Re: How to get all arp entries for a certain network

From: Moe Trin (ibuprofin_at_painkiller.example.tld)
Date: 09/03/04


Date: Fri, 03 Sep 2004 13:37:38 -0500

In article <5ea65e2.0409020732.6b3b682d@posting.google.com>, Zahi Shahak wrote:
>Hi,
>How can I get my arp table to fill up with all the objects in a
>certain network(which I have the network/netmask). The only way I
>found is pinging all the objects in the network one by one....I know
>there's a better way.

Ping the broadcast (ping -b), but don't do this very much, as it can
generate a lot of traffic. And remember:

1. Some hosts will not respond to a broadcast ping, though they _will_
respond to a unicast ping (to their speciifc address).

2. Some hosts have firewalls configured to block/ignore pings.

A less invasive technique is to just run a sniffer like tcpdump
looking for ARP request/reply packets. I used to run an application
that monitored the ARP cache of the routers and DNS servers (then
comparing the results with a data base to detect "unusual" events)
for security purposes. 'arpwatch' is somewhat similar in function.

        Old guy