is
governed by this License along with a term that is a further
restriction, you may remove that term. If a license document contains
a further restriction but permits relicensing or conveying under this
License, you may add to a covered work material governed by the terms
of that license document, provided that the further restriction does
not survive such relicensing or conveying.
If you add terms to a covered work in accord with this section, you
must place, in the relevant source files, a statement of the
additional terms that apply to those files, or a notice indicating
where to find the applicable terms.
Additional terms, permissive or non-permissive, may be stated in the
form of a separately written license, or stated as exceptions;
the above requirements apply either way.
8. Termination.
You may not propagate or modify a covered work except as expressly
provided under this License. Any attempt otherwise to propagate or
modify it is void, and will automatically terminate your rights under
this License (including any patent licenses granted under the third
paragraph of section 11).
However, if you cease all violation of this License, then your
license from a particular copyright holder is reinstated (a)
provisionally, unless and until the copyright holder explicitly and
finally terminates your license, and (b) permanently, if the copyright
holder fails to notify you of the violation by some reasonable means
prior to 60 days after the cessation.
Moreover, your license from a particular copyright holder is
reinstated permanently if the copyright holder notifies you of the
violation by some reasonable means, this is the first time you have
received notice of violation of this License (for any work) from that
copyright holder, and you cure the violation prior to 30 days after
your receipt of the notice.
Termination of your rights under this section does not terminate the
licenses of parties who have received copies or rights from you under
this License. If your rights have been terminated and not permanently
reinstated, you do not qualify to receive new licenses for the same
material under section 10.
9. Acceptance Not Required for Having Copies.
You are not required to accept this License in order to receive or
run a copy of the Program. Ancillary propagation of a covered work
occurring solely as a consequence of using peer-to-peer transmission
to receive a copy likewise does not require acceptance. However,
nothing other than this License grants you permission to propagate or
modify any covered work. These actions infringe copyright if you do
not accept this License. Therefore, by modifying or propagating a
covered work, you indicate your acceptance of this License to do so.
10. Automatic Licensing of Downstream Recipients.
Each time you convey a covered work, the recipient automatically
receives a license from the original licensors, to run, modify and
propagate that work, subject to this License. You are not responsible
for enforcing compliance by third parties with this License.
An "entity transaction" is a transaction transferring control of an
organization, or substantially all assets of one, or subdividing an
organization, or merging organizations. If propagation of a covered
work results from an entity transaction, each party to that
transaction who receives a copy of the work also receives whatever
licenses to the work the party's predecessor in interest had or could
give under the previous paragraph, plus a right to possession of the
Corresponding Source of the work from the predecessor in interest, if
the predecessor has it or can get it with reasonable efforts.
You may not impose any further restrictions on the exercise of the
rights granted or affirmed under this License. For example, you may
not impose a license fee, royalty, or other charge for exercise of
rights granted under this License, and you may not initiate litigation
(including a cross-claim or counterclaim in a lawsuit) alleging that
any patent claim is infringed by making, using, selling, offering for
sale, or importing the Program or any portion of it.
11. Patents.
A "contributor" is a copyright holder who authorizes use under this
License of the Program or a work on which the Program is based. The
work thus licensed is called the contributor's "contributor version".
A contributor's "essential patent claims" are all patent claims
owned or controlled by the contributor, whether already acquired or
hereafter acquired, that would be infringed by some manner, permitted
by this License, of making, using, or selling its contributor version,
but do not include claims that would be infringed only as a
consequence of further modification of the contributor version. For
purposes of this definition, "control" includes the right to grant
patent sublicenses in a manner consistent with the requirements of
this License.
Each contributor grants you a non-exclusive, worldwide, royalty-free
patent license under the contributor's essential patent claims, to
make, use, sell, offer for sale, import and otherwise run, modify and
propagate the contents of its contributor version.
In the following three paragraphs, a "patent license" is any express
agreement or commitment, however denominated, not to enforce a patent
(such as an express permission to practice a patent or covenant not to
sue for patent infringement). To "grant" such a patent license to a
party means to make such an agreement or commitment not to enforce a
patent against the party.
If you convey a covered work, knowingly relying on a patent license,
and the Corresponding Source of the work is not available for anyone
to copy, free of charge and under the terms of this License, through a
publicly available network server or other readily accessible means,
then you must either (1) cause the Corresponding Source to be so
available, or (2) arrange to deprive yourself of the benefit of the
patent license for this particular work, or (3) arrange, in a manner
consistent with the requirements of this License, to extend the patent
license to downstream recipients. "Knowingly relying" means you have
actual knowledge that, but for the patent license, your conveying the
covered work in a country, or your recipient's use of the covered work
in a country, would infringe one or more identifiable patents in that
country that you have reason to believe are valid.
If, pursuant to or in connection with a single transaction or
arrangement, you convey, or propagate by procuring conveyance of, a
covered work, and grant a patent license to some of the parties
receiving the covered work authorizing them to use, propagate, modify
or convey a specific copy of the covered work, then the patent license
you grant is automatically extended to all recipients of the covered
work and works based on it.
A patent license is "discriminatory" if it does not include within
the scope of its coverage, prohibits the exercise of, or is
conditioned on the non-exercise of one or more of the rights that are
specifically granted under this License. You may not convey a covered
work if you are a party to an arrangement with a third party that is
in the business of distributing software, under which you make payment
to the third party based on the extent of your activity of conveying
the work, and under which the third party grants, to any of the
parties who would receive the covered work from you, a discriminatory
patent license (a) in connection with copies of the covered work
conveyed by you (or copies made from those copies), or (b) primarily
for and in connection with specific products or compilations that
contain the covered work, unless you entered into that arrangement,
or that patent license was granted, prior to 28 March 2007.
Nothing in this License shall be construed as excluding or limiting
any implied license or other defenses to infringement that may
otherwise be available to you under applicable patent law.
12. No Surrender of Others' Freedom.
If conditions are imposed on you (whether by court order, agreement or
otherwise) that contradict the conditions of this License, they do not
excuse you from the conditions of this License. If you cannot convey a
covered work so as to satisfy simultaneously your obligations under this
License and any other pertinent obligations, then as a consequence you may
not convey it at all. For example, if you agree to terms that obligate you
to collect a royalty for further conveying from those to whom you convey
the Program, the only way you could satisfy both those terms and this
License would be to refrain entirely from conveying the Program.
13. Use with the GNU Affero General Public License.
Notwithstanding any other provision of this License, you have
permission to link or combine any covered work with a work licensed
under version 3 of the GNU Affero General Public License into a single
combined work, and to convey the resulting work. The terms of this
License will continue to apply to the part which is the covered work,
but the special requirements of the GNU Affero General Public License,
section 13, concerning interaction through a network will apply to the
combination as such.
14. Revised Versions of this License.
The Free Software Foundation may publish revised and/or new versions of
the GNU General Public License from time to time. Such new versions will
be similar in spirit to the present version, but may differ in detail to
address new problems or concerns.
Each version is given a distinguishing version number. If the
Program specifies that a certain numbered version of the GNU General
Public License "or any later version" applies to it, you have the
option of following the terms and conditions either of that numbered
version or of any later version published by the Free Software
Foundation. If the Program does not specify a version number of the
GNU General Public License, you may choose any version ever published
by the Free Software Foundation.
If the Program specifies that a proxy can decide which future
versions of the GNU General Public License can be used, that proxy's
public statement of acceptance of a version permanently authorizes you
to choose that version for the Program.
Later license versions may give you additional or different
permissions. However, no additional obligations are imposed on any
author or copyright holder as a result of your choosing to follow a
later version.
15. Disclaimer of Warranty.
THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
16. Limitation of Liability.
IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
SUCH DAMAGES.
17. Interpretation of Sections 15 and 16.
If the disclaimer of warranty and limitation of liability provided
above cannot be given local legal effect according to their terms,
reviewing courts shall apply local law that most closely approximates
an absolute waiver of all civil liability in connection with the
Program, unless a warranty or assumption of liability accompanies a
copy of the Program in return for a fee.
END OF TERMS AND CONDITIONS
How to Apply These Terms to Your New Programs
If you develop a new program, and you want it to be of the greatest
possible use to the public, the best way to achieve this is to make it
free software which everyone can redistribute and change under these terms.
To do so, attach the following notices to the program. It is safest
to attach them to the start of each source file to most effectively
state the exclusion of warranty; and each file should have at least
the "copyright" line and a pointer to where the full notice is found.
Copyright (C)
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see .
Also add information on how to contact you by electronic and paper mail.
If the program does terminal interaction, make it output a short
notice like this when it starts in an interactive mode:
Copyright (C)
This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
This is free software, and you are welcome to redistribute it
under certain conditions; type `show c' for details.
The hypothetical commands `show w' and `show c' should show the appropriate
parts of the General Public License. Of course, your program's commands
might be different; for a GUI interface, you would use an "about box".
You should also get your employer (if you work as a programmer) or school,
if any, to sign a "copyright disclaimer" for the program, if necessary.
For more information on this, and how to apply and follow the GNU GPL, see
.
The GNU General Public License does not permit incorporating your program
into proprietary programs. If your program is a subroutine library, you
may consider it more useful to permit linking proprietary applications with
the library. If this is what you want to do, use the GNU Lesser General
Public License instead of this License. But first, please read
.
arp-scan-1.10.0/ChangeLog 0000664 0000000 0000000 00000133131 14345150431 0015051 0 ustar 00root root 0000000 0000000 2022-12-10 Roy Hills
* configure.ac: Set version to 1.10.0.
* Git: Tagged as 1.10.0
* ieee-oui.txt: Updated from IEEE website. Total of 47345 MAC/Vendor
mappings.
2022-12-01 Roy Hills
* arp-scan.h: Make cap_status enum values explicit.
* configure.ac: Set version to 1.10-rc1.
2022-11-25 Roy Hills
* Makefile.am: Add $(PACKAGE) to the PKGSYSCONFDIR macro definition
so arp-scan looks in the correct directory for the mac-vendor.txt
file. Thanks to Richard Hoyle for reporting this bug.
* error.c, format.c, link-bpf.c, link-dlpi.c, link-packet-socket.c,
wrappers.c, utils.c, arp-scan.c: Standardise code formatting.
2022-11-11 Roy Hills
* Makefile.am: Added install-exec-hook to set the CAP_NET_RAW
capability on the arp-scan executable if "setcap" exists and
works. Otherwise falls back to setting the SUID bit.
2022-11-09 Roy Hills
* check-error, check-options, Makefile.am: Added new tests to check
various options and error conditions.
* arp-scan.c, arp-scan.1.dist: Updated manpage and help text.
* pre-release-testing.txt: Removed unneeded and outdated file.
2022-11-07 Roy Hills
* arp-scan.c: Changed C99 "for (int i=0..." syntax to C89
"for (i=0..." format. This caused errors with old toolchain e.g.
autoconf 2.69/gcc 4.9.2 on Debian Jessie.
* check-run1: Moved error checks to check-error.
* check-error: New file to check error conditions.
* Makefile.am: Updated list of test scripts.
* check-decode: Check for any hostname, not just "localhost"
because not all distros use that name.
* arp-scan.c, arp-scan.1.dist: Correct the short option letter
for the --macfile option. It was incorectly shown as "O"
when it should be "m".
2022-11-06 Roy Hills
* Makefile.am: Install mac-vendor.txt to $(sysconfdir)/$(PACKAGE)
instead of $(pkgdatadir). With a default ./configure this will be
/usr/local/etc/arp-scan. For a binary package it will typically be
/etc/arp-scan. This change is because users may add local entries to
mac-vendor.txt that they want to preserve between package upgrades.
* arp-scan.c, arp-scan.1.dist: Update file paths for mac-vendor.txt.
* NEWS renamed to NEWS.md with NEWS symlink pointing to it.
* configure.ac, Makefile.am: use $(SED) variable, remove
AC_REVISION($Revision$) because git doesn't expand keywords.
Add AC_CONFIG_AUX_DIR([build-aux]) to declutter top level directory.
Changed AC_PREREQ() from 2.61 to 2.69.
2022-11-03 Roy Hills
* arp-scan.c, arp-scan.h: Don't display long usage message for
unrecognised options and other simple issues, but display brief
message and exit instead. A brief error message is clearer than
half a page of usage text.
* check-run1: Added tests for unrecognised option and no target hosts.
2022-11-02 Roy Hills
* arp-scan.c, arp-scan.1.dist: Change --format short option character
from -k to -F. The -F character became free when the --iabfile
option was removed, and is a more logical choice.
*** This means anyone who has been using the old -k short option ***
*** for --format will need to change to the new -F option. ***
* arp-scan.c, check-decode: Print warning message for unavailable
--format fields in addition to unknown fields. Updated test.
* arp-scan.c, check-decode: Only print vendor field if present for
the default output format. Previously it printed NULL if --quiet
was specified. Added test to check-decode to check --quiet output.
2022-11-01 Roy Hills
* arp-scan.h: Increase HASH_TABLE_SIZE from 50,000 to 70,000 due to
addition of IEEE MA-M and MA-S registries. ieee-oui.txt currently
contains 47028 entries of 70000 (67.2%).
* get-oui.1: renamed to get-oui.1.dist with PKGDATADIR substitution.
* check-ieee-reg: New file to test IEEE registry lookup.
* Makefile.am: Build man page "get-oui.1" from "get-oui.dist", added
check-ieee-reg test.
* get-oui: Changed IEEE URLs from http to https. This avoids an HTTP
redirect from the http to https site.
* ieee-oui.txt: Updated from IEEE website.
* strlcat.c: removed. arp-scan only uses strlcpy(), so we don't need
to ship replacement source code for strcat() as well.
* configure.ac, strlcpy.h: Removed references to strlcat.
2022-10-31 Roy Hills
* get-oui: Changed to fetch registry data from all four IEEE registries
(MA-L, MA-M, MA-S and IAB), format appropriately for arp-scan, and
concatenate into ieee-oui.
* get-iab: No longer needed. Replaced with stub script that calls die.
* Makefile.am, check-decode, check-host-list: Removed get-iab / iabfile
references.
* arp-scan.c, arp-scan.h: Removed --iabfile option.
* README.md, arp-scan.1.dist, get-oui.1, mac-vendor.5, mac-vendor.txt:
Update text to reflect changes.
* get-iab.1: Removed. No longer needed.
* ieee-iab.txt: Removed. No longer needed.
* ieee-oui.txt: Updated to new combined registry format.
2022-10-30 Roy Hills
* Makefile.am: Build man page "arp-scan.1" from "arp-scan.dist"
replacing all occurances of @pkgdatadir@ with the $pkgdatadir
variable that is set by configure. This ensures that the file
paths in the manpage arp-scan.1 reflect the paths on the system
where ./configure was run.
* arp-scan.1: renamed to arp-scan.1.dist with PKGDATADIR substitution.
2022-10-27 Roy Hills
* arp-fingerprint.1, arp-scan.1, get-iab.1, get-oui.1, mac-vendor.5:
Standardised man page fonts, corrected some inaccuracies and removed
author section.
* Updated ieee-oui.txt and ieee-iab.txt files.
2022-10-25 Roy Hills
* format.c: New file containing output format functions.
* Makefile.am: Added format.c source file to arp_scan_SOURCES
* utils.c: Added name_to_id() and str_ccmp() functions.
* arp-scan.c, arp-scan.h, arp-scan.1: Add --format option and output
fields processing code.
2022-10-24 Roy Hills
* Makefile.am, check-decode: Added checks to test output format with
--rtt, --resolve, different ARP/header address, and locally
administered MAC address.
* pkt-diff-frame-addr.pcap, pkt-local-admin.pcap: New files for
above tests.
2022-10-23 Roy Hills
* arp-scan.c, error.c arp-scan.c, error.c: Changed most fixed-length
strings to use dynamic length strings.
* utils.c: Changed make_message() to assume vsnprintf() behaves
according to POSIX. No need to accomodate bugs in ancient glibc
versions.
2022-10-09 Roy Hills
* arp-scan.c: Added POSIX.1e capabilities support.
* configure.ac, acinclude.m4: Add autoconf tests for Linux libcap
POSIX.1e capabilities support. Incremented version to 1.9.9 to
reflect addition of POSIX.1e capabilities support.
* utils.c, arp-scan.h: New functions limit_capabilities() to limit the
permitted capabilities, set_capability() to enable and disable
capabilities, and drop_capabilities() to permanently drop all
capabilities. These functions use libcap if POSIX.1e capabilities
are supported otherwise they fall back to setuid() and seteuid().
2022-10-08 Roy Hills
* Tagged as 1.9.8
* arp-scan.c: fix bug reported by mrquincle where ARP responses for
a host that had timed out was being incorrectly flagged as a
duplicate with the warning message "remove_host called on non-live
host: SHOULDN'T HAPPEN".
2022-10-07 Roy Hills
* arp-scan.c, arp.scan.h: New option --resolve (-d) to resolve IP
addresses to hostnames. When this option is specified, responding
hosts will be displayed as hostnames instead of IP addresses if they
can be resolved.
* my_getopt.c, my_getopt.h: New getopt implementation using bsittler's
version from http://xent.com/~bsittler/geocities/.
* configure.ac: Modified to use new getopt implementation.
2022-10-05 Roy Hills
* arp-scan.c, arp-scan.1: Documented the exit status when --limit
is specified and fewer than the specified number of hosts respond.
2022-10-02 Roy Hills
* acinclude.m4: fix typo in 'if test "X$CC" != "X"' checks.
2022-09-28 Roy Hills
* arp-scan.c: Added --limit (-M) option. When this option is
given, arp-scan will exit after the specified number of target
hosts have responded. Thanks to mirfatif for suggesting this
enhancement.
* arp-scan.c: Don't increment number of responders for duplicate
response packets. The number of responders now represents the
number of responding hosts rather than the number of response
packets.
* pkt-dup-response.pcap: new file
* check-decode: Added duplicate response packet checks
* arp-scan.1: Updated manpage to reflect new --limit option.
2022-09-18 Roy Hills
* check-decode, check-host-list, check-packet, check-run1: Changed
"$srcdir/arp-scan" to "./arp-scan" in test scripts so
"make distcheck" succeeds.
* .github/workflows/c-cpp.yml: Enable "make distcheck" step.
2022-09-14 Roy Hills
* README.md, .github/workflows/*: Migrated from travis-ci to github
actions for CI/CD build check and code coverage report.
* .travis.yml: removed as no longer needed.
2022-09-11 Roy Hills
* arp-scan.h, configure.ac, getopt.c, getopt1.c: only include
the local replacement getopt header file if the system doesn't
support getopt_long_only. Previously it was being included even
if it wasn't required.
* getopt.h: rename to my_getopt.h.
2022-09-10 Roy Hills
* acinclude.m4: Replaced obsolete autoconf macros AC_TRY_COMPILE with
AC_COMPILE_IFELSE and AC_TRY_LINK with AC_LINK_IFELSE. These macros
were obsoleted in autoconf 2.70.
* strlcat.h: included this new file that was missed out of the previous
commit.
2022-09-09 Roy Hills
* arp-scan.c: Die with error message if hsearch() fails when adding a
new entry to the hash table. Previous behaviour was to issue a
warning and continue.
* mt19937ar.c, mt19937ar.h, Makefile.am, arp-scan.h: Update Mersenne Twister
random number generator source code to latest version from
https://github.com/clibs/mt19937ar
* strlcat.c, strlcpy.c: Updated from latest OpenBSD source.
* strlcat.h: New file containing function prototypes for strlcat() and strlcpy().
2022-09-03 Roy Hills
* arp-scan.c: Allow MAC addresses in mac-vendor.txt to use either lower
or uppercase hex digits and ignore any seperator characters e.g. ":"
or "-". This allows normal format MAC addresses such as those output
by arp-scan to be used directly in the mac-vendor.txt file.
