Re: How to get all arp entries for a certain network
From: Moe Trin (ibuprofin_at_painkiller.example.tld)
Date: Fri, 03 Sep 2004 13:37:38 -0500
In article <email@example.com>, Zahi Shahak wrote:
>How can I get my arp table to fill up with all the objects in a
>certain network(which I have the network/netmask). The only way I
>found is pinging all the objects in the network one by one....I know
>there's a better way.
Ping the broadcast (ping -b), but don't do this very much, as it can
generate a lot of traffic. And remember:
1. Some hosts will not respond to a broadcast ping, though they _will_
respond to a unicast ping (to their speciifc address).
2. Some hosts have firewalls configured to block/ignore pings.
A less invasive technique is to just run a sniffer like tcpdump
looking for ARP request/reply packets. I used to run an application
that monitored the ARP cache of the routers and DNS servers (then
comparing the results with a data base to detect "unusual" events)
for security purposes. 'arpwatch' is somewhat similar in function.