* mac-vendor.txt: Update comments to reflect code changes.
2022-06-16 Roy Hills
* get-iab: change IEEE IAB URL to
http://standards-oui.ieee.org/iab/iab.txt. Thanks to silex for the
pull request.
* Updated ieee-oui.txt and ieee-iab.txt files.
2021-12-12 Roy Hills
* arp-scan.c: Limit packet length in callback() to prevent potential
buffer overrun in unmarshal_arp_pkt() if network frames larger
than expected are received by libpcap. Thanks to @mrquincle for
reporting this issue.
2021-11-17 Roy Hills
* Use getifaddrs() to obtain the interface IP address if it is available
and pcap_findalldevs() fails to find the address.
This is typically needed for device aliases such as "eth0:0" on Linux
which are not supported by pcap_findalldevs() and would previously
cause an error.
* Increment version number to 1.9.8 to reflect code and autoconf
changes.
2021-09-09 Roy Hills
* Retry sending an ARP packet if the packet send function fails with
EAGAIN instead of aborting with an error message. High packet send
rates can cause sendto() to fail occasionally with EAGAIN due to
temporary resource starvation. Thanks to gessel for reporting this
problem.
--retry-send (default 3) specifies the number of retries.
--retry-send-interval (default 10ms) sets the delay between retries.
* Minor code cleanup to fix spelling, remove trailing whitespace,
fix shellcode warnings and update license file. Thanks to a1346054
for the pull request.
* Updated ieee-oui.txt and ieee-iab.txt files.
2020-07-05 Roy Hills
* README.md, arp-fingerprint.1, arp-scan.1, get-iab.1, get-oui.1,
mac-vendor.5, mac-vendor.txt: Update wiki references to use
new URL http://www.royhills.co.uk/wiki/
2019-10-24 Roy Hills
* configure.ac: Increment version number to 1.9.7 in preparation for
new release.
* configure.ac, acinclude.m4: Tidy up: remove obsolescent and unused
autoconf macros.
* Modified copyright statement in files to include up to 2019.
2019-10-20 Roy Hills
* arp-scan.c: Call the pcap functions before get_hardware_address() to
ensure lack of permissions is reported by pcap_activate() rather
than by the link specific get_hardware_address(). This will give
consistent error messages across different platforms.
Improve diagnostic message for pcap_activate() errors and warnings.
* arp-scan.h: Changed pcap_set_timeout() value from 0 to 1000ms.
Removed ARRAY_SIZE macro which is no longer used.
* .gitignore: Added config.h.in~ to .gitignore.
2019-10-13 Roy Hills
* arp-scan.c: Call pcap_set_immediate_mode() on the pcap handle so
captured packets are processed immediately. This pcap function was
added in libpcap 1.5.0, so this and future versions of arp-scan
require libpcap 1.5.0 or later. Thanks for @cleoo for reporting the
bug in arp-scan 1.9.5 on Arch Linux 2019.10.01 x64, and to
@guyharris for providing the solution.
* arp-scan.c: Remove ioctl workarounds for BSD with BPF and Solaris
with DLPI that were used to ensure immediate packet delivery. These
workarounds are superseded by pcap_set_immediate_mode().
* wrappers.c: New function my_lookupdev() to replace pcap_lookupdev()
which is depreciated in libpcap 1.9.0 and later.
* configure.ac: Remove ARP_PCAP_BPF and ARP_PCAP_DLPI defines, as these
are no longer used after the removal of the ioctl workarounds.
* configure.ac: Change pcap compatibility test to check for
pcap_set_immediate_mode instead of pcap_create to test for libpcap
1.5.0 or later.
* configure.ac: Increment version number to 1.9.6 to reflect the
libpcap API change.
* Updated ieee-oui.txt and ieee-iab.txt files.
2019-08-29 Roy Hills
* arp-scan.c: include the interface MAC address in the interface
summary output. E.g.
Interface: ens33, datalink type: EN10MB (Ethernet), MAC Addr: 00:0c:29:01:0d:21
* Updated ieee-oui.txt and ieee-iab.txt files.
2019-03-16 Roy Hills
* acinclude.m4: Use AC_TRY_LINK instead of AC_TRY_COMPILE when
determining if tack protector support is supported, as some
operating system may lack the libssp library. Thanks to
ffontaine for this pull request.
* Updated ieee-oui.txt and ieee-iab.txt files.
2017-07-19 Roy Hills
* Print "locally administered" for qualifing OUIs. Thanks to sanderjo
for this pull request.
2017-05-29 Roy Hills
* Updated ieee-oui.txt and ieee-iab.txt files.
2016-09-03 Roy Hills
* arp-scan.c: Use the new libpcap 1.0 API functions pcap_create(),
pcap_set_XXX(), pcap_activate() instead of the old pcap_open_live().
This requires libpcap 1.0 or later, so this and future versions of
arp-scan will not work with libpcap 0.9 or earlier.
* configure.ac: Change pcap compatibility test to check for pcap_create
instead of pcap_sendpacket to test for libpcap 1.0 or later.
* configure.ac: Increment version number to 1.9.5 to reflect the
libpcap API change.
* Modified copyright statement in files to include up to 2016.
2016-08-31 Roy Hills
* arp-scan.c, arp-scan.h: Merge changes by tissieres to use
source_mac rather than interface_mac in the pcap filter. This
requires us to enable promiscuous mode to ensure that the
ARP replies are received.
* configure.ac: Increment version number to 1.9.4 to reflect the
changes made since 2016-08-13.
2016-08-30 Roy Hills
* arp-fingerprint: Merge changes by Rhig to add "-l" option.
* arp-fingerprint: Added patterns for FreeBSD 10.3, DragonflyBSD 4.6,
Windows10, Linux 4.0, Linux 4.6, OpenBSD 5.9, NetBSD 7.0.
2016-08-22 Roy Hills
* configure.ac: Remove function replacement for inet_aton, as all
systems I'm aware of have this function now. This replacement
was needed for Solaris 8, but Solaris 10 does not need it and I
doubt that anyone is still using versions of Solaris prior to 10.
* inet_aton.c: Removed.
2016-08-20 Roy Hills
* arp-scan.c, arp-scan.h: Use posix hash table functions hcreate(),
hsearch() and hdestroy() instead of the gas hash table code.
* hash.c, hash.h, obstack.c, obstack.h: Removed.
2016-08-13 Roy Hills
* get-oui, get-oui.1, arp-scan.1: Update IEEE OUI download location.
* ieee-oui.txt: Updated from IEEE website using modified script.
* check-decode: Updated manufacturer names to match updated OUI file.
* configure.ac: Increased version number from 1.9.2 to 1.9.3 to
reflect the various changes made on github between Aug 2013 and
Aug 2016.
* acinclude.m4: Assume long long int format is %lld if cross compiling.
* arp-scan.c: Correct warning message for invalid IP addresses to avoid
segmentation violation.
2015-11-13 Roy Hills
* get-iab: Read the OUI from the data in the file instead of using
the constant 24-bit number 0050C2. This is required because the
0050C2 IEEE OUI has been fully used, and allocations have started
from the 40D855 IEEE OUI.
* *.c: Removed unneeded trailing whitespace in source code. Thanks
to "jubalh" for this pull request.
* arp-scan.c, check-run1: Change --help and --version options to output
to stdout (fd 0) instead of stderr (fd 1) in accordance with GNU
Coding Standards section 4.7, "Standards for Command Line Interfaces".
Thanks to "srdja" for this pull request.
* get-oui, get-iab: omit trailing whitespace from ieee-oui.txt and
ieee-iab.txt files.
* ieee-oui.txt, ieee-iab.txt: Updated from IEEE website using modified
scripts.
2013-12-02 Roy Hills
* link-packet-socket.c: Die with an error if we can't open a raw
packet socket to obtain the interface MAC address. This avoids
a segmentation violation on Linux if we try to run arp-scan against
a specific interface without the required privileges.
2013-12-02 Roy Hills
* arp-scan.c, arp-scan.h arp-scan.1: Added new --randomseed option,
which allows the random numer generator to be seeded with a specific
value.
* arp-scan.c, arp-scan.h, utils.c: Removed --debug (-d) option. This
has not been used for years, and the associated debug code was
causing more clutter than it was worth.
* check-host-list: Added test to check generation of random host list.
2013-12-01 Roy Hills
* configure.ac, .gitignore: Added configure option --enable-gcov to
enable gcov code coverage.
2013-11-12 Roy Hills
* arp-fingerprint: Added fingerprint for Cisco IOS 15.0.
2013-11-02 Roy Hills
* arp-scan.c, arp-scan.1: Added new --plain (-x) option to supress
printing of header and footer text, and only display one output
line for each responding host. Idea from Stefan Tomanek's arp-scan
fork on github at https://github.com/wertarbyte/arp-scan.
2013-09-21 Roy Hills
* get-oui, get-iab: Use LWP::UserAgent instead of LWP::Simple to enable
us to obtain the raw content rather than the decoded content. This
avoids Unicode/UTF-8 issues caused by a change in behaviour between
LWP 5.813 on Debian Lenny and 5.836 on Debian Squeeze.
* ieee-oui.txt, ieee-iab.txt: Updated from IEEE website using modified
scripts.
2013-09-05 Roy Hills
* arp-fingerprint: Added fingerprint for WIZnet W5100 on Arduino
Ethernet shield.
2013-09-05 Roy Hills
* configure.ac: Change the bug-report string in AC_INIT from the
arp-scan email address to the github URL.
* Added references to the github repository in various files in
place of the arp-scan email address.
* Updated ieee-oui.txt and ieee-iab.txt files.
2013-08-15 Roy Hills
* Removed $Id$ keywords from all files, and associated rcsid variables
from C source. These are not really needed and they don't work with
git.
* check-run1: Added GPL licence text, which had been accidentally
ommitted when the script was written.
* configure.ac: Incremented version to 1.9.2 to distinguish new
version under git revision control.
* .gitignore: new file containing file patterns that should not be
committed to the repository.
2013-08-15 Roy Hills
* ChangeLog: Removed pointless id keywords.
* Final SVN revision before migration to git.
2013-07-25 Roy Hills
* Released arp-scan version 1.9.
tarball arp-scan-1.9.tar.gz, size 488442 bytes
md5sum 38584d6c1edfa9f6b41d496e4a5539f1
* configure.ac: Incremented version to 1.9.1.
2013-07-24 Roy Hills
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
* configure.ac: Incremented version number to 1.9.
* NEWS: Updated with latest changes.
2013-05-09 Roy Hills
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
* Built with autoconf 2.69 and automake 1.11 from Debian Wheezy to
add support for ARM 64 bit CPU architecture and remove configure
warnings about conftest.dSYM on MacOS X.
2013-05-03 Roy Hills
* arp-fingerprint: Added FreeBSD 8.2, FreeBSD 9.1, DragonflyBSD 3.0,
DragonflyBSD 3.2, Linux 3.2, Linux 3.8, NetBSD 5.1, NetBSD 6.0,
OpenBSD 4.8, OpenBSD 5.1 and RiscOS 5.19.
* NEWS: Updated with changes since last release.
* configure.ac: Incremented version number to 1.8.4.
2013-04-25 Roy Hills
* arp-scan.c, arp-scan.h: Changed arp-scan to use the libpcap
function pcap_sendpacket() instead of our own link-layer specific
link_send() functions. This means that we now require libpcap
version 0.9.3 or later.
* link-bpf.c, link-dlpi.c, link-packet-socket.c: Removed unneeded
link-layer specific link_send() functions. Changed link_open()
and link_close() functions to static, and modified
get_hardware_address() and get_source_ip() functions to call
link_open/link_close directly. Included link_t typedef in
link_handle struct declaration.
* configure.ac: Change the libpcap function check from
pcap_lib_version() to pcap_sendpacket(), to ensure that we have
a recent enough version of libpcap.
* arp-scan.c: New function get_source_ip() to get the interface IP
address using platform-independent code.
* link-bpf.c, link-dlpi.c, link-packet-socket.c: Removed unneeded
link-layer specific get_source_ip() functions.
2013-04-15 Roy Hills
* Modified copyright statement in files to include up to 2013.
* get-oui, get-iab: Modified regex to allow optional whitespace at
the beginning of line.
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
* check-decode: Updated for new IEEE OUI vendors.
* configure.ac: Incremented version number to 1.8.3.
* arp-scan.c: Removed unneeded errlen declaration to avoid "set but
not used" warning with GCC 4.6 and later.
2013-01-01 Roy Hills
* arp-fingerprint: Added Windows 8
2012-08-08 Roy Hills
* configure.ac: Added OS pattern for Dragonfly BSD.
2012-06-06 Roy Hills
* arp-fingerprint: Added fingerprint for BeOS.
2012-05-29 Roy Hills
* arp-scan.c: Copy the pcap_header->ts structure to a temporary
struct timeval before passing to timeval_diff during rtt calculation.
We can't pass a pointer to pcap_header->ts directly to timeval_diff
because it's not guaranteed to have the same size as a struct
timeval. E.g. OpenBSD 5.1 on amd64. Thanks to Stuart Henderson at
OpenBSD for spotting this bug.
2012-05-20 Roy Hills
* get-oui, get-iab: Applied patch from Stuart Henderson at OpenBSD.
This allows the -u (alternative URL) option to be correctly handled,
and changes the default URLs to the new locations on the IEEE
website (the old locations still work, but with a redirect).
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
2011-12-30 Roy Hills
* arp-scan.c, arp-scan.h, arp-scan.1: If the location of the various
MAC/Vendor mapping files (IEEE OUI, IEEE IAB or custom) are not
specified on the command line with the appropriate option, then
look for them in the current directory before looking in the system
wide location.
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
* check-decode: Updated patterns to reflect vendor name changes in
latest IEEE OUI file.
2011-12-18 Roy Hills
* configure.ac: Incremented version to 1.8.2
2011-09-27 Roy Hills
* arp-scan.h, arp-scan.c, arp-scan.1: Added new option --rtt (-D) to
calculate and display the packet round-trip time.
2011-08-18 Roy Hills
* arp-scan.h, arp-scan.1: Raised default timeout from 100ms to 500ms.
It is suspected that the default timeout is too short in some
situations, and this may be one of the causes of duplicate responses.
* arp-scan.h, link-bpf.c: Include before arp-scan.h in
link-bpf.c, and remove conditional inclusion of in
arp-scan.h. This causes to be included before
on all systems that use BPF, e.g. BSD and MacOS. This should prevent
the problems that occur on some of these systems, and remove the need
for conditional inclusion to prevent them.
* arp-fingerprint: Added additional fingerprint for Linux 2.6 on
Amazon Kindle.
2011-07-31 Roy Hills
* arp-fingerprint: Added fingerprint for GNU/Hurd
2011-07-04 Roy Hills
* Makefile.am: Added pkt-custom-request-vlan-llc.dat to EXTRA_DIST.
2011-03-07 Roy Hills
* configure.ac: Incremented version to 1.8.1.
2011-03-01 Roy Hills
* Released arp-scan version 1.8.
tarball arp-scan-1.8.tar.gz, size 430221 bytes
md5sum be8826574ec566217eb7ca040fe472f9
* configure.ac: Remove version number from AM_INIT_AUTOMAKE macro,
as this usage is obsolete now. Incremented version to 1.8.
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
2011-02-26 Roy Hills
* pkt-custom-request-vlan-llc.dat: New data file for check-packet
script containing custom ARP request with 802.1Q VLAN tag and
LLC/SNAP framing.
* check-packet: Added check for custom ARP request with 802.1Q VLAN
tag and LLC/SNAP framing.
2011-02-25 Roy Hills
* pkt-vlan-llc-response.pcap: New file containing an example of
an ARP reply with 802.1Q tag and LLC/SNAP framing. From a Cisco
2621 router.
* pkt-trailer-response.pcap: Renamed from pkt-trailer-reply.pcap.
* check-decode: New checks for trailer response and 802.1Q/LLC
responses.
* arp-scan.c: Modified pcap filter string to capture ARP responses
with both 802.1Q tag and LLC/SNAP framing.
* Makefile.am: Include pkt-trailer-response.pcap and
pkt-vlan-llc-response.pcap.
2011-02-21 Roy Hills
* arp-scan.c: Modified usage() so that it can output either brief or
detailed help output depending on a new "detailed" argument. Now,
detailed output, including information on the available options, is
only displayed when arp-scan is run with the --help option. For
error conditions such as incorrect options, it only produces brief
output.
* arp-scan.c: Modify display_packet() to report responses where the
ARP protocol type (ar$pro) is not IP (0x0800). This allows trailer
negotiation responses to be distinguished from regular ARP replies.
* pkt-trailer-reply.pcap: New file containing an example of a trailer
negotiation ARP response from a Quasijarus 4.3BSD system on SIMH VAX.
* arp-fingerprint: Added fingerprint for Blackberry OS.
2011-02-19 Roy Hills
* arp-scan.h: On Apple Mac OS X systems with Xcode 2.5 and later,
include before .
* configure.ac: Increment version number to 1.7.6.
2011-02-06 Roy Hills
* acinclude.m4: Changed GCC_FORTIFY_SOURCE macro so the test program
doesn't include , because that header file is not
present on all the operating systems that we support, e.g. OpenBSD.
2011-02-04 Roy Hills
* arp-scan.c: Use pcap_get_selectable_fd() rather than pcap_fileno()
to get the pcap file descriptor.
* check-host-list: Added new test to check the creation of the host
list.
2011-02-03 Roy Hills
* arp-scan.c: When using --writepkttofile we no longer open a link
layer socket or a pcap handle, so we don't need root privileges.
* check-packet: Remove check for root privileges as this is no longer
needed.
* check-decode: Added two new tests to improve code coverage.
* arp-scan.c, arp-scan.h: Modify add_host_pattern() and add_host() so
we always use the more efficient inet_pton() rather than
get_host_address() for IPnet/bits, IPnet:mask and IPstart-IPend
patterns.
2011-02-02 Roy Hills
* arp-scan.c: Change operation of --readpktfromfile so it reads from
a pcap savefile rather than from a raw file.
* pkt-simple-response.pcap, pkt-padding-response.pcap,
pkt-vlan-response.pcap, pkt-llc-response.pcap: New pcap format
files for check-decode.
* check-decode: Modified to use new pcap format savefiles, and remove
check for root privileges as this is no longer needed.
2011-01-31 Roy Hills
* link-dlpi.c: Fix "comparison between signed and unsigned" warning in
function dlpi_msg.
* arp-fingerprint: Added fingerprint for Windows 7.
* arp-scan.c: Changed what gets displayed for the different verbose
levels, and updated the --help output to reflect the new behaviour.
2011-01-30 Roy Hills
* check-packet, check-decode: New checks to check packet creation and
packet decoding.
* pkt-custom-request.dat, pkt-custom-request-llc.dat,
pkt-custom-request-padding.dat, pkt-custom-request-vlan.dat,
pkt-padding-response.dat, pkt-simple-request.dat,
pkt-simple-response.dat: Data files for check-packet and check-decode
scripts.
* Makefile.am: Add new check scripts and data files.
* arp-scan.c, arp-scan.h: Added undocumented options --writepkttofile
and --readpktfromfile to allow data to be written to or read from a
file instead of the network for testing.
* arp-scan.c: Use "stdin" instead of fdopen(0,"r") when using
--filename=-, fixing a bug which was causing fd 0 to be closed.
Set the frame type correctly for LLC/SNAP format frames: before
it was always set to 0x0806.
* configure.ac: Add headers required for --writepkttofile and
--readpktfromfile. Increment version number to 1.7.5.
2011-01-09 Roy Hills
* COPYING: Changed license from GPLv2 to GPLv3.
* Modified licence statement in source files to specify GPLv3
* Modified copyright statement in files to include up to 2011.
2010-12-22 Roy Hills
* arp-scan.c: Change req_interval back from unsigned to int. This
addresses a bug in the timing code that was introduced in svn
r18043, which caused the packet rate to be very high irrespective
of the specified interval.
* configure.ac: Enable -Wextra warnings for gcc. Increment version
number to 1.7.4.
2010-12-22 Roy Hills
* hash.c, hash.h, obstack.c, obstack.h: Updated version of GAS hash
table code to the latest version from GNU binutils 2.21. This new
version addresses the shadowed variable warnings that the old version
used to produce when compiled with -Wshadow.
* configure.ac: define ATTRIBUTE_UNUSED macro to enable portable use
of attribute unused to mark possibly unused function arguments.
* arp-scan.c: Minor changes to remove a couple of shadowed variable
warnings.
2010-12-07 Roy Hills
* acinclude.m4: Added GCC_WEXTRA macro to determine if the C compiler
supports the -Wextra switch to enable extra warnings.
* arp-scan.c, arp-scan.h, utils.c: Remove unused function parameters
and address signed/unsigned comparisons highlighted by -Wextra.
2010-12-03 Roy Hills
* arp-scan.1: Added warning about setting ar$spa to the destination
IP address. Suggested by Ed Schaller.
2010-04-25 Roy Hills
* arp-fingerprint: Added 2.11BSD
2009-08-15 Roy Hills
* arp-scan.c, utils.c: Improve handling of --bandwidth and
--interval options: Allow either upper or lowercase
multiplier letters and give an error if an unknown multiplier
character is used. Previously an unknown multiplier character
or one with the wrong case was silently ignored and treated as
no multiplier at all.
* wrappers.c: Change Strtoul and Strtol so they give an error
if the underlying function finishes at an unconvertible
character other than NULL or whitespace.
* configure.ac: Added extra warning "-Wwrite-strings" for gcc.
2009-08-14 Roy Hills
* arp-scan.c, arp-scan.h, configure.ac, error.c: Removed syslog
functionality as this is not used and has been #ifdef'ed out
for some time.
2009-05-06 Roy Hills
* autoconf.ac: Updated to autoconf 2.61
2009-03-06 Roy Hills
* acinclude.m4: Added macros to detect compiler support for
-fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security.
* configure.ac: Conditionally enable compiler flags for
-fstack-protect, -D_FORTIFY_SOURCE and -Wformat-security using
the new acinclude.m4 autoconf macros.
* configure.ac: Incremented version to 1.7.2.
2008-08-01 Roy Hills
* arp-fingerprint get-iab get-oui: Replaced "#!/usr/bin/perl" shebang
with "#!/usr/bin/env perl" to increase portability. This allows
these perl scripts to work on systems where perl is not installed in
/usr/bin, such as NetBSD.
2008-07-26 Roy Hills
* configure.ac: Incremented version to 1.7.1.
* arp-fingerprint: Added NetBSD 4.0, FreeBSD 7.0 and Vista SP1
2008-07-25 Roy Hills
* Released arp-scan version 1.7.
tarball arp-scan-1.7.tar.gz, size 344,771 bytes
md5sum a9927dba2b1dbdfd1c3b3bb09615fc14
2008-07-24 Roy Hills
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
* configure.ac: Incremented version to 1.7.
2008-07-11 Roy Hills
* arp-scan.a: Removed reference to RMIF environment variable.
arp-scan now uses the value specified with --interface, or
if that is not specified, picks an interface with
pcap_lookupdev().
* configure.ac: Incremented version to 1.6.4 for pre-release
testing.
* *.c, *.h: Modified copyright statements to read 2005-2008.
2008-05-03 Roy Hills
* arp-scan.c: Added --pcapsavefile (-W) option to allow received
ARP responses to be saved in the specified pcap savefile for
later analysis.
* TODO: Removed plan to support libpcap 0.7 as just about every
system has at least libpcap 0.8, and most have 0.9.
* arp-scan.c: changed display_packet() so it displays the source
address from the frame header in parens if it is different from the
ar$sha address. E.g.
192.168.1.255 ff:ff:ff:ff:ff:ff (00:03:a0:88:eb:a8) Broadcast
2007-12-10 Roy Hills
* arp-scan.c: Change most calls to strtol() to use the new
wrapper function Strtol() instead, because this checks for
errors. Previously, a non-numeric value would be converted to
zero without any error, meaning something like "--snap=xxx"
would be silently accepted. Now such invalid inputs results in
an error.
* arp-scan.c: Added new --vlan (-Q) option to support sending
ARP packets with an 802.1Q VLAN tag. Response packets with
an 802.1Q tag are decoded and displayed irrespective of this
option.
2007-04-17 Roy Hills
* arp-scan.h: Reduced MAX_FRAME from 65536 to 2048 bytes.
* arp-scan.c: Add the optional padding in marshal_arp_pkt(), and
avoid potential buffer overflow if padding is longer than the
remaining buffer size.
* arp-scan.c: Changed display_packet() to take ARP structure, extra
data and framing type as parameters passed from callback() to avoid
having to call unmarshal_arp_pkt() twice. This also means that
we don't need to pass the raw frame to display_packet() now as it
has the data in individual variables.
* arp-scan.c: Move padding addition to marshal_arp_pkt().
2007-04-14 Roy Hills
* arp-scan.h, arp-scan.c: Changed MAXIP to MAX_FRAME and changed value
to 65536 bytes. This is the maximum allowable frame size, which is
used to size read/write buffers. This is much larger than any
layer-2 frame.
* arp-scan.h: Changed PACKET_OVERHEAD to 18 (6+6+2 ... +4) and
MINIMUM_FRAME_SIZE to 46.
* arp-scan.h: undefine SYSLOG, as we don't use this any more, and I
doubt that anyone else needs it. The syslog functionality may be
removed in a future release.
2007-04-13 Roy Hills
* arp-scan.c: Added support for RFC 1042 LLC/SNAP framing with the
new --llc (-L) option.
2007-04-12 Roy Hills
* Released arp-scan version 1.6.
tarball arp-scan-1.6.tar.gz, size 319,566 bytes
md5sum eb24303c6eb4d77c3abf23511efce642
2007-04-10 Roy Hills
* mt19937ar.c: New file - Mersenne Twister random number generator.
* arp-scan.c: Changed random number implementation to use the mersenne
twister functions from mt19937ar.c rather than random() from the C
library. This improves portability, as random() is not part of
standard C.
* Updated ieee-oui.txt and ieee-iab.txt from the IEEE website
using get-oui and get-iab Perl scripts.
2007-04-08 Roy Hills
* utils.c: Removed ununsed function printable().
* arp-scan.c: Added /* NOTREACHED */ comments in appropriate places.
Removed unneeded max_iter global variable.
Added call to pcap_lib_version() in arp_scan_version().
* configure.ac: Changed check for pcap_datalink_val_to_name() to
check for pcap_lib_version() instead.
2007-04-06 Roy Hills
* configure.ac: Added checks for strlcat and strlcpy, with
replacement functions using the OpenBSD implementations if they are
not present.
* strlcat.c, strlcpy.c: New source files from the OpenBSD source at
http://www.openbsd.org/cgi-bin/cvsweb/src/lib/libc/string
* *.c: replaced most calls to strcat and strncat with strlcat, and
calls to strcpy and strncpy with strlcpy. Two calls to strncpy
remain because the source strings are not null terminated.
2007-04-05 Roy Hills
* arp-scan.c: Check the return status of pcap_dispatch() against -1
rather than < 0 to check for error because the use of pcap_breakloop
results in a return status of -2, and this is not an error. Even
though we don't use pcap_breakloop, we should still behave correctly
if it used in the future.
* arp-scan.c: Check return status of inet_pton() separately against
< 0, which indicates and error, and against == 0, which indicates
that the string is not a valid address. Previously we handled these
together with the comparison <= 0. Also return from add_host()
immediately if the host lookup fails.
2007-04-04 Roy Hills
* arp-fingerprint: Check that the target host specification is not
an IP network or range, and terminate with an error message if it
is. Some users have mistakenly tried to use arp-fingerprint against
a network, and I want to give a better error message in these cases.
* arp-fingerprint: Remove the default "-N" from the arp-scan command
line as it is valid to use a hostname. Modified the associated
manpage so it agrees with this change.
2007-04-03 Roy Hills
* arp-scan.c: Add ioctl to reduce the bufmod timeout to zero for
Solaris (DLPI). This prevents buffering, and ensures that packets
are available immediately. This allows arp-scan to work on
Solaris (tested on Solaris/SPARC 2.9 with Libpcap 0.9.5).
2007-03-29 Roy Hills
* arp-scan.c: Change help output, so we display the default value for
the --bandwidth option, and don't display it for the --interval
option (as the latter will always be zero because we use bandwidth
by default). Updated arp-scan.1 manpage with the new output.
2007-02-15 Roy Hills
* link-dlpi.c: Wrote link-level functions for DLPI. Compiles on
Solaris 9, but not fully tested.
2007-01-26 Roy Hills
* Updated ieee-oui.txt and ieee-iab.txt from the IEEE website
using get-oui and get-iab Perl scripts.
2006-07-26 Roy Hills
* Released version 1.5.
Tarball details:
-rw-rw-r-- 1 rsh nta 298917 2006-07-26 13:50 arp-scan-1.5.tar.gz
85b0e04323ce3a423f60ab905a589856 arp-scan-1.5.tar.gz
* configure.ac: Incremented version number to 1.5.1 in preparation
for post-1.5 changes.
2006-07-24 Roy Hills
* ieee-oui.txt, ieee-iab.txt: Updated IEEE OUI and IAB listings from
IEEE website using get-oui and get-iab Perl scripts.
2006-07-22 Roy Hills
* configure.ac: Increased version number to 1.4.5.
* README: Added installation instructions.
2006-07-21 Roy Hills
* link-bpf.c: New file containing link-level sending functions
for BPF as used by BSD OSes.
* link-packet-socket.c: Changed socket protocol from SOCK_DGRAM to
SOCK_RAW, so the entire Ethernet frame including the header can
be controlled.
* arp-scan.c: Changed to build entire outgoing frame, rather than
just the ARP payload.
* arp-scan.c: Modifications to support BPF link-layer. This has been
tested on FreeBSD 6.1, OpenBSD 3.9, NetBSD 3.0.1 and
Darwin 7.9.0 (MacOS 10.3.9).
* arp-scan.c: Changed operation of the --srcaddr option. Now it
sets the hardware address in the frame header of outgoing packets
without altering the address of the outgoing interface.
* link-packet-socket.c, link-bpf.c: Removed set_hardware_address()
function, as this is no longer needed with the new operation of
the --srcaddr option.
2006-07-11 Roy Hills
* arp-scan.c: Removed unneeded gettimeofday() call in add_host().
This increases the host addition rate considerably, so adding
a class-A network (2^24 hosts) now takes 15 seconds as opposed
to 80 seconds.
2006-07-10 Roy Hills
* arp-scan.h, arp-scan.c: Removed unneeded element "n" from host
entry structure. This reduces the per-host memory usage from
32 bytes per host to 28 bytes per host.
* mac-vendor.5: New manual page for the mac-vendor.txt file format.
2006-07-03 Roy Hills
* link-packet-socket.c: New file containing all functions that
use Linux packet socket link layer interface. This moves all
the packet-socket implementation dependent to this one file, which
should make future porting to other operating systems easier.
* arp-scan.c, arp-scan.h: Modified to use link-layer functions in
new link-packet-socket.c file.
* configure.ac: Increased version number to 1.4.2.
2006-06-28 Roy Hills
* arp-scan.c, arp-scan.h: removed the unneeded ip_address union
and replaced it with "struct in_addr". As arp-scan is only
applicable to IPv4, we don't need to use the union. This
change reduces the size of an address from 16 bytes to 4, and
reduces the per-host memory usage from 44 bytes/host to 32.
* arp-fingerprint: Added Windows Vista Beta 2 fingerprint.
2006-06-27 Roy Hills
* configure.ac: Increase version number to 1.4.1 in preparation
for future changes.
2006-06-26 Roy Hills
* Released version 1.4.
This is the first stable version. v1.3 was a beta, and v1.0,
1.1 and 1.2 were internal versions before it was released under GPL.
arp-scan-1.10.0/Makefile.am 0000664 0000000 0000000 00000004523 14345150431 0015335 0 ustar 00root root 0000000 0000000 # Process this file with automake to produce Makefile.in
#
pkgsysconfdir = $(sysconfdir)/$(PACKAGE)
AM_CPPFLAGS = -DPKGDATADIR=\"$(pkgdatadir)\" -DPKGSYSCONFDIR=\"$(sysconfdir)/$(PACKAGE)\"
#
bin_PROGRAMS = arp-scan
#
dist_bin_SCRIPTS = get-oui get-iab arp-fingerprint
#
dist_check_SCRIPTS = check-run1 check-packet check-decode check-host-list check-ieee-reg check-error check-options check-prng
check_PROGRAMS = mt19937ar-test
mt19937ar_test_SOURCES = mt19937ar-test.c mt19937ar.c mt19937ar.h
#
dist_man_MANS = arp-scan.1 get-oui.1 arp-fingerprint.1 mac-vendor.5
#
arp_scan_SOURCES = arp-scan.c arp-scan.h error.c wrappers.c utils.c mt19937ar.c format.c mt19937ar.h
arp_scan_LDADD = $(LIBOBJS)
#
dist_pkgsysconf_DATA = mac-vendor.txt
dist_pkgdata_DATA = ieee-oui.txt
#
TESTS = $(dist_check_SCRIPTS)
EXTRA_DIST = arp-scan.1.dist get-oui.1.dist pkt-simple-request.dat pkt-custom-request.dat pkt-custom-request-padding.dat pkt-custom-request-llc.dat pkt-custom-request-vlan.dat pkt-simple-response.pcap pkt-padding-response.pcap pkt-vlan-response.pcap pkt-llc-response.pcap pkt-net1921681-response.pcap pkt-trailer-response.pcap pkt-vlan-llc-response.pcap pkt-custom-request-vlan-llc.dat pkt-dup-response.pcap pkt-diff-frame-addr.pcap pkt-local-admin.pcap pkt-ieee-regcheck.pcap
#
# Substitute autoconf pkgdatadir variable in arp-scan.1 manpage
CLEANFILES = arp-scan.1 get-oui.1
do_subst = $(SED) -e 's,[@]PKGDATADIR[@],$(pkgdatadir),g;s,[@]PKGSYSCONFDIR[@],$(pkgsysconfdir),g'
arp-scan.1: arp-scan.1.dist Makefile
$(do_subst) < $(srcdir)/arp-scan.1.dist > arp-scan.1
get-oui.1: get-oui.1.dist Makefile
$(do_subst) < $(srcdir)/get-oui.1.dist > get-oui.1
# Install arp-scan with cap_net_raw if possible, otherwise SUID root
install-exec-hook:
@if command -v setcap > /dev/null; then \
if setcap cap_net_raw+p $(DESTDIR)$(bindir)/arp-scan$(EXEEXT); then \
echo "setcap cap_net_raw+p $(DESTDIR)$(bindir)/arp-scan$(EXEEXT)"; \
chmod u-s $(DESTDIR)$(bindir)/arp-scan$(EXEEXT); \
else \
echo "Setcap failed on $(DESTDIR)$(bindir)/arp-scan$(EXEEXT), falling back to setuid" >&2; \
echo "chmod u+s $(DESTDIR)$(bindir)/arp-scan$(EXEEXT)"; \
chmod u+s $(DESTDIR)$(bindir)/arp-scan$(EXEEXT); \
fi \
else \
echo "Setcap is not installed, falling back to setuid" >&2 ; \
echo "chmod u+s $(DESTDIR)$(bindir)/arp-scan$(EXEEXT)" ;\
chmod u+s $(DESTDIR)$(bindir)/arp-scan$(EXEEXT) ;\
fi
arp-scan-1.10.0/NEWS 0000777 0000000 0000000 00000000000 14345150431 0015065 2NEWS.md ustar 00root root 0000000 0000000 arp-scan-1.10.0/NEWS.md 0000664 0000000 0000000 00000031330 14345150431 0014373 0 ustar 00root root 0000000 0000000 **This file gives a brief overview of the major changes between each arp-scan
release. For more details please read the ChangeLog file.**
# 2022-12-10 arp-scan 1.10.0 (git tag 1.10.0)
## New Features
* **POSIX.1e capabilities support for Linux systems with libcap.**
- Uses `CAP_NET_RAW` capability instead of superuser (root) permissions.
- May need `libcap-dev` or similar package to build. *Note that `libcap`
(capabilities) and `libpcap` (packet capture) are different libraries.*
- configure option `--with-libcap`, defaults to auto.
- Can set capability on exe with: `setcap cap_net_raw+p /path/to/arp-scan`
- Initially clears effective set completely and clears everything except
CAP_NET_RAW from the permitted set. Only enables CAP_NET_RAW in effective
set for the functions that open raw sockets. Once sockets opened, removes
CAP_NET_RAW from both effective and permitted set so process can never
re enable it.
- If arp-scan is SUID root, will drop all capabilities except CAP_NET_RAW
as above and will also drop SUID with `setuid(getuid())`. So SUID root is
essentially as secure as `setcap cap_net_raw+p /path/to/arp-scan` and is a
safe alternative if the filesystem does not support extended attributes.
- If arp-scan is run as root, e.g. `sudo`, it will drop all capabilities
except CAP_NET_RAW and proceed as previously, but will remain as UID 0
and may encounter file permissions issues if it tries to open files with
e.g. `--pcapsavefile` or `--ouifile` in user directories.
- `--version` displays `Built with libcap POSIX.1e capability support` if
enabled.
- `make install` installs the arp-scan executable with the `CAP_NET_RAW`
capability if `setcap` is available and works. Otherwise will fallback to
SUID. See `install-exec-hook` in `Makefile.am` for details.
* **--format option allows flexible output format.**
- Fields and text with \ character escapes, e.g. `${ip}\t${mac}\t${vendor}`
- Optional left/right aligned width, e.g. `|${ip;-15}|${mac}|`
- XML: `${ip}${mac}${vendor}`
- JSON: `{"ipAddress":"${ip}", "macAddress":"${mac}", "vendor":"${vendor}"},`
- See the arp-scan manpage for details of field names and more examples.
* **Mac/Vendor mapping file changes.**
- `ieee-oui.txt` now holds data for all IEEE registries: MA-L (OUI), MA-M,
MA-S (OUI36) and IAB.
- `ieee-iab.txt` file and `--iabfile` option have been removed.
- `get-oui` now updates `ieee-oui.txt` from all registries. `get-iab` has been
removed.
- `get-oui` requires Perl module `Text::CSV` as it now uses the IEEE .csv
files instead of the .txt files.
- `get-oui` can be edited to use the data from the Debian `ieee-data` package.
- `mac-vendor.txt` is now installed to `$(sysconfdir)/$(PACKAGE)` instead of
`$(pkgdatadir)`. E.g. `/usr/local/etc/arp-scan` if ./configured with no
directory options, or `/etc/arp-scan` with `--sysconfdir=/etc`. This is to
permit local changes to persist across upgrades.
## General improvements
* Put man pages and `--help` output on a diet. Updated for new options.
* Option value length is now limited only by the maximum command line
length (normally around 100K). This allows for complex `--format` options,
long `--padding` lengths etc.
* arp-scan now prints a brief error message instead of half a page of usage
text for unknown options.
# 2022-10-08 arp-scan 1.9.8 (git tag 1.9.8)
* New Features:
- Allow the use of Linux IP aliases such as `eth0:0` for the interface name.
- Permit regular MAC addresses e.g. `00:0c:29:b9:43:1b` in `mac-vendor.txt`.
- `--limit=n` option exits after n of hosts have responded, exit 1 for header file early in link-bpf.c to avoid BPF symbol
problems on some BSD based operating systems.
* Added arp-fingerprint patterns for GNU/Hurd, Amazon Kindle (Linux 2.6),
BeOS, Windows 8, Recent Linux, FreeBSD, NetBSD and OpenBSD versions, and
RiscOS.
* Added data file "pkt-custom-request-vlan-llc.dat" to the tarball to allow
the ARP request packet generation self test to complete successfully.
* Various minor bug fixes and improvements.
# 2011-03-01 arp-scan 1.8:
* Updated IEEE OUI and IAB MAC/Vendor files. There are now 14707 OUI entries
and 3542 IAB entries.
* Added support for trailer ARP replies, which were used in early versions
of BSD Unix on VAX.
* Added support for ARP packets with both 802.1Q VLAN tag and LLC/SNAP framing.
* The full help output is only displayed if specifically requested with
arp-scan --help. Usage errors now result in smaller help output.
* Added support for Apple Mac OS X with Xcode 2.5 and later. This allows
arp-scan to build on Tiger, Leopard and Snow Leopard.
* Changed license from GPLv2 to GPLv3.
* Added warning about possible DoS when setting ar$spa to the destination IP
address to the help output and man page.
* Added arp-fingerprint patterns for 2.11BSD, NetBSD 4.0, FreeBSD 7.0,
Vista SP1, Windows 7 and Blackberry OS.
* Enabled compiler security options -fstack-protect, -D_FORTIFY_SOURCE=2 and
-Wformat-security if they are supported by the compiler. Also enabled extra
warnings -Wwrite-strings and -Wextra.
* Added new "make check" tests to check packet generation, and packet decoding
and display.
* Modified get-oui and get-iab perl scripts so they will work on systems where
the perl interpreter is not in /usr/bin, e.g. NetBSD.
* Various minor bug fixes and improvements.
# 2008-07-24 arp-scan 1.7:
* new --pcapsavefile (-W) option to save the ARP response packets to a pcap
savefile for later analysis with tcpdump, wireshark or another program that
supports the pcap file format.
* new --vlan (-Q) option to create outgoing ARP packets with an 802.1Q VLAN tag
ARP responses with a VLAN tag are interpreted and displayed.
* New --llc (-L) option to create outgoing ARP packets with RFC 1042 LLC/SNAP
framing. Received ARP packets are decoded and displayed with either
LLC/SNAP or the default Ethernet-II framing irrespective of this option.
* Avoid double unmarshalling of packet data: once in callback, then again in
display_packet().
* New arp-fingerprint patterns for ARP fingerprinting: Cisco 79xx IP Phone
SIP 5.x, 6.x and 7.x; Cisco 79xx IP Phone SIP 8.x.
* Updated IEEE OUI and IAB MAC/Vendor files. There are now 11,697 OUI entries
and 2,386 IAB entries.
# 2007-04-12 arp-scan 1.6:
* arp-scan wiki at http://www.nta-monitor.com/wiki/
This contains detailed documentation on arp-scan, and is intended to be
the primary documentation resource.
* Added support for Sun Solaris. Tested on Solaris 9 (SPARC). arp-scan may
also work on other systems that use DLPI, but only Solaris has been tested.
* New arp-fingerprint patterns for ARP fingerprinting: IOS 11.2, 11.3 and 12.4;
ScreenOS 5.1, 5.2, 5.3 and 5.4; Cisco VPN Concentrator 4.7; AIX 4.3 and 5.3;
Nortel Contivity 6.00 and 6.05; Cisco PIX 5.1, 5.2, 5.3, 6.0, 6.1, 6.2, 6.3
and 7.0.
* Updated IEEE OUI and IAB MAC/Vendor files. There are now 10,214 OUI entries
and 1,858 IAB entries.
* Added HSRP MAC address to mac-vendor.txt.
# 2006-07-22 arp-scan 1.5:
* Reduced memory usage from 44 bytes per target to 28 bytes. This reduces
the memory usage for a Class-B network from 2.75MB to 1.75MB, and a Class-A
network from 704MB to 448MB.
* Reduced the startup time for large target ranges. This reduces the startup
time for a Class-A network from 80 seconds to 15 seconds on a Compaq laptop
with 1.4GHz CPU.
* Added support for FreeBSD, OpenBSD, NetBSD and MacOS X (Darwin). arp-scan
will probably also work on other operating systems that implement BPF, but
only those listed have been tested.
* Improved operation of the --srcaddr option. Now this will change the
source hardware address in the Ethernet header without changing the
interface address.
* Additional fingerprints for arp-fingerprint.
* Improved manual pages.
* Updated IEEE OUI and IAB files. There are now 9,426 OUI entries and 1,568
IAB entries.
# 2006-06-26 arp-scan 1.4:
* Added IEEE IAB listings and associated get-iab update script and --iabfile
option.
* Added manual MAC/Vendor mapping file: mac-vendor.txt and associated
--macfile option.
* New --localnet option to scan all IP addresses on the specified interface
network and mask.
# 2006-06-23 arp-scan 1.3:
* Initial public release. Source distribution only, which will compile and
run on Linux.
arp-scan-1.10.0/README 0000777 0000000 0000000 00000000000 14345150431 0015427 2README.md ustar 00root root 0000000 0000000 arp-scan-1.10.0/README.md 0000664 0000000 0000000 00000005050 14345150431 0014554 0 ustar 00root root 0000000 0000000 # arp-scan
[](https://github.com/royhills/arp-scan/actions/workflows/c-cpp.yml)
[](https://coveralls.io/github/royhills/arp-scan?branch=master)
[](https://github.com/royhills/arp-scan/actions/workflows/codeql.yml)
---
## Table of Contents
- [About](#about)
- [Installation](#installation)
- [Documentation](#documentation)
About
-----
arp-scan is a command-line tool that uses the ARP protocol to discover and fingerprint IPv4 hosts on the local network. It is available for Linux, BSD (including macOS) and Solaris under the GPLv3 licence.
Installation
------------
arp-scan uses the GNU automake and autoconf tools, so the typical installation process is:
- ```git clone https://github.com/royhills/arp-scan.git``` to obtain the latest source code
- ```cd arp-scan```
- ```autoreconf --install``` to generate a configure file
- ```./configure``` to create a makefile for your system (see configuration options below)
- ```make``` to build the project
- Optionally ```make check``` to verify that everything works as expected
- ```make install``` to install (you'll need to be root or use sudo/doas for this part)
You will need:
- GNU `automake` and `autoconf`.
- The `make` utility.
- An ANSI C compiler (works with `gcc` and `clang`).
- `libpcap` version 1.5 or later.
- `libcap` to build with POSIX.1e capabilities support on Linux.
To run the Perl scripts arp-fingerprint and get-oui, you will also need `perl` and the perl modules `LWP::UserAgent` and `Text::CSV`.
You can pass options to "configure" to control the build process. Run "./configure --help" for a list of options. arp-scan has one package-specific configure option:
- --with-libcap[=auto/yes/no] Build with libcap POSIX.1e capabilities support [default=auto]
By default, configure will enable capability support if the *libcap* library and headers are installed. Specifying *--with-libcap* will enable support and *--without-libpcap* will disable it.
arp-scan runs on:
- Linux
- FreeBSD
- OpenBSD
- NetBSD
- DragonflyBSD
- macOS X
- Solaris 10 (there are known problems with Solaris 11)
Documentation
-------------
For usage information use:
```arp-scan --help```
For detailed information, see the manual pages: arp-scan(1), arp-fingerprint(1), get-oui(1) and mac-vendor(5).
See the arp-scan wiki at http://www.royhills.co.uk/wiki/
arp-scan-1.10.0/TODO 0000664 0000000 0000000 00000000564 14345150431 0013772 0 ustar 00root root 0000000 0000000 Add support for win32 link-layer send and receive.
Find portable function to get interface MAC address.
Investigate response packets >60 bytes long, e.g. Windows 2003 Server and
some Cisco.
MPLS tag support (Label Distribution Using ARP: draft-kompella-mpls-larp-11).
Add support for Cisco ISL VLANs in addition to 802.1Q VLANs. Suggested by
Daniel at commonexploits.
arp-scan-1.10.0/acinclude.m4 0000664 0000000 0000000 00000013545 14345150431 0015476 0 ustar 00root root 0000000 0000000 dnl autoconf macros
dnl
dnl Useful macros for autoconf to check for ssp-patched gcc
dnl 1.0 - September 2003 - Tiago Sousa
dnl
dnl Modified by ffontaine pull request: use AC_LINK_IFELSE instead of
dnl AC_COMPILE_IFELSE because some systems may be missing the libssp library
dnl even though the compiler accepts the option.
dnl
dnl About ssp:
dnl GCC extension for protecting applications from stack-smashing attacks
dnl http://www.research.ibm.com/trl/projects/security/ssp/
dnl
dnl Usage:
dnl After calling the correct AC_LANG_*, use the corresponding macro:
dnl
dnl GCC_STACK_PROTECT_CC
dnl checks -fstack-protector with the C compiler, if it exists then updates
dnl CFLAGS and defines ENABLE_SSP_CC
dnl
dnl GCC_STACK_PROTECT_CXX
dnl checks -fstack-protector with the C++ compiler, if it exists then updates
dnl CXXFLAGS and defines ENABLE_SSP_CXX
dnl
AC_DEFUN([GCC_STACK_PROTECT_CC],[
ssp_cc=yes
if test "X$CC" != "X"; then
AC_MSG_CHECKING([whether ${CC} accepts -fstack-protector])
ssp_old_cflags="$CFLAGS"
CFLAGS="$CFLAGS -fstack-protector"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],[],[ssp_cc=no])
echo $ssp_cc
if test "X$ssp_cc" = "Xno"; then
CFLAGS="$ssp_old_cflags"
else
AC_DEFINE([ENABLE_SSP_CC], 1, [Define if SSP C support is enabled.])
fi
fi
])
AC_DEFUN([GCC_STACK_PROTECT_CXX],[
ssp_cxx=yes
if test "X$CXX" != "X"; then
AC_MSG_CHECKING([whether ${CXX} accepts -fstack-protector])
ssp_old_cxxflags="$CXXFLAGS"
CXXFLAGS="$CXXFLAGS -fstack-protector"
AC_LINK_IFELSE([AC_LANG_PROGRAM([[]], [[]])],[],[ssp_cxx=no])
echo $ssp_cxx
if test "X$ssp_cxx" = "Xno"; then
CXXFLAGS="$ssp_old_cxxflags"
else
AC_DEFINE([ENABLE_SSP_CXX], 1, [Define if SSP C++ support is enabled.])
fi
fi
])
dnl Check whether GCC accepts -D_FORTIFY_SOURCE
dnl
dnl This was introduced in GCC 4.1 and glibc 2.4, but was present in earlier
dnl versions on redhat systems (specifically GCC 3.4.3 and above).
dnl
dnl We define the GNUC_PREREQ macro to the same definition as __GNUC_PREREQ
dnl in . We don't use __GNUC_PREREQ directly because
dnl is not present on all the operating systems that we support, e.g. OpenBSD.
dnl
AC_DEFUN([GCC_FORTIFY_SOURCE],[
if test "X$CC" != "X"; then
AC_MSG_CHECKING([whether ${CC} accepts -D_FORTIFY_SOURCE])
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[
#define GNUC_PREREQ(maj, min) ((__GNUC__ << 16) + __GNUC_MINOR__ >= ((maj) << 16) + (min))
#if !(GNUC_PREREQ (4, 1) \
|| (defined __GNUC_RH_RELEASE__ && GNUC_PREREQ (4, 0)) \
|| (defined __GNUC_RH_RELEASE__ && GNUC_PREREQ (3, 4) \
&& __GNUC_MINOR__ == 4 \
&& (__GNUC_PATCHLEVEL__ > 2 \
|| (__GNUC_PATCHLEVEL__ == 2 && __GNUC_RH_RELEASE__ >= 8))))
#error No FORTIFY_SOURCE support
#endif
]])],[
AC_MSG_RESULT(yes)
CFLAGS="$CFLAGS -D_FORTIFY_SOURCE=2"
],[
AC_MSG_RESULT(no)
])
fi
])
dnl Check for support of the GCC -Wformat-security option.
dnl This option was introduced in GCC 3.0.
dnl
dnl Note that in this test, the test compilation fails if the option is
dnl supported, and succeeds if it is not supported.
dnl
dnl If this option is supported, then the test program will produce a
dnl warning like "format not a string literal and no format arguments".
dnl If it is not supported, then the test program will compile without
dnl warnings.
dnl
AC_DEFUN([GCC_FORMAT_SECURITY],[
if test "X$CC" != "X"; then
AC_MSG_CHECKING([whether ${CC} accepts -Wformat-security])
wfs_old_cflags="$CFLAGS"
CFLAGS="$CFLAGS -Wall -Werror -Wformat -Wformat-security"
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[#include ]], [[
char *fmt=NULL;
printf(fmt);
return 0;
]])],[
AC_MSG_RESULT(no)
CFLAGS="$wfs_old_cflags"
],[
AC_MSG_RESULT(yes)
CFLAGS="$wfs_old_cflags -Wformat -Wformat-security"
])
fi
])
dnl Check for support of the GCC -Wextra option, which enables extra warnings.
dnl Support for this option was added in gcc 3.4.0.
dnl
AC_DEFUN([GCC_WEXTRA],[
gcc_wextra=yes
if test "X$CC" != "X"; then
AC_MSG_CHECKING([whether ${CC} accepts -Wextra])
gcc_old_cflags="$CFLAGS"
CFLAGS="$CFLAGS -Wextra"
AC_COMPILE_IFELSE([AC_LANG_PROGRAM([[]], [[]])],[
AC_MSG_RESULT(yes)
],[
AC_MSG_RESULT(no)
gcc_wextra=no
CFLAGS="$ssp_old_cflags"
])
fi
])
dnl Check for POSIX.1e capabilities support with libcap
AC_DEFUN([CHECK_LIBCAP],
[
AC_ARG_WITH(libcap,
AS_HELP_STRING([--with-libcap@<:@=auto/yes/no@:>@],[Build with libcap POSIX.1e capabilities support @<:@default=auto@:>@]),,
with_libcap=auto)
if test "X$with_libcap" = "Xno" ; then
have_libcap=no;
else
# Check for header file
AC_CHECK_HEADER(sys/capability.h, cap_headers=yes, cap_headers=no)
# Check for library
AC_CHECK_LIB(cap, cap_set_proc, cap_library=yes, cap_library=no)
# Check results are usable
if test "X$with_libcap" = "Xyes" -a "X$cap_library" = "Xno" ; then
AC_MSG_ERROR([libcap support was requested but the library was not found])
fi
if test "X$cap_library" = "Xyes" -a "X$cap_headers" = "Xno" ; then
AC_MSG_ERROR([libcap libraries found but headers are missing])
fi
fi
AC_MSG_CHECKING([whether to use libcap])
if test "X$cap_library" = "Xyes" -a "X$cap_library" = "Xyes"; then
AC_DEFINE(HAVE_LIBCAP,1,[Define to 1 if you have the libcap library])
AC_DEFINE(HAVE_SYS_CAPABILITY_H,1,[Define to 1 if you have the header file])
LIBS="-lcap $LIBS"
AC_MSG_RESULT([yes])
AC_MSG_NOTICE([Including libcap POSIX.1e capability support])
else
AC_MSG_RESULT([no])
AC_MSG_NOTICE([POSIX.1e capabilities disabled or not supported])
fi
])
arp-scan-1.10.0/arp-fingerprint 0000775 0000000 0000000 00000027632 14345150431 0016344 0 ustar 00root root 0000000 0000000 #!/usr/bin/env perl
#
# Copyright 2006-2016 Roy Hills
#
# This file is part of arp-scan.
#
# arp-scan is free software: you can redistribute it and/or modify
# it under the terms of the GNU General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# arp-scan is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with arp-scan. If not, see .
#
# arp-fingerprint -- Perl script to fingerprint system with arp-scan
#
# Author: Roy Hills
# Date: 30th May 2006
#
# This script uses arp-scan to fingerprint the operating system on the
# specified target.
#
# It sends various different ARP packets to the target, and records which
# ones it responds to. From this, it constructs a fingerprint string
# which is used to match against a hash containing known fingerprints.
#
use warnings;
use strict;
use Getopt::Std;
#
sub get_localnet($);
#
my $arpscan="arp-scan -q -r 1";
#
# Hash of known fingerprints
#
# These fingerprints were observed on:
#
# FreeBSD 10.3 FreeBSD 10.3 amd64 on VMware
# FreeBSD 9.1 FreeBSD 9.1 i386 on VMware
# FreeBSD 8.2 FreeBSD 8.2 i386 on VMware
# FreeBSD 7.0 FreeBSD 7.0 i386 on VMware
# FreeBSD 5.3 FreeBSD 5.3 i386 on VMware
# FreeBSD 4.3 FreeBSD 4.3 i386 on VMware
# DragonflyBSD 2.0 Dragonfly BSD 2.0.0 i386 on VMware
# DragonflyBSD 3.0 Dragonfly BSD 3.0.2 i386 on VMware
# DragonflyBSD 3.2 Dragonfly BSD 3.2.2 amd64 on VMware
# DragonflyBSD 4.6 Dragonfly BSD 4.6.0 amd64 on VMware
# Win 3.11 Windows for Workgroups 3.11/DOS 6.22 on VMware
# 95 Windows 95 OSR2 on VMware
# Win98 Windows 98 SE on VMware
# WinME Windows ME on VMware
# Windows7 Windows 7 Professional 6.1.7600 Build 7600 on Dell Vostro 220
# Windows8 Windows 8 Pro x64 6.2.9200 Build 9200 on VMware
# Windows10 Windows 10 Pro 10.0.14393 Build 14393 on VMware
# NT 3.51 Windows NT Server 3.51 SP0 on VMware
# NT4 Windows NT Workstation 4.0 SP6a on Pentium
# 2000 Windows 2000
# XP Windows XP Professional SP2 on Intel P4
# 2003 Windows 2003 Server SP1 on Intel P4
# Vista Windows Vista Beta 2 Build 5384 on VMware
# Vista Windows Vista SP1 Build 6001 on Dell Inspiron
# 2008 Windows 2008 Server Beta on i386
# Linux 2.0 Linux 2.0.29 on VMware (debian 1.3.1)
# Linux 2.2 Linux 2.2.19 on VMware (debian potato)
# Linux 2.4 Linux 2.4.29 on Intel P3 (debian sarge)
# Linux 2.6 Linux 2.6.15.7 i686 on Intel P3 (debian sarge)
# Linux 2.6 Kindle 3.1 on Amazon Kindle 3
# Linux 2.6 Linux 2.6.32.60 x86_64 on VMware (debian squeeze)
# Linux 3.2 Linux 3.2.0 686 on VMware (debian wheezy)
# Linux 3.8 Linux 3.8.8 x86_64 on VMware (fedora 17)
# Linux 4.0 Linux 4.0.6 x86_64 on VMware (fedora 22)
# Linux 4.6 Linux 4.6.7 x86_64 on VMware (fedora 24)
# Cisco IOS IOS 11.2(17) on Cisco 2503
# Cisco IOS IOS 11.3(11b)T2 on Cisco 2503
# Cisco IOS IOS 12.0(8) on Cisco 1601
# Cisco IOS IOS 12.1(27b) on Cisco 2621
# Cisco IOS IOS 12.2(32) on Cisco 1603
# Cisco IOS IOS 12.3(15) on Cisco 2503
# Cisco IOS IOS 12.4(3) on Cisco 2811
# Cisco IOS IOS 12.4(24)T1 on Cisco 1841
# Cisco IOS IOS 15.0(1)M on Cisco 7206 (dynamips)
# Solaris 2.5.1 Solaris 2.5.1 (SPARC) on Sun SPARCstation 20
# Solaris 2.6 Solaris 2.6 (SPARC) on Sun Ultra 5
# Solaris 7 Solaris 7 (x86) on VMware
# Solaris 8 Solaris 8 (SPARC) on Sun Ultra 5 (64 bit)
# Solaris 9 Solaris 9 (SPARC) on Sun Ultra 5 (64 bit)
# Solaris 10 Solaris 10 (x86) on VMware
# ScreenOS 5.0 Juniper ScreenOS 5.0.0r9 on NetScreen 5XP
# ScreenOS 5.1 Juniper ScreenOS 5.1.0r1.0 on NetScreen 5GT
# ScreenOS 5.3 Juniper ScreenOS 5.3.0r4.0 on NetScreen 5GT
# ScreenOS 5.4 Juniper ScreenOS 5.4.0r1.0 on NetScreen 5GT
# ScreenOS 5.4 Juniper ScreenOS 5.4.0r22.0 on NetScreen 5GT
# ScreenOS 6.2 Juniper ScreenOS 6.2.0r12.0 on Juniper SSG5
# MacOS 10.4 MacOS 10.4.6 on powerbook G4
# MacOS 10.3 MacOS 10.3.9 on imac G3
# IRIX 6.5 IRIX64 IRIS 6.5 05190004 IP30 on SGI Octane
# SCO OS 5.0.7 SCO OpenServer 5.0.7 on VMware
# 2.11BSD 2.11BSD patch level 431 on PDP-11/73 (SIMH simulated)
# 4.3BSD 4.3BSD (Quasijarus0c) on MicroVAX 3000 (SIMH simulated)
# OpenBSD 3.1 OpenBSD 3.1 i386 on VMware
# OpenBSD 3.9 OpenBSD 3.9 i386 on VMware
# OpenBSD 4.8 OpenBSD 4.8 i386 on VMware
# OpenBSD 5.1 OpenBSD 5.1 amd64 on VMware
# OpenBSD 5.9 OpenBSD 5.9 amd64 on VMware
# NetBSD 2.0.2 NetBSD 2.0.2 i386 on VMware
# NetBSD 4.0 NetBSD 4.0 i386 on VMware
# NetBSD 5.1 NetBSD 5.1.2 i386 on VMware
# NetBSD 6.0 NetBSD 6.0.1 amd64 on VMware
# NetBSD 7.0 NetBSD 7.0.1 amd64 on VMware
# IPSO 3.2.1 IPSO 3.2.1-fcs1 on Nokia VPN 210
# Netware 6.5 Novell NetWare 6.5 on VMware
# HP-UX 11 HP-UX B.11.00 A 9000/712 (PA-RISC)
# PIX OS PIX OS (unknown vsn) on Cisco PIX 525
# PIX OS 4.4 PIX OS 4.4(4) on Cisco PIX 520
# PIX OS 5.1 PIX OS 5.1(2) on Cisco PIX 520
# PIX OS 5.2 PIX OS 5.2(9) on Cisco PIX 520
# PIX OS 5.3 PIX OS 5.3(2) on Cisco PIX 520
# PIX OS 6.0 PIX OS 6.0(4) on Cisco PIX 520
# PIX OS 6.1 PIX OS 6.1(5) on Cisco PIX 520
# PIX OS 6.2 PIX OS 6.2(4) on Cisco PIX 520
# PIX OS 6.3 PIX OS 6.3(5) on Cisco PIX 520
# PIX OS 7.0(1) PIX OS 7.0(1) on Cisco PIX 515E
# PIX OS 7.0(2) PIX OS 7.0(2) on Cisco PIX 515E
# PIX OS 7.0(4) PIX OS 7.0(4) on Cisco PIX 515E
# PIX OS 7.0(6) PIX OS 7.0(6) on Cisco PIX 515E
# PIX OS 7.1 PIX OS 7.1(1) on Cisco PIX 515E
# PIX OS 7.2 PIX OS 7.2(1) on Cisco PIX 515E
# PIX OS 8.0 PIX OS 8.0(2) on Cisco PIX 515E
# Minix 3 Minix 3 1.2a on VMware
# Nortel Contivity 6.00 Nortel Contivity V06_00 (VxWorks based)
# Nortel Contivity 6.05 Nortel Contivity V06_05.135
# AIX 4.3 IBM AIX Version 4.3 on RS/6000 7043-260
# AIX 5.3 IBM AIX Version 5.3 on RS/6000 7043-260
# Cisco VPN Concentrator 4.7 Cisco VPN Concentrator 3030 4.7.2E
# Cisco IP Phone 79xx SIP 5.x,6.x,7.x 7940 SIP firmware version 5.3
# Cisco IP Phone 79xx SIP 5.x,6.x,7.x 7940 SIP firmware version 6.3
# Cisco IP Phone 79xx SIP 5.x,6.x,7.x 7940 SIP firmware version 7.5
# Cisco IP Phone 79xx SIP 8.x 7940 SIP firmware version 8.6
# Catalyst 1900 Cisco Catalyst 1900 V9.00.03 Standard Edition
# Catalyst IOS 12.2 Cisco Catalyst 3550-48 running IOS 12.2(35)SE
# Catalyst IOS 12.0 Cisco Catalyst 2924-XL running IOS 12.0(5)WC17
# Catalyst IOS 12.1 Cisco Catalyst 3550-48 running IOS 12.1(11)EA1a SMI
# FortiOS 3.00 FortiGate 100A running FortiOS 3.00,build0406,070126
# Plan9 Plan9 release 4 on VMware
# Blackberry OS Blackberry OS v5.0.0.681 on Blackberry 8900
# GNU/Hurd Debian GNU/Hurd (GNU-Mach 1.3.99/Hurd-0.3) on VMware
# BeOS BeOS 5.0.3 PE Max on VMware
# RiscOS 5.19 RiscOS 5.19 on Raspberry Pi
# WIZnet W5100 WIZnet W5100 on Ethernet chip on Arduino Ethernet shield
# Android 4.1 Android 4.1.2 on Samsung Galaxy S3 Mini (wifi)
# Android 4.4 Android 4.4.2 on Google Nexus 7 (wifi)
#
my %fp_hash = (
'11110100000' => 'FreeBSD 5.3, 7.0, 8.2, 9.1, 10.3, DragonflyBSD 2.0, 3.0, 3.2, 4.6, Win98, WinME, NT4, 2000, XP, 2003, Catalyst IOS 12.0, 12.1, 12.2, FortiOS 3.00',
'01000100000' => 'Linux 2.2, 2.4, 2.6',
'01010100000' => 'Linux 2.2, 2.4, 2.6, 3.2, 3.8, 4.0, 4.6, Vista, 2008, Windows7, Windows8, Windows10', # Linux only if non-local IP is routed
'00000100000' => 'Cisco IOS 11.2, 11.3, 12.0, 12.1, 12.2, 12.3, 12.4, 15.0',
'11110110000' => 'Solaris 2.5.1, 2.6, 7, 8, 9, 10, HP-UX 11, NetBSD 6.0, 7.0',
'01000111111' => 'ScreenOS 5.0, 5.1, 5.3, 5.4, 6.2',
'11110000000' => 'Linux 2.0, MacOS 10.4, IPSO 3.2.1, Minix 3, Cisco VPN Concentrator 4.7, Catalyst 1900, BeOS, WIZnet W5100',
'11110100011' => 'MacOS 10.3, FreeBSD 4.3, IRIX 6.5, AIX 4.3, AIX 5.3',
'10010100011' => 'SCO OS 5.0.7',
'10110100000' => 'Win 3.11, 95, NT 3.51',
'11110000011' => '2.11BSD, 4.3BSD, OpenBSD 3.1, 3.9, 4.8, 5.1, 5.9, Nortel Contivity 6.00, 6.05, RiscOS 5.19',
'10110110000' => 'NetBSD 2.0.2, 4.0, 5.1',
'10110111111' => 'PIX OS 4.4, 5.1, 5.2, 5.3, Android 4.1',
'11110111111' => 'PIX OS 6.0, 6.1, 6.2, ScreenOS 5.0 (transparent), Plan9, Blackberry OS',
'00010110011' => 'PIX OS 6.3, 7.0(1), 7.0(2)',
'01010110011' => 'PIX OS 7.0(4)-7.0(6), 7.1, 7.2, 8.0',
'00000110000' => 'Netware 6.5',
'00010100000' => 'Unknown 1', # 14805 79.253 Cisco
'00000110011' => 'Cisco IP Phone 79xx SIP 5.x,6.x,7.x',
'11110110011' => 'Cisco IP Phone 79xx SIP 8.x', # Also 14805 63.11 Fujitsu Siemens
'01010000000' => 'GNU/Hurd, Android 4.4',
);
#
my $usage =
qq/Usage: arp-fingerprint [options]
Fingerprint the target system using arp-scan.
'options' is one or more of:
-h Display this usage message.
-v Give verbose progress messages.
-o Pass specified options to arp-scan
-l Fingerprint all targets in the local net.
/;
my %opts;
my $user_opts="";
my $verbose;
my $fingerprint="";
my $fp_name;
my @targets;
my $target;
#
# Process options
#
die "$usage\n" unless getopts('hlvo:',\%opts);
if ($opts{h}) {
print "$usage\n";
exit(0);
}
$verbose=$opts{v} ? 1 : 0;
if ($opts{o}) {
$user_opts = $opts{o};
}
#If we're working in localnet mode, we don't need arguments
if ($#ARGV != 0 && !$opts{l}) {
die "$usage\n";
}
if ($opts{l}) {
@targets=get_localnet($user_opts);
} else {
@targets=@ARGV;
}
for $target (@targets) {
$fingerprint="";
#
# Check that the target is not an IP range or network.
#
if ($target =~ /\d+\.\d+\.\d+\.\d+-\d+\.\d+\.\d+\.\d+/ ||
$target =~ /\d+\.\d+\.\d+\.\d+\/\d+/ ||
$target =~ /\d+\.\d+\.\d+\.\d+:\d+\.\d+\.\d+\.\d+/) {
die "argument must be a single IP address or hostname\n";
}
#
# Check that the system responds to an arp-scan with no options.
# If it does, then fingerprint the target.
#
if (&fp("","$target") eq "1") {
# 1: source protocol address = localhost
$fingerprint .= &fp("--arpspa=127.0.0.1","$target");
# 2: source protocol address = zero
$fingerprint .= &fp("--arpspa=0.0.0.0","$target");
# 3: source protocol address = broadcast
$fingerprint .= &fp("--arpspa=255.255.255.255","$target");
# 4: source protocol address = non local (network 1 is reserved)
$fingerprint .= &fp("--arpspa=1.0.0.1","$target"); # Non-local source IP
# 5: invalid arp opcode
$fingerprint .= &fp("--arpop=255","$target");
# 6: arp hardware type = IEEE_802.2
$fingerprint .= &fp("--arphrd=6","$target");
# 7: invalid arp hardware type
$fingerprint .= &fp("--arphrd=255","$target");
# 8: invalid arp protocol type
$fingerprint .= &fp("--arppro=0xffff","$target");
# 9: arp protocol type = Novell IPX
$fingerprint .= &fp("--arppro=0x8137","$target");
# 10: invalid protocol address length
$fingerprint .= &fp("--arppln=6","$target");
# 11: Invalid hardware address length
$fingerprint .= &fp("--arphln=8","$target");
#
if (defined $fp_hash{$fingerprint}) {
$fp_name = "$fp_hash{$fingerprint}";
} else {
$fp_name = "UNKNOWN";
}
print "$target\t$fingerprint\t$fp_name\n";
} else {
print "$target\tNo Response\n";
}
}
#
# Scan the specified IP address with arp-scan using the given options.
# Return "1" if the target responds, or "0" if it does not respond.
#
sub fp ($$) {
my $ip;
my $options;
my $response = "0";
($options, $ip) = @_;
open(ARPSCAN, "$arpscan $user_opts $options $ip |") || die "arp-scan failed";
while () {
if (/^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+\t/) {
$response = "1";
last;
}
}
close(ARPSCAN);
if ($verbose && $options ne "") {
if ($response) {
print "$options\tYes\n";
} else {
print "$options\tNo\n";
}
}
return $response;
}
#
# use -l flag on arp-scan to collect all IPs in the local network
#
sub get_localnet($) {
my $user_opts = $_[0];
my @targets;
open(ARPSCAN, "$arpscan $user_opts -l |") || die "arp-scan failed";
while () {
if (/^([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)\t/) {
push @targets, $1;
}
}
close(ARPSCAN);
die "parse of arp-scan failed" unless @targets;
return @targets;
}
arp-scan-1.10.0/arp-fingerprint.1 0000664 0000000 0000000 00000010142 14345150431 0016464 0 ustar 00root root 0000000 0000000 .\" Copyright (C) Roy Hills
.\"
.\" Copying and distribution of this file, with or without modification,
.\" are permitted in any medium without royalty provided the copyright
.\" notice and this notice are preserved.
.\"
.TH ARP-FINGERPRINT 1 "October 27, 2022"
.\" Please adjust this date whenever revising the man page.
.SH NAME
arp-fingerprint \- Fingerprint a system using ARP
.SH SYNOPSIS
.B arp-fingerprint
.RI [ options ]
.I target
.PP
The target should be specified as a single IP address or hostname. You cannot specify multiple targets, IP networks or ranges.
.PP
If you use an IP address for the target, you can use the
.B -o
option to pass the
.B --numeric
option to
.BR arp-scan ,
which will prevent it from attempting DNS lookups. This can speed up the
fingerprinting process, especially on systems with a slow or faulty DNS
configuration.
.SH DESCRIPTION
.B arp-fingerprint
fingerprints the specified target host using the ARP protocol.
.PP
It sends various different types of ARP request to the target, and records
which types it responds to. From this, it constructs a fingerprint string
consisting of "1" where the target responded and "0" where it did not.
An example of a fingerprint string is
.IR 01000100000 .
This fingerprint string is then used to lookup the likely target operating system.
.PP
Many of the fingerprint strings are shared by several operating systems, so
there is not always a one-to-one mapping between fingerprint strings and
operating systems. Also the fact that a system's fingerprint matches a certain
operating system (or list of operating systems) does not necessarily mean that
the system being fingerprinted is that operating system, although it is quite
likely. This is because the list of operating systems is not exhaustive; it is
just what I have discovered to date, and there are bound to be operating
systems that are not listed.
.PP
The ARP fingerprint of a system is generally a function of that system's
kernel (although it is possible for the ARP function to be implemented in
user space, it almost never is).
.PP
Sometimes, an operating system can give different fingerprints depending
on the configuration. An example is Linux, which will respond to a non-local
source IP address if that IP is routed through the interface being tested.
This is both good and bad: on one hand it makes the fingerprinting task more
complex; but on the other, it can allow some aspects of the system configuration
to be determined.
.PP
Sometimes the fact that two different operating systems share a common ARP
fingerprint string points to a re-use of networking code. One example of
this is Windows NT and FreeBSD.
.PP
.B arp-fingerprint
uses
.B arp-scan
to send the ARP requests and receive the replies.
.PP
There are other methods that can be used to fingerprint a system using
.B arp-scan
which can be used in addition to
.BR arp-fingerprint .
These additional methods are not included in
.B arp-fingerprint
either because they are likely to cause disruption to the target system, or
because they require knowledge of the target's configuration that may not
always be available.
.PP
Most of the ARP requests that \fBarp-fingerprint\fP sends are non-standard,
so it could disrupt systems that don't have a robust TCP/IP stack.
.SH OPTIONS
.TP
.B -h
Display a brief usage message and exit.
.TP
.B -v
Display verbose progress messages.
.TP
.B -o
Pass specified options to arp-scan. You need to enclose the options
string in quotes if it contains spaces. e.g.
-o "-I eth1". The commonly used options are --interface (-I) and --numeric
(-N).
.TP
.B -l
Fingerprint all hosts on the local network. You do not need to specify any
target hosts if this option is given.
.SH EXAMPLES
.nf
$ arp-fingerprint 192.168.0.1
192.168.0.1 01000100000 Linux 2.2, 2.4, 2.6
.fi
.PP
.nf
$ arp-fingerprint -o "-N -I eth1" 192.168.0.202
192.168.0.202 11110100000 FreeBSD 5.3, Win98, WinME, NT4, 2000, XP, 2003
.fi
.SH NOTES
.B arp-fingerprint
is implemented in Perl, so you need to have the Perl interpreter installed on
your system to use it.
.SH "SEE ALSO"
.TP
.BR arp-scan (1)
.PP
.I http://www.royhills.co.uk/wiki/
The arp-scan wiki page.
arp-scan-1.10.0/arp-scan.1.dist 0000664 0000000 0000000 00000050133 14345150431 0016027 0 ustar 00root root 0000000 0000000 '\" te
.\" Copyright (C) Roy Hills
.\"
.\" Copying and distribution of this file, with or without modification,
.\" are permitted in any medium without royalty provided the copyright
.\" notice and this notice are preserved.
.\"
.TH ARP-SCAN 1 "November 9, 2022"
.\" Please adjust this date whenever revising the man page.
.SH NAME
arp-scan \- Send ARP requests to target hosts and display responses
.SH SYNOPSIS
.B arp-scan
.RI [ options ] " " [ hosts ...]
.PP
Target hosts must be specified on the command line unless the \fB--file\fP or
\fB--localnet\fP option is used.
.PP
Targets can be IPv4 addresses or hostnames. You can also use CIDR notation
(10.0.0.0/24) (network and broadcast included), ranges (10.0.0.1-10.0.0.10),
and network:mask (10.0.0.0:255.255.255.0).
.SH DESCRIPTION
\fBarp-scan\fP sends ARP request packets to the specified hosts and displays
any responses received. The network interface can be specified with the
\fB--interface\fP option. If no interface is specified, \fBarp-scan\fP
will pick the lowest numbered, configured up interface (excluding loopback).
.PP
\fBarp-scan\fP uses raw sockets, which requires privileges on some systems:
.TP
Linux with POSIX.1e capabilities support using libcap:
\fBarp-scan\fP is capabilities aware. It requires \fICAP_NET_RAW\fP in the
permitted set and only enables that capability for the required functions.
use \fIsetcap cap_net_raw+p /path/to/arp-scan\fP to add CAP_NET_RAW to the
permitted set of the arp-scan executable.
Capabilities support also makes SUID root much safer because \fBarp-scan\fP
will drop all capabilities except CAP_NET_RAW and will not run with full root
privileges.
.TP
BSD and macOS:
You need read/write access to \fI/dev/bpf*\fP
.TP
Any operating system:
Running as root or SUID root will work on any OS but other methods are
preferable where possible.
.PP
ARP only operates on the local network, and cannot be routed.
Although the ARP protocol uses IPv4 addresses, it is not an
IP protocol and \fBarp-scan\fP can be used on interfaces without an
IPv4 address.
.PP
One ARP request is sent for each target. If a
host does not respond, the request will be re-sent once more. The number of
retries can be changed with the \fB--retry\fP option. Reducing the number of
retries will reduce the scanning time at the risk of missing some
results due to packet loss.
.PP
You can specify the bandwidth that \fBarp-scan\fP will use
with the \fB--bandwidth\fP option. The default is
256000 bits per second. Increasing the bandwidth will reduce scanning time,
but setting the bandwidth too high may cause a high broadcast packet rate.
Another way to specify the packet rate is with the \fB--interval\fP option.
.PP
The time for a single-pass scan (i.e. with \fB--retry\fP=1) is:
.PP
.EQ
time = n times i + t + o
.EN
.PP
Where \fIn\fP is the number of hosts, \fIi\fP is the interval
(given with \fB--interval\fP or calculated from
\fB--bandwidth\fP), \fIt\fP is the timeout (specified with
\fB--timeout\fP) and \fIo\fP is the overhead time taken to load the target
list and read the MAC/Vendor mapping files. The overhead is normally
negligible (typically around 100ms) but can be reduced further by the
\fB--quiet\fP option.
For small lists of hosts, the timeout value will dominate, but for large lists
the packet interval is the most important value.
.PP
Any part of the ARP request may be modified through the use of the
\fB--arpXXX\fP options as shown in the table below:
.TS
box;
cB S S S
LB | LB | LB | LB
L | L | L | L.
ARP Request Packet Options
=
Field Bits Option Default
=
ar$hrd 16 --arphrd 1 (ARPHRD_ETHER)
ar$pro 16 --arppro 0x0800
ar$hln 8 --arphln 6 (ETH_ALEN)
ar$pln 8 --arppln 4 (IPv4)
ar$op 16 --arpop 1 (ARPOP_REQUEST)
ar$sha 48 --arpsha interface h/w address
ar$spa 32 --arpspa interface IPv4 address
ar$tha 48 --arptha 00:00:00:00:00:00
ar$tpa 32 None target host IPv4 address
.TE
.\" We need two paragraphs under the table to get the correct spacing.
.PP
.PP
The most common option is \fB--arpspa\fP,
which sets the source IPv4 address in the ARP request, allowing
the ARP request to use a different source address from the
interface address. This allows the use of \fBarp-scan\fP
on interfaces with no IPv4 address.
Note: Setting \fIar$spa\fP to the target's IP address causes some operating
systems to report an address clash when they receive an ARP request for
their own address.
.PP
You can also change the values in the Ethernet frame header as shown below:
.TS
box;
cB S S S
LB | LB | LB | LB
L | L | L | L.
Ethernet Header Options
=
Field Bits Option Default
=
Dest Address 48 --destaddr ff:ff:ff:ff:ff:ff
Source Address 48 --srcaddr interface address
Protocol Type 16 --prototype 0x0806 (ARP)
.TE
.\" We need two paragraphs under the table to get the correct spacing.
.PP
.PP
The \fB--destaddr\fP option which sets the destination Ethernet address
is the only one that is commonly used.
.PP
By default, ARP responses are displayed in the following format:
.TS
;
L L L.
.TE
.PP
Where \fIIPv4 Address\fP is the IP address of the responding target,
\fIMAC Address\fP is its link-layer address and \fIVendor Details\fP
are the vendor details decoded from the hardware address. The output
fields are separated by a single tab character. You can change the
output format with the \fB--format\fP option.
.PP
The responses are displayed in the order they are received, which
can be different from the order the requests were sent because some
hosts may respond quicker than others.
.PP
The vendor decoding uses the files \fIieee-oui.txt\fP and \fImac-vendor.txt\fP.
\fIieee-oui.txt\fP is generated from the IEEE \fIMA-L\fP (OUI), \fIMA-M\fP,
\fIMA-S\fP (OUI36) and \fIIAB\fP registries.
\fImac-vendor.txt\fP contains additional MAC to Vendor mappings, and can be
used to add custom mappings. \fBget-oui\fP can be used to update
\fIieee-oui.txt\fP with the latest data from the IEEE registries.
.PP
All IPv4 hosts should respond to ARP request packets, including
hosts with packet filtering such as firewalls. This makes \fBarp-scan\fP
a useful tool to discover all active IPv4 hosts on the local network.
.SH OPTIONS
Where an option takes a value, that value is specified as a letter in
angle brackets. The letter indicates the type of data that is expected:
.IP \fB\fP
Character string.
.IP \fB\fP
Decimal integer, or hex if preceeded by 0x e.g. 2048 or 0x800.
.IP \fB\fP
Floating point decimal number.
.IP \fB\fP
MAC address, e.g. 01:23:45:67:89:ab or 01-23-45-67-89-ab (case insensitive)
.IP \fB\fP
IPv4 address e.g. 10.0.0.1
.IP \fB\fP
Hex encoded binary data. No leading 0x. (case insensitive).
.IP \fB\fP
Something else - see option description.
.SS "General Options"
.TP
.BR --help " or " -h
Display this usage message and exit.
.TP
.BR --verbose " or " -v
Display verbose progress messages.
Can be used than once to increase verbosity. Max=3.
.TP
.BR --version " or " -V
Display program version and exit.
Displays the version, license details, libpcap version,
and whether POSIX.1e capability support is included.
.TP
\fB--interface\fP=\fI\fP or \fB-I \fI\fR
Use network interface \fI\fP.
If this option is not specified, arp-scan will search
the system interface list for the lowest numbered,
configured up interface (excluding loopback).
.SS "Host Selection"
.TP
\fB--file\fP=\fI\fP or \fB-f \fI\fR
Read hostnames or addresses from the specified file.
One name or address pattern per line. Use "-" for stdin.
.TP
.BR --localnet " or " -l
Generate addresses from interface configuration.
Generates list from interface address and netmask
(network and broadcast included). You cannot use the
\fB--file\fP option or give targets on the command line.
Use \fB--interface\fP to specify the interface.
.SS "MAC/Vendor Mapping Files"
.TP
\fB--ouifile\fP=\fI\fP or \fB-O \fI\fR
Use IEEE registry vendor mapping file \fI\fP.
Default is \fIieee-oui.txt\fP in the current directory.
If that is not found \fI@PKGDATADIR@/ieee-oui.txt\fP is used.
.TP
\fB--macfile\fP=\fI\fP or \fB-m \fI\fR
Use custom vendor mapping file \fI\fP.
Default is \fImac-vendor.txt\fP in the current directory.
If that is not found \fI@PKGSYSCONFDIR@/mac-vendor.txt\fP is used.
.SS "Output Format Control"
.TP
.BR --quiet " or " -q
Display minimal output for each responding host.
Only the IP address and MAC address are displayed.
Reduces memory usage by about 5MB because the
vendor mapping files are not used.
Only the \fI${ip}\fP and \fI${mac}\fP fields are available for the \fB--format\fP
option if \fB--quiet\fP is specified.
.TP
.BR --plain " or " -x
Supress header and footer text. Only display the responding host details.
Useful if the output will be parsed by a script.
.TP
.BR --ignoredups " or " -g
Don't display duplicate packets.
By default duplicate packets are
flagged with \fI(DUP: n)\fP where \fIn\fP is the number of
times this host has responded.
.TP
.BR --rtt " or " -D
Calculate and display the packet round-trip time.
The time is displayed in milliseconds and fractional
microseconds. Makes the \fI${rtt}\fP field
available for \fB--format\fP.
.TP
\fB--format\fP=\fI\fP or \fB-F \fI\fR
Specify the output format string.
The format is a string that will be output for each
responding host. Host details can be included by inserting
references to fields using the syntax
"\fI${field[;width]}\fP". Fields are displayed right-
aligned unless the width is negative in which case
left alignment will be used. The following case-
insensitive field names are recognised:
.sp
.TS
L L .
IP Host IPv4 address in dotted quad format
Name Host name if \fB--resolve\fP option given
MAC Host MAC address xx:xx:xx:xx:xx:xx
HdrMAC Ethernet source addr if different
Vendor Vendor details string
Padding Padding after ARP packet in hex if nonzero
Framing Framing type if not Ethernet_II
VLAN 802.1Q VLAN ID if present
Proto ARP protocol if not 0x0800
DUP Packet number for duplicate packets (>1)
RTT Round trip time if \fB--rtt\fP option given
.TE
.sp
Only the \fI${ip}\fP and \fI${mac}\fP fields are available if the
\fB--quiet\fP option is specified.
.sp
Any characters that are not fields are output
verbatim. "\\" introduces escapes:
.sp
.TS
L L .
\\n newline
\\r carriage return
\\t tab
\\ suppress special meaning for following character
.TE
.sp
You should enclose the \fB--format\fP argument in 'single
quotes' to protect special characters from the shell.
.sp
Example: --format='${ip}\\t${mac}\\t${vendor}'
.SS "Host List Randomisation"
.TP
.BR --random " or " -R
Randomise the target host list.
.TP
\fB--randomseed\fP=\fI\fR
Seed the pseudo random number generator.
Useful if you want a reproducible \fB--random\fP order.
.SS "Output Timing and Retry"
.TP
\fB--retry\fP=\fI\fP or \fB-r \fI\fR
Set total number of attempts per host to \fI\fP,
default=2.
.TP
\fB--backoff\fP=\fI\fP or \fB-b \fI\fR
Set backoff factor to \fI\fP, default=1.50.
Multiplies timeout by \fI\fP for each pass.
.TP
\fB--timeout\fP=\fI\fP or \fB-t \fI\fR
Set initial per host timeout to \fI\fP ms, default=500.
This timeout is for the first packet sent to each host.
subsequent timeouts are multiplied by the backoff
factor which is set with \fB--backoff\fR.
.TP
\fB--interval\fP=\fI\fP or \fB-i \fI\fR
Set minimum packet interval to \fI\fP.
This controls the outgoing bandwidth usage by limiting
the packet rate. If you want to use up to a given
bandwidth it is easier to use the --bandwidth option
instead. The interval is in milliseconds, or
microseconds if "u" is appended.
.TP
\fB--bandwidth\fP=\fI\fP or \fB-B \fI\fR
Set outbound bandwidth to \fI\fP, default=256000.
The value is in bits per second. Append \fIK\fP for
kilobits or \fIM\fP for megabits (decimal multiples). You
cannot specify both \fB--interval\fP and \fB--bandwidth\fP.
.SS "DNS Resolution"
.TP
.BR --numeric " or " -N
Targets must be IP addresses, not hostnames.
Can reduce startup time for large target lists.
.TP
.BR --resolve " or " -d
Resolve responding addresses to hostnames.
The default output format will display the hostname
instead of the IPv4 address. This option makes the
\fI${name}\fP field available for the \fB--format\fP option.
.SS "Output ARP Packet"
.TP
\fB--arpsha\fP=\fI\fP or \fB-u \fI\fR
Set the ARP source Ethernet address.
Sets the 48-bit \fIar$sha\fP field
but does not change the hardware address in the frame
header, see \fB--srcaddr\fP for how to change
that address. Default is the Ethernet address of
the outgoing interface.
.TP
\fB--arptha\fP=\fI\fP or \fB-w \fI\fR
Set the ARP target Ethernet address.
Sets the 48-bit \fIar$tha\fP field.
The default is zero, because this field is not used
for ARP request packets.
.TP
\fB--arphrd\fP=\fI\fP or \fB-H \fI\fR
Set the ARP hardware type, default=\fI1\fP.
Sets the 16-bit \fIar$hrd\fP field.
The default is \fI1\fP (\fIARPHRD_ETHER\fP). Many
operating systems also respond to \fI6\fP
(\fIARPHRD_IEEE802\fP).
.TP
\fB--arppro\fP=\fI\fP or \fB-p \fI\fR
Set the ARP protocol type, default=\fI0x0800\fP.
Sets the 16-bit \fIar$pro\fP field.
Most operating systems only respond to \fI0x0800\fP (IPv4).
.TP
\fB--arphln\fP=\fI\fP or \fB-a \fI\fR
Set the hardware address length, default=\fI6\fP.
Sets the 8-bit \fIar$hln\fP field.
The lengths of the \fIar$sha\fP and \fIar$tha\fP
fields are not changed by this
option; it only changes the \fIar$hln\fP field.
.TP
\fB--arppln\fP=\fI\fP or \fB-P \fI\fR
Set the protocol address length, default=\fI4\fP.
Sets the 8-bit \fIar$pln\fP field.
The lengths of the \fIar$spa\fP and \fIar$tpa\fP
fields are not changed by this
option; it only changes the \fIar$pln\fP field.
.TP
\fB--arpop\fP=\fI\fP or \fB-o \fI\fR
Specify the ARP operation, default=\fI1\fP.
Sets the 16-bit \fIar$op\fP field.
Most operating systems only respond to the value 1
(ARPOP_REQUEST).
.TP
\fB--arpspa\fP=\fI\fP or \fB-s \fI\fR
Set the source IPv4 address.
The address should be in dotted quad format,
or the string "\fIdest\fP" which sets the source
address to the target host address.
The default is the outgoing interface address.
Sets the 32-bit \fIar$spa\fP field.
Some operating systems only respond if the source address
is within the network of the receiving interface.
Setting \fIar$spa\fP to the destination IP address
can cause some operating systems to report
an address clash.
.SS "Output Ethernet Header"
.TP
\fB--srcaddr\fP=\fI\fP or \fB-S \fI\fR
Set the source Ethernet MAC address.
Default is the interface MAC address. This sets the
address in the Ethernet header. It does not change the
address in the ARP packet: use \fB--arpsha\fP to
change that address.
.TP
\fB--destaddr\fP=\fI\fP or \fB-T \fI\fR
Set the destination MAC address.
Sets the destination address in the Ethernet
header. Default is \fIff:ff:ff:ff:ff:ff\fP (broadcast)
Hosts also respond if the request is sent to their
unicast address, or to a multicast address they
are listening on.
.TP
\fB--prototype\fP=\fI\fP or \fB-y \fI\fR
Sets the Ethernet protocol type, default=\fI0x0806\fP.
This sets the protocol type field in the Ethernet
header.
.TP
.BR --llc " or " -L
Use RFC 1042 LLC/SNAP encapsulation for 802.2 networks.
\fBarp-scan\fP will decode and display ARP responses in both
Ethernet-II and IEEE 802.2 formats irrespective of
this option.
.TP
\fB--vlan\fP=\fI\fP or \fB-Q \fI\fR
Use 802.1Q tagging with VLAN id \fI\fP.
The id should be in the range 0 to 4095. arp-scan will
decode and display ARP responses in 802.1Q format
irrespective of this option.
.SS "Misc Options"
.TP
\fB--limit\fP=\fI\fP or \fB-M \fI\fR
Exit after the specified number of hosts have responded.
\fBarp-scan\fP will exit with status 1 if the number of
responding hosts is less than the limit. Can be used
in scripts to check if fewer hosts respond without
having to parse the output.
.TP
\fB--pcapsavefile\fP=\fI\fP or \fB-W \fI\fR
Write received packets to pcap savefile \fI\fP.
ARP responses will be written to the specified file
as well as being decoded and displayed.
.TP
\fB--snap\fP=\fI\fP or \fB-n \fI\fR
Set the pcap snap length to \fI\fP. Default=64.
Specifies the frame capture length, including the
Ethernet header. The default is normally sufficient.
.TP
\fB--retry-send\fP=\fI\fP or \fB-Y \fI\fR
Set number of send attempts, default=20.
.TP
\fB--retry-send-interval\fP=\fI\fP or \fB-E \fI\fR
Set interval between send attempts.
Interval is in milliseconds or microseconds if "u"
is appended. default=5.
.TP
\fB--padding\fP=\fI\fP or \fB-A \fI\fR
Specify padding after packet data.
Set padding after the ARP request to hex value .
.SH "EXIT STATUS"
\fBarp-scan\fP will exit with 0 on successful completion or >0 if an error was encountered.
.PP
If the \fI--limit\fP option is specified, \fBarp-scan\fP will also exit with
a non-zero exit code if the number of responding hosts is less than the
specified limit.
.SH FILES
.TP
.I @PKGDATADIR@/ieee-oui.txt
List of IEEE OUI (Organisationally Unique Identifier) to vendor mappings.
.TP
.I @PKGSYSCONFDIR@/mac-vendor.txt
List of other Ethernet MAC to vendor mappings, including local additions.
.SH EXAMPLES
.SS "Simple Scan"
Scan the default network using the interface IPv4 configuration to generate
the list of hosts to scan.
.PP
.nf
$ arp-scan --localnet
Interface: eth0, type: EN10MB, MAC: 50:65:f3:f0:6d:7c, IPv4: 10.0.0.106
Starting arp-scan 1.9.9 with 256 hosts (https://github.com/royhills/arp-scan)
10.0.0.14 a4:1f:72:7f:25:bb Dell Inc.
10.0.0.22 10:60:4b:73:43:de Hewlett Packard
10.0.0.74 00:0c:29:90:07:e9 VMware, Inc.
10.0.0.75 00:0c:29:66:9e:c2 VMware, Inc.
10.0.0.76 00:0c:29:d0:e1:ea VMware, Inc.
10.0.0.82 9c:b6:54:bb:f3:ec Hewlett Packard
10.0.0.84 00:21:9b:fd:b9:b3 Dell Inc.
10.0.0.85 00:02:b3:eb:5a:f8 Intel Corporation
10.0.0.91 00:9c:02:a5:7b:29 Hewlett Packard
10.0.0.92 d4:ae:52:d0:07:6f Dell Inc.
10.0.0.93 d4:ae:52:d0:04:9b Dell Inc.
10.0.0.96 9c:b6:54:bb:f5:35 Hewlett Packard
10.0.0.97 00:0c:29:0e:95:20 VMware, Inc.
10.0.0.104 50:65:f3:f0:70:a4 Hewlett Packard
15 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.9: 256 hosts scanned in 1.532 seconds (167.10 hosts/sec). 14 responded
.fi
.SS "Output Formatting"
Scan all hosts in \fI10.0.0.0/24\fP using interface \fIeth0\fP. Calculate round-trip time and display in aligned columns using a custom format.
.PP
.nf
$ arp-scan -I eth0 --rtt --format='|${ip;-15}|${mac}|${rtt;8}|' 10.0.0.0/24
Interface: eth0, type: EN10MB, MAC: 50:65:f3:f0:6d:7c, IPv4: 10.0.0.106
Starting arp-scan 1.9.9 with 256 hosts (https://github.com/royhills/arp-scan)
|10.0.0.14 |a4:1f:72:7f:25:bb| 0.280|
|10.0.0.22 |10:60:4b:73:43:de| 0.293|
|10.0.0.74 |00:0c:29:90:07:e9| 0.380|
|10.0.0.75 |00:0c:29:66:9e:c2| 0.311|
|10.0.0.76 |00:0c:29:d0:e1:ea| 0.326|
|10.0.0.82 |9c:b6:54:bb:f3:ec| 0.216|
|10.0.0.84 |00:21:9b:fd:b9:b3| 0.244|
|10.0.0.85 |00:02:b3:eb:5a:f8| 0.244|
|10.0.0.91 |00:9c:02:a5:7b:29| 0.209|
|10.0.0.92 |d4:ae:52:d0:07:6f| 0.289|
|10.0.0.93 |d4:ae:52:d0:04:9b| 0.278|
|10.0.0.96 |9c:b6:54:bb:f5:35| 0.255|
|10.0.0.97 |00:0c:29:0e:95:20| 0.288|
|10.0.0.104 |50:65:f3:f0:70:a4| 0.263|
14 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.9: 256 hosts scanned in 2.032 seconds (125.98 hosts/sec). 14 responded
.fi
.SS "CSV Output"
\fB--plain\fP removes extraneous output.
.PP
.nf
$ arp-scan -I eth0 --plain --format='${ip},${mac},"${vendor}"' 10.0.0.0/24
10.0.0.14,a4:1f:72:7f:25:bb,"Dell Inc."
10.0.0.22,10:60:4b:73:43:de,"Hewlett Packard"
10.0.0.74,00:0c:29:90:07:e9,"VMware, Inc."
10.0.0.75,00:0c:29:66:9e:c2,"VMware, Inc."
10.0.0.76,00:0c:29:d0:e1:ea,"VMware, Inc."
10.0.0.82,9c:b6:54:bb:f3:ec,"Hewlett Packard"
10.0.0.84,00:21:9b:fd:b9:b3,"Dell Inc."
10.0.0.85,00:02:b3:eb:5a:f8,"Intel Corporation"
10.0.0.91,00:9c:02:a5:7b:29,"Hewlett Packard"
10.0.0.92,d4:ae:52:d0:07:6f,"Dell Inc."
10.0.0.93,d4:ae:52:d0:04:9b,"Dell Inc."
10.0.0.96,9c:b6:54:bb:f5:35,"Hewlett Packard"
10.0.0.97,00:0c:29:0e:95:20,"VMware, Inc."
10.0.0.104,50:65:f3:f0:70:a4,"Hewlett Packard"
.fi
.SH "SEE ALSO"
.BR get-oui (1)
.PP
.BR arp-fingerprint (1)
.PP
.I http://www.royhills.co.uk/wiki/
The arp-scan wiki page.
.PP
.I https://github.com/royhills/arp-scan
The arp-scan homepage.
arp-scan-1.10.0/arp-scan.c 0000664 0000000 0000000 00000300311 14345150431 0015143 0 ustar 00root root 0000000 0000000 /*
* arp-scan is Copyright (C) 2005-2022 Roy Hills
*
* This file is part of arp-scan.
*
* arp-scan is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* arp-scan is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with arp-scan. If not, see .
*
* arp-scan -- Send ARP requests to network hosts and display responses
*
* Author: Roy Hills
* Date: 13 October 2005
*
* Usage:
* arp-scan [options] [host...]
*
* Description:
*
* arp-scan sends the specified ARP packet to the specified hosts
* and displays any responses received.
*
* The ARP protocol is defined in RFC 826 Ethernet Address Resolution Protocol
*
*/
#include "arp-scan.h"
/* Global variables */
static host_entry *helist = NULL; /* Array of host entries */
static host_entry **helistptr; /* Array of pointers to host entries */
static host_entry **cursor; /* Pointer to current host entry ptr */
static unsigned num_hosts = 0; /* Number of entries in the list */
static unsigned responders = 0; /* Number of hosts which responded */
static unsigned live_count; /* Number of entries awaiting reply */
static int verbose = 0; /* Verbose level */
static char *filename; /* Target list file name */
static int filename_flag = 0; /* Set if using target list file */
static int random_flag = 0; /* Randomise the list */
static int numeric_flag = 0; /* IP addresses only */
static unsigned interval = 0; /* Desired interval between packets */
static unsigned bandwidth = DEFAULT_BANDWIDTH; /* Bandwidth in bits per sec */
static unsigned retry = DEFAULT_RETRY; /* Number of retries */
static unsigned timeout = DEFAULT_TIMEOUT; /* Per-host timeout */
static float backoff_factor = DEFAULT_BACKOFF_FACTOR; /* Backoff factor */
static int snaplen = SNAPLEN; /* Pcap snap length */
static char *if_name = NULL; /* Interface name, e.g. "eth0" */
static int quiet_flag = 0; /* Don't decode the packet */
static int ignore_dups = 0; /* Don't display duplicate packets */
static uint32_t arp_spa; /* Source IP address */
static int arp_spa_flag = 0; /* Source IP address specified */
static int arp_spa_is_tpa = 0; /* Source IP is dest IP */
static unsigned char arp_sha[ETH_ALEN]; /* Source Ethernet MAC Address */
static int arp_sha_flag = 0; /* Source MAC address specified */
static char *ouifilename = NULL; /* OUI filename */
static char *macfilename = NULL; /* MAC filename */
static char *pcap_savefile = NULL; /* pcap savefile filename */
static int arp_op = DEFAULT_ARP_OP; /* ARP Operation code */
static int arp_hrd = DEFAULT_ARP_HRD; /* ARP hardware type */
static int arp_pro = DEFAULT_ARP_PRO; /* ARP protocol */
static int arp_hln = DEFAULT_ARP_HLN; /* Hardware address length */
static int arp_pln = DEFAULT_ARP_PLN; /* Protocol address length */
static int eth_pro = DEFAULT_ETH_PRO; /* Ethernet protocol type */
static unsigned char arp_tha[6] = {0, 0, 0, 0, 0, 0};
static unsigned char target_mac[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
static unsigned char source_mac[6];
static int source_mac_flag = 0;
static unsigned char *padding = NULL;
static size_t padding_len = 0;
static int localnet_flag = 0; /* Scan local network */
static int llc_flag = 0; /* Use 802.2 LLC with SNAP */
static int ieee_8021q_vlan = -1; /* Use 802.1Q VLAN tagging if >= 0 */
static int pkt_write_file_flag = 0; /* Write packet to file flag */
static int pkt_read_file_flag = 0; /* Read packet from file flag */
static char *pkt_filename = NULL; /* Read/Write packet to file filename */
static int write_pkt_to_file = 0; /* Write packet to file for debugging */
static int rtt_flag = 0; /* Display round-trip time */
static pcap_dumper_t *pcap_dump_handle = NULL; /* pcap savefile handle */
static int plain_flag = 0; /* Only show host information */
static int resolve_flag = 0; /* Resolve IP addresses to hostnames */
unsigned int random_seed = 0;
static unsigned retry_send = DEFAULT_RETRY_SEND; /* Number of send packet retries */
static unsigned retry_send_interval = DEFAULT_RETRY_SEND_INTERVAL; /* Interval in seconds between send packet retries */
static unsigned int host_limit = 0; /* Exit after n responders if nonzero */
static format_element *format = NULL; /* Output format linked list */
int
main(int argc, char *argv[]) {
struct timeval now;
struct timeval diff; /* Difference between two timevals */
int select_timeout; /* Select timeout */
uint64_t loop_timediff; /* Time since last packet sent in us */
uint64_t host_timediff; /* Time since last pkt sent to this host (us) */
struct timeval last_packet_time; /* Time last packet was sent */
int req_interval; /* Requested per-packet interval */
int cum_err = 0; /* Cumulative timing error */
struct timeval start_time; /* Program start time */
struct timeval end_time; /* Program end time */
struct timeval elapsed_time; /* Elapsed time as timeval */
double elapsed_seconds; /* Elapsed time in seconds */
int reset_cum_err;
int pass_no = 0;
int first_timeout = 1;
unsigned i;
char errbuf[PCAP_ERRBUF_SIZE];
struct bpf_program filter;
char *filter_string;
bpf_u_int32 netmask;
bpf_u_int32 localnet;
int datalink;
int ret_status = 0;
int pcap_fd; /* Pcap file descriptor */
unsigned char interface_mac[ETH_ALEN];
pcap_t *pcap_handle; /* pcap handle */
struct in_addr interface_ip_addr;
/*
* Limit process capabilities to the minimum necessary to run this program.
*
* If we have POSIX.1e capability support, this removes all capabilities
* from the effective set and reduces the capabilities in the permitted
* set to the minimum needed.
*
* If we do not have capability support, then drop any SUID root privs
* by setting the effective user id to the real uid.
*/
limit_capabilities();
/*
* Process options.
*/
process_options(argc, argv);
/*
* If we're not reading from a file, and --localnet was not specified, then
* die if no hosts were given as command line arguments.
*/
if (!filename_flag && !localnet_flag)
if ((argc - optind) < 1)
err_msg("ERROR: No target hosts on command line and neither --file or "
"--localnet options given");
/*
* Get program start time for statistics displayed on completion.
*/
Gettimeofday(&start_time);
/*
* Open the network device for reading with pcap, or the pcap file if we
* have specified --readpktfromfile. If we are writing packets to a binary
* file, then set pcap_handle to NULL as we don't need to read packets in
* this case.
*/
if (pkt_read_file_flag) {
if (!(pcap_handle = pcap_open_offline(pkt_filename, errbuf)))
err_msg("pcap_open_offline: %s", errbuf);
} else if (!pkt_write_file_flag) {
/*
* enable CAP_NET_RAW in the effective set if we have POSIX.1e capability
* support. If we don't have capability support then restore SUID root
* privs by setting the effective user id to the saved euid.
*/
set_capability(ENABLE);
/*
* Determine network interface to use. If the interface was specified
* with the --interface option then use that, otherwise use
* my_lookupdev() to pick a suitable interface.
*
*/
if (!if_name) {
if (!(if_name = my_lookupdev(errbuf))) {
err_msg("my_lookupdev: %s", errbuf);
}
}
if (!(pcap_handle = pcap_create(if_name, errbuf)))
err_msg("pcap_create: %s", errbuf);
if ((pcap_set_snaplen(pcap_handle, snaplen)) < 0)
err_msg("pcap_set_snaplen: %s", pcap_geterr(pcap_handle));
if ((pcap_set_promisc(pcap_handle, PROMISC)) < 0)
err_msg("pcap_set_promisc: %s", pcap_geterr(pcap_handle));
if ((pcap_set_immediate_mode(pcap_handle, 1)) < 0)
err_msg("pcap_set_immediate_mode: %s", pcap_geterr(pcap_handle));
if ((pcap_set_timeout(pcap_handle, TO_MS)) < 0) /* Is this still needed? */
err_msg("pcap_set_timeout: %s", pcap_geterr(pcap_handle));
ret_status = pcap_activate(pcap_handle);
if (ret_status < 0) { /* Error from pcap_activate() */
char *cp;
cp = pcap_geterr(pcap_handle);
if (ret_status == PCAP_ERROR)
err_msg("pcap_activate: %s", cp);
else if ((ret_status == PCAP_ERROR_NO_SUCH_DEVICE ||
ret_status == PCAP_ERROR_PERM_DENIED) && *cp != '\0')
err_msg("pcap_activate: %s: %s\n(%s)", if_name,
pcap_statustostr(ret_status), cp);
else
err_msg("pcap_activate: %s: %s", if_name,
pcap_statustostr(ret_status));
} else if (ret_status > 0) { /* Warning from pcap_activate() */
char *cp;
cp = pcap_geterr(pcap_handle);
if (ret_status == PCAP_WARNING)
warn_msg("pcap_activate: %s", cp);
else if (ret_status == PCAP_WARNING_PROMISC_NOTSUP && *cp != '\0')
warn_msg("pcap_activate: %s: %s\n(%s)", if_name,
pcap_statustostr(ret_status), cp);
else
warn_msg("pcap_activate: %s: %s", if_name,
pcap_statustostr(ret_status));
}
/*
* Obtain the MAC address for the selected interface, and use this
* as the default value for the source hardware addresses in the frame
* header and ARP packet if the user has not specified their values.
*/
get_hardware_address(if_name, interface_mac);
/*
* Disable CAP_NET_RAW in the effective set if we have POSIX.1e capability
* support. If we don't have capability support then drop SUID root
* privs by setting the effective user id to the real uid.
*/
set_capability(DISABLE);
/*
* Permanently remove all capabilities or SUID root privilege as we
* don't need any special privileges after this point.
*
* We disable all capabilities in both the effective and permitted sets
* if we have POSIX.1e capability support, otherwise we permanently drop
* SUID root privs by setting the user ID to the real user ID.
*/
drop_capabilities();
/*
* Die with an error if we can't get the MAC address, as this
* indicates that the interface doesn't have a MAC address, so is
* probably not a compatible interface type.
*/
if (interface_mac[0]==0 && interface_mac[1]==0 &&
interface_mac[2]==0 && interface_mac[3]==0 &&
interface_mac[4]==0 && interface_mac[5]==0) {
err_msg("ERROR: Could not obtain MAC address for interface %s",
if_name);
}
if (source_mac_flag == 0)
memcpy(source_mac, interface_mac, ETH_ALEN);
if (arp_sha_flag == 0)
memcpy(arp_sha, interface_mac, ETH_ALEN);
/*
* Obtain the interface IP address, and use that as the default value
* if the user has not manually specified the ARP source address.
*
* Give a warning and use 0.0.0.0 if the interface has no IP address.
*/
ret_status = get_source_ip(if_name, &interface_ip_addr);
if (arp_spa_flag == 0) {
if (ret_status == -1) {
warn_msg("WARNING: Could not obtain IP address for interface %s. "
"Using 0.0.0.0 for", if_name);
warn_msg("the source address, which may not be what you want.");
warn_msg("Either configure %s with an IP address, or manually "
"specify the address", if_name);
warn_msg("with the --arpspa option.");
}
memcpy(&arp_spa, &(interface_ip_addr.s_addr), sizeof(arp_spa));
}
} else {
pcap_handle = NULL;
}
/*
* If we are reading data with pcap, get and display the datalink details
*/
if (pcap_handle) {
if ((datalink = pcap_datalink(pcap_handle)) < 0)
err_msg("pcap_datalink: %s", pcap_geterr(pcap_handle));
if (!plain_flag) {
if (!pkt_read_file_flag) {
printf("Interface: %s, type: %s, "
"MAC: %.2x:%.2x:%.2x:%.2x:%.2x:%.2x, IPv4: %s\n",
if_name, pcap_datalink_val_to_name(datalink),
interface_mac[0], interface_mac[1], interface_mac[2],
interface_mac[3], interface_mac[4], interface_mac[5],
(interface_ip_addr.s_addr==0) ? "(none)" : my_ntoa(interface_ip_addr));
} else {
printf("Interface: pcap file\n");
}
}
if (datalink != DLT_EN10MB) {
warn_msg("WARNING: Unsupported datalink type");
}
}
/*
* If we are reading from a network device, then get the associated file
* descriptor and configure it, determine the interface IP network and
* netmask, and install a pcap filter to receive only ARP responses.
* If we are reading from a pcap file, or writing to a binary file, just
* set the file descriptor to -1 to indicate that it is not associated
* with a network device.
*/
if (!pkt_read_file_flag && !pkt_write_file_flag) {
if ((pcap_fd = pcap_get_selectable_fd(pcap_handle)) < 0)
err_msg("pcap_fileno: %s", pcap_geterr(pcap_handle));
if ((pcap_setnonblock(pcap_handle, 1, errbuf)) < 0)
err_msg("pcap_setnonblock: %s", errbuf);
if (pcap_lookupnet(if_name, &localnet, &netmask, errbuf) < 0) {
memset(&localnet, '\0', sizeof(localnet));
memset(&netmask, '\0', sizeof(netmask));
if (localnet_flag) {
warn_msg("ERROR: Could not obtain interface IP address and netmask");
err_msg("ERROR: pcap_lookupnet: %s", errbuf);
}
}
/*
* The pcap filter string selects packets addressed to the ARP source
* address that are Ethernet-II ARP packets, 802.3 LLC/SNAP ARP packets,
* 802.1Q tagged ARP packets or 802.1Q tagged 802.3 LLC/SNAP ARP packets.
*/
filter_string=make_message("ether dst %.2x:%.2x:%.2x:%.2x:%.2x:%.2x and "
"(arp or (ether[14:4]=0xaaaa0300 and "
"ether[20:2]=0x0806) or (ether[12:2]=0x8100 "
"and ether[16:2]=0x0806) or "
"(ether[12:2]=0x8100 and "
"ether[18:4]=0xaaaa0300 and "
"ether[24:2]=0x0806))",
arp_sha[0], arp_sha[1],
arp_sha[2], arp_sha[3],
arp_sha[4], arp_sha[5]);
if (verbose > 1)
warn_msg("DEBUG: pcap filter string: \"%s\"", filter_string);
if ((pcap_compile(pcap_handle, &filter, filter_string, OPTIMISE,
netmask)) < 0)
err_msg("pcap_compile: %s", pcap_geterr(pcap_handle));
free(filter_string);
if ((pcap_setfilter(pcap_handle, &filter)) < 0)
err_msg("pcap_setfilter: %s", pcap_geterr(pcap_handle));
} else { /* Reading packets from file */
pcap_fd = -1;
}
/*
* Open pcap savefile is the --pcapsavefile (-W) option was specified
*/
if (pcap_savefile) {
if (!(pcap_dump_handle = pcap_dump_open(pcap_handle, pcap_savefile))) {
err_msg("pcap_dump_open: %s", pcap_geterr(pcap_handle));
}
}
/*
* Check that the combination of specified options and arguments is
* valid.
*/
if (interval && bandwidth != DEFAULT_BANDWIDTH)
err_msg("ERROR: You cannot specify both --bandwidth and --interval.");
if (localnet_flag) {
if ((argc - optind) > 0)
err_msg("ERROR: You can not specify targets with the --localnet option");
if (filename_flag)
err_msg("ERROR: You can not specify both --file and --localnet options");
}
/*
* Create MAC/Vendor hash table if quiet is not in effect.
*/
if (!quiet_flag) {
char *fn;
int count;
if ((hcreate(HASH_TABLE_SIZE)) == 0)
err_sys("hcreate");
fn = get_mac_vendor_filename(ouifilename, PKGDATADIR, OUIFILENAME);
count = add_mac_vendor(fn);
if (verbose > 1 && count > 0)
warn_msg("DEBUG: Loaded %d IEEE OUI/Vendor entries from %s.",
count, fn);
free(fn);
fn = get_mac_vendor_filename(macfilename, PKGSYSCONFDIR, MACFILENAME);
count = add_mac_vendor(fn);
if (verbose > 1 && count > 0)
warn_msg("DEBUG: Loaded %d MAC/Vendor entries from %s.",
count, fn);
free(fn);
}
/*
* Populate the list from the specified file if --file was specified, or
* from the interface address and mask if --localnet was specified, or
* otherwise from the remaining command line arguments.
*/
if (filename_flag) { /* Populate list from file */
FILE *fp;
char line[MAXLINE];
char *cp;
if ((strcmp(filename, "-")) == 0) { /* Filename "-" means stdin */
fp = stdin;
} else {
if ((fp = fopen(filename, "r")) == NULL) {
err_sys("Cannot open %s", filename);
}
}
while (fgets(line, MAXLINE, fp)) {
for (cp = line; !isspace((unsigned char)*cp) && *cp != '\0'; cp++)
;
*cp = '\0';
add_host_pattern(line, timeout);
}
if (fp != stdin) {
fclose(fp);
}
} else if (localnet_flag) { /* Populate list from i/f addr & mask */
struct in_addr if_network;
struct in_addr if_netmask;
char *c_network;
char *c_netmask;
const char *cp;
char localnet_descr[32];
if_network.s_addr = localnet;
if_netmask.s_addr = netmask;
cp = my_ntoa(if_network);
c_network = make_message("%s", cp);
cp = my_ntoa(if_netmask);
c_netmask = make_message("%s", cp);
snprintf(localnet_descr, 32, "%s:%s", c_network, c_netmask);
free(c_network);
free(c_netmask);
if (verbose) {
warn_msg("Using %s for localnet", localnet_descr);
}
add_host_pattern(localnet_descr, timeout);
} else { /* Populate list from command line arguments */
argv = &argv[optind];
while (*argv) {
add_host_pattern(*argv, timeout);
argv++;
}
}
/*
* Check that we have at least one entry in the list.
*/
if (!num_hosts)
err_msg("ERROR: No hosts to process.");
/*
* If --writepkttofile was specified, open the specified output file.
*/
if (pkt_write_file_flag) {
write_pkt_to_file = open(pkt_filename, O_WRONLY|O_CREAT|O_TRUNC, 0666);
if (write_pkt_to_file == -1)
err_sys("open %s", pkt_filename);
}
/*
* Create and initialise array of pointers to host entries.
*/
helistptr = Malloc(num_hosts * sizeof(host_entry *));
for (i=0; i0; i--) {
r = (int)(genrand_real2() * i); /* 0<=r 1) {
warn_msg("DEBUG: pkt len=%zu bytes, bandwidth=%u bps, interval=%u us",
packet_out_len, bandwidth, interval);
}
}
/*
* Display initial message.
*/
if (!plain_flag) {
printf("Starting %s with %u hosts (https://github.com/royhills/arp-scan)\n",
PACKAGE_STRING, num_hosts);
}
/*
* Display the lists if verbose setting is 3 or more.
*/
if (verbose > 2)
dump_list();
/*
* Main loop: send packets to all hosts in order until a response
* has been received or the host has exhausted its retry limit.
*
* The loop exits when all hosts have either responded or timed out;
* or if the number of responders reaches host_limit when host_limit is
* non zero.
*/
reset_cum_err = 1;
req_interval = interval;
while (live_count && !(host_limit != 0 && responders >= host_limit)) {
/*
* Obtain current time and calculate deltas since last packet and
* last packet to this host.
*/
Gettimeofday(&now);
/*
* If the last packet was sent more than interval microseconds ago, we
* can potentially send a packet to the current host.
*/
timeval_diff(&now, &last_packet_time, &diff);
loop_timediff = (uint64_t)1000000*diff.tv_sec + diff.tv_usec;
if (loop_timediff >= (unsigned)req_interval) {
/*
* If the last packet to this host was sent more than the current
* timeout for this host us ago, then we can potentially send a packet
* to it.
*/
timeval_diff(&now, &((*cursor)->last_send_time), &diff);
host_timediff = (uint64_t)1000000*diff.tv_sec + diff.tv_usec;
if (host_timediff >= (*cursor)->timeout) {
if (reset_cum_err) {
cum_err = 0;
req_interval = interval;
reset_cum_err = 0;
} else {
cum_err += loop_timediff - interval;
if (req_interval >= cum_err) {
req_interval = req_interval - cum_err;
} else {
req_interval = 0;
}
}
select_timeout = req_interval;
/*
* If we've exceeded our retry limit, this host has timed out so
* remove it from the list. Otherwise increase the timeout by the
* backoff factor if this is not the first packet sent to this host
* and send a packet.
*/
if (verbose && (*cursor)->num_sent > pass_no) {
warn_msg("---\tPass %d complete", pass_no+1);
pass_no = (*cursor)->num_sent;
}
if ((*cursor)->num_sent >= retry) {
if (verbose > 1)
warn_msg("---\tRemoving host %s - Timeout",
my_ntoa((*cursor)->addr));
remove_host(cursor); /* Automatically calls advance_cursor() */
if (first_timeout) {
timeval_diff(&now, &((*cursor)->last_send_time), &diff);
host_timediff = (uint64_t)1000000*diff.tv_sec +
diff.tv_usec;
while (host_timediff >= (*cursor)->timeout && live_count) {
if ((*cursor)->live) {
if (verbose > 1)
warn_msg("---\tRemoving host %s - Catch-Up Timeout",
my_ntoa((*cursor)->addr));
remove_host(cursor);
} else {
advance_cursor();
}
timeval_diff(&now, &((*cursor)->last_send_time), &diff);
host_timediff = (uint64_t)1000000*diff.tv_sec +
diff.tv_usec;
}
first_timeout = 0;
}
Gettimeofday(&last_packet_time);
} else { /* Retry limit not reached for this host */
if ((*cursor)->num_sent)
(*cursor)->timeout *= backoff_factor;
send_packet(pcap_handle, *cursor, &last_packet_time);
advance_cursor();
}
} else { /* We can't send a packet to this host yet */
/*
* There is no point calling advance_cursor() here because if
* host n is not ready to send host n+1 will not be ready either.
*/
select_timeout = (*cursor)->timeout - host_timediff;
reset_cum_err = 1; /* Zero cumulative error */
} /* End If */
} else { /* We can't send a packet yet */
select_timeout = req_interval - loop_timediff;
} /* End If */
recvfrom_wto(pcap_fd, select_timeout, pcap_handle);
} /* End While */
if (!plain_flag) {
printf("\n"); /* Ensure we have a blank line */
}
clean_up(pcap_handle);
if (write_pkt_to_file)
close(write_pkt_to_file);
Gettimeofday(&end_time);
timeval_diff(&end_time, &start_time, &elapsed_time);
elapsed_seconds = (elapsed_time.tv_sec*1000 +
elapsed_time.tv_usec/1000) / 1000.0;
if (!plain_flag) {
printf("Ending %s: %u hosts scanned in %.3f seconds (%.2f hosts/sec). %u "
"responded\n",
PACKAGE_STRING, num_hosts, elapsed_seconds,
num_hosts/elapsed_seconds, responders);
}
/*
* exit with status 1 if host_limit has been set with the --limit option and
* the number of responding hosts is less than this limit. Otherwise exit
* with status 0.
*/
return (host_limit == 0 || responders >= host_limit) ? 0 : 1;
}
/*
* display_packet -- Check and display received packet
*
* Inputs:
*
* he The host entry corresponding to the received packet
* arpei ARP packet structure
* extra_data Extra data after ARP packet (padding)
* extra_data_len Length of extra data
* framing Framing type (e.g. Ethernet II, LLC)
* vlan_id 802.1Q VLAN identifier, or -1 if not 802.1Q
* frame_hdr The Ethernet frame header
* pcap_header The PCAP header struct
*
* Returns:
*
* None.
*
* This checks the received packet and displays details of what
* was received in the format: .
*/
void
display_packet(host_entry *he, arp_ether_ipv4 *arpei,
const unsigned char *extra_data, size_t extra_data_len,
int framing, int vlan_id, ether_hdr *frame_hdr,
const struct pcap_pkthdr *pcap_header) {
typedef struct {
const char *name;
char *value;
} field;
static field fields[NUMFIELDS] = {
{"IP",NULL}, {"Name",NULL}, {"MAC",NULL}, {"HdrMAC",NULL},
{"Vendor",NULL}, {"Padding",NULL}, {"Framing",NULL}, {"VLAN",NULL},
{"Proto",NULL}, {"DUP",NULL}, {"RTT",NULL}
};
static const id_name_map fields_map[] = {
{0, "IP"}, {1, "Name"}, {2, "MAC"},
{3, "HdrMAC"}, {4, "Vendor"}, {5, "Padding"},
{6, "Framing"}, {7, "VLAN"}, {8, "Proto"},
{9, "DUP"}, {10, "RTT"}, {-1, NULL} /* -1 marks end of list */
};
char *msg;
char *cp;
char *ga_err_msg;
int nonzero = 0;
unsigned i;
/*
* Assign output fields based on response packet and options.
*/
/*
* IP field, always present.
*/
fields[0].value = make_message("%s", my_ntoa(he->addr));
/*
* Name field, present if --resolve option given.
*/
if (resolve_flag) {
cp = get_host_name(he->addr, &ga_err_msg);
if (cp) {
fields[1].value = make_message("%s", cp);
} else {
warn_msg("WARNING: getnameinfo() failed for \"%s\": %s",
my_ntoa(he->addr), ga_err_msg);
}
}
/*
* MAC field, always present.
*/
fields[2].value = make_message("%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
arpei->ar_sha[0], arpei->ar_sha[1],
arpei->ar_sha[2], arpei->ar_sha[3],
arpei->ar_sha[4], arpei->ar_sha[5]);
/*
* HdrMAC field, present if source MAC in the ARP packet is different
* to source MAC in the Ethernet frame header.
*/
if ((memcmp(arpei->ar_sha, frame_hdr->src_addr, ETH_ALEN)) != 0) {
fields[3].value = make_message("%.2x:%.2x:%.2x:%.2x:%.2x:%.2x",
frame_hdr->src_addr[0], frame_hdr->src_addr[1],
frame_hdr->src_addr[2], frame_hdr->src_addr[3],
frame_hdr->src_addr[4], frame_hdr->src_addr[5]);
}
/*
* Vendor field, present if --quiet option not given
*/
if (!quiet_flag) {
/*
* Find vendor in hash table.
*
* We start with more specific matches (against larger parts of the
* hardware address), and work towards less specific matches until
* we find a match or exhaust all possible matches.
*/
char oui_string[13]; /* Space for full hw addr plus NULL */
const char *vendor = NULL;
int oui_end = 12;
ENTRY hash_query;
ENTRY *hash_result;
snprintf(oui_string, 13, "%.2X%.2X%.2X%.2X%.2X%.2X",
arpei->ar_sha[0], arpei->ar_sha[1], arpei->ar_sha[2],
arpei->ar_sha[3], arpei->ar_sha[4], arpei->ar_sha[5]);
while (vendor == NULL && oui_end > 1) {
oui_string[oui_end] = '\0'; /* Truncate oui string */
hash_query.key = oui_string;
hash_result = hsearch(hash_query, FIND);
if (hash_result) {
vendor = hash_result->data;
} else {
vendor = NULL;
}
oui_end--;
}
if (vendor)
fields[4].value = make_message("%s", vendor);
else
/* Check the second-least-significant bit of first octet */
if (arpei->ar_sha[0] & (1<<1))
fields[4].value = make_message("%s", "(Unknown: locally administered)");
else
fields[4].value = make_message("%s", "(Unknown)");
/*
* Padding field, present if --quiet option not given and frame padding
* is non zero
*/
/*
* Check that any data after the ARP packet is zero.
* If it is non-zero, and verbose is selected, then set the Padding
* field to the hex representation of the padding.
*/
if (extra_data_len > 0) {
const unsigned char *ucp = extra_data;
for (i=0; iar_pro) != 0x0800) {
fields[8].value = make_message("0x%04x", ntohs(arpei->ar_pro));
}
/*
* DUP field, present if this is not the first response from this host.
*/
if (he->num_recv > 1) {
fields[9].value = make_message("%u", he->num_recv);
}
/*
* RTT field, present if the --rtt option is given
*/
if (rtt_flag) {
struct timeval rtt;
struct timeval pcap_timestamp;
unsigned long rtt_us; /* round-trip time in microseconds */
/*
* We can't pass a pointer to pcap_header->ts directly to timeval_diff
* because it may not have the same size as a struct timeval.
* E.g. OpenBSD 5.1 on amd64.
*/
pcap_timestamp.tv_sec = pcap_header->ts.tv_sec;
pcap_timestamp.tv_usec = pcap_header->ts.tv_usec;
timeval_diff(&pcap_timestamp, &(he->last_send_time), &rtt);
rtt_us = rtt.tv_sec * 1000000 + rtt.tv_usec;
fields[10].value=make_message("%lu.%03lu", rtt_us/1000, rtt_us%1000);
}
} /* End if (!quiet_flag) */
/*
* Output fields.
*/
if (!format) { /* If --format option not given */
/*
* Output IP field or Name field depending on whether --resolve option
* was given.
*/
if (resolve_flag) {
msg = make_message("%s", fields[1].value);
} else {
msg = make_message("%s", fields[0].value);
}
/*
* Output MAC field
*/
cp = msg;
msg = make_message("%s\t%s", cp, fields[2].value);
free(cp);
/*
* Output HdrMAC field if present
*/
if (fields[3].value) {
cp = msg;
msg = make_message("%s (%s)", cp, fields[3].value);
free(cp);
}
/*
* Output Vendor field if present.
*/
if (fields[4].value) {
cp = msg;
msg = make_message("%s\t%s", cp, fields[4].value);
free(cp);
}
/*
* Output Padding field if present and --verbose is given
*/
if (fields[5].value && verbose) {
cp = msg;
msg = make_message("%s\tPadding=%s", cp, fields[5].value);
free(cp);
}
/*
* Output Framing field if present.
*/
if (fields[6].value) {
cp = msg;
if (framing == FRAMING_LLC_SNAP) {
msg = make_message("%s (%s)", cp, fields[6].value);
}
free(cp);
}
/*
* Output VLAN ID if the VLAN field is present.
*/
if (fields[7].value) {
cp = msg;
msg = make_message("%s (802.1Q VLAN=%s)", cp, fields[7].value);
free(cp);
}
/*
* Output Proto field if present.
*/
if (fields[8].value) {
cp = msg;
msg = make_message("%s (ARP Proto=%s)", cp, fields[8].value);
free(cp);
}
/*
* Output DUP field if present.
*/
if (fields[9].value) {
cp = msg;
msg = make_message("%s (DUP: %s)", cp, fields[9].value);
free(cp);
}
/*
* Output RTT field if present.
*/
if (fields[10].value) {
cp = msg;
msg = make_message("%s\tRTT=%s ms", cp, fields[10].value);
free(cp);
}
} else { /* --format option given */
format_element *fmt;
int idx;
msg = dupstr(""); /* Set msg to empty string */
for (fmt=format; fmt; fmt=fmt->next) {
if (fmt->type == FORMAT_FIELD) {
if ((idx=name_to_id(fmt->data, fields_map)) != -1 &&
fields[idx].value) {
cp = msg;
msg = make_message("%s%*s", cp, fmt->width, fields[idx].value);
free(cp);
} else { /* Field name not found in map */
warn_msg("WARNING: Field ${%s} unknown or not available",
fmt->data);
}
} else if (fmt->type == FORMAT_STRING) {
cp = msg;
msg = make_message("%s%s", cp, fmt->data);
free(cp);
}
}
}
/*
* Display the message on stdout.
*/
printf("%s\n", msg);
free(msg);
for (i=0; iaddr.s_addr;
}
} else {
arpei.ar_sip = arp_spa;
}
if (he)
arpei.ar_tip = he->addr.s_addr;
/*
* Copy the required data into the output buffer "buf" and set "buflen"
* to the number of bytes in this buffer.
*/
marshal_arp_pkt(buf, &frame_hdr, &arpei, &buflen, padding, padding_len);
/*
* If host entry pointer is NULL, just return with the packet length.
*/
if (he == NULL)
return buflen;
/*
* Check that the host is live. Complain if not.
*/
if (!he->live) {
warn_msg("***\tsend_packet called on non-live host: SHOULDN'T HAPPEN");
return 0;
}
/*
* Update the last send times for this host.
*/
Gettimeofday(last_packet_time);
he->last_send_time.tv_sec = last_packet_time->tv_sec;
he->last_send_time.tv_usec = last_packet_time->tv_usec;
he->num_sent++;
/*
* If we are using the undocumented --readpktfromfile option, don't send
* anything and just return with the number of bytes we would have sent.
*/
if (pkt_read_file_flag) {
return buflen;
}
/*
* Send the packet.
*/
if (verbose > 1)
warn_msg("---\tSending packet #%u to host %s tmo %d", he->num_sent,
my_ntoa(he->addr), he->timeout);
if (write_pkt_to_file) { /* Writing to file */
nsent = write(write_pkt_to_file, buf, buflen);
} else { /* Send packet to Ethernet adaptor */
to.tv_sec = retry_send_interval/1000000;
to.tv_usec = (retry_send_interval - 1000000*to.tv_sec);
for (i=0; i= 0) { /* Successfully sent packet */
break;
} else if (errno != EAGAIN) { /* Unrecoverable error */
err_sys("ERROR: failed to send packet");
}
if (retry_send_interval > 0) {
if (verbose)
warn_msg("---\tRetrying send after %d microsecond delay (#%d of %d)",
retry_send_interval, i, retry_send);
n = select(0, NULL, NULL, NULL, &to); /* Delay */
if (n < 0) {
err_sys("select");
}
}
}
}
if (nsent < 0)
err_sys("ERROR: failed to send packet");
return buflen;
}
/*
* clean_up -- Protocol-specific Clean-Up routine.
*
* Inputs:
*
* None.
*
* Returns:
*
* None.
*
* This is called once after all hosts have been processed. It can be
* used to perform any tidying-up or statistics-displaying required.
*/
void
clean_up(pcap_t *pcap_handle) {
struct pcap_stat stats;
if (!plain_flag) {
if (pcap_handle && !pkt_read_file_flag) {
if ((pcap_stats(pcap_handle, &stats)) < 0)
err_msg("pcap_stats: %s", pcap_geterr(pcap_handle));
printf("%u packets received by filter, %u packets dropped by kernel\n",
stats.ps_recv, stats.ps_drop);
}
}
if (pcap_dump_handle) {
pcap_dump_close(pcap_dump_handle);
}
if (pcap_handle) {
pcap_close(pcap_handle);
}
}
/*
* usage -- display usage message and exit
*
* Inputs:
*
* None
*
* Returns:
*
* None (this function never returns).
*/
void
usage(void) {
printf("Usage: arp-scan [options] [hosts...]\n");
printf("\n");
printf("Target hosts must be specified on the command line unless the --file or\n");
printf("--localnet option is used.\n");
printf("\n");
printf("arp-scan uses raw sockets, which requires privileges on some systems:\n");
printf("\n");
printf("Linux with POSIX.1e capabilities support using libcap:\n");
printf(" arp-scan is capabilities aware. It requires CAP_NET_RAW in the permitted\n");
printf(" set and only enables that capability for the required functions.\n");
printf("BSD and macOS:\n");
printf(" You need read/write access to /dev/bpf*\n");
printf("Any operating system:\n");
printf(" Running as root or SUID root will work on any OS but other methods\n");
printf(" are preferable where possible.\n");
printf("\n");
printf("Targets can be IPv4 addresses or hostnames. You can also use CIDR notation\n");
printf("(10.0.0.0/24) (network and broadcast included), ranges (10.0.0.1-10.0.0.10),\n");
printf("and network:mask (10.0.0.0:255.255.255.0).\n");
printf("\n");
printf("Options:\n");
printf("\n");
printf("The data type for option arguments is shown by a letter in angle brackets: \n");
printf("\n");
printf(" Character string.\n");
printf(" Decimal integer, or hex if preceeded by 0x e.g. 2048 or 0x800.\n");
printf(" Floating point decimal number.\n");
printf(" MAC address, e.g. 01:23:45:67:89:ab or 01-23-45-67-89-ab (case insensitive)\n");
printf(" IPv4 address e.g. 10.0.0.1\n");
printf(" Hex encoded binary data. No leading 0x. (case insensitive).\n");
printf(" Something else - see option description.\n");
printf("\n");
printf("General Options:\n");
printf("\n--help or -h\t\tDisplay this usage message and exit.\n");
printf("\n--verbose or -v\t\tDisplay verbose progress messages.\n");
printf("\t\t\tCan be used than once to increase verbosity. Max=3.\n");
printf("\n--version or -V\t\tDisplay program version details and exit.\n");
printf("\t\t\tShows the version, license details, libpcap version,\n");
printf("\t\t\tand whether POSIX.1e capability support is included.\n");
printf("\n--interface= or -I Use network interface .\n");
printf("\t\t\tIf this option is not specified, arp-scan will search\n");
printf("\t\t\tthe system interface list for the lowest numbered,\n");
printf("\t\t\tconfigured up interface (excluding loopback).\n");
printf("\n");
printf("Host Selection:\n");
printf("\n--file= or -f \tRead hostnames or addresses from the specified file\n");
printf("\t\t\tOne name or address pattern per line. Use \"-\" for stdin.\n");
printf("\n--localnet or -l\tGenerate addresses from interface configuration.\n");
printf("\t\t\tGenerates list from interface address and netmask\n");
printf("\t\t\t(network and broadcast included). You cannot use the\n");
printf("\t\t\t--file option or give targets on the command line.\n");
printf("\t\t\tUse --interface to specify the interface.\n");
printf("\n");
printf("MAC/Vendor Mapping Files:\n");
printf("\n--ouifile= or -O \tUse IEEE registry vendor mapping file .\n");
printf("\t\t\tDefault is %s in the current directory. If\n", OUIFILENAME);
printf("\t\t\tthat is not found %s/%s\n", PKGDATADIR, OUIFILENAME);
printf("\t\t\tis used.\n");
printf("\n--macfile= or -m