ARP 모니터링 Tool

ARP 스캐닝하는 방법입니다.
저같은 경우는 SCAN 하려는 대상서버에 ping 한번 때려보고
# arp 명령어로 확인하곤 하는데… 여러 스캔도구들이 있어서 소개해드립니다.
설치 & 사용방법 상당히 간단합니다.

테스트 환경 : Ubuntu 14.04 LTS

• arp-scan
  # apt-get install arp-scan# arp-scan -I eth0 -l

※ 옵션설명
–localnet or -l
Generate addresses from network interface configuration.
Use the network interface IP address and network mask to generate the list of target host addresses.
The list will include the network and broadcast addresses, so an interface address of 10.0.0.1 with netmask 255.255.255.0 would generate 256 target hosts from 10.0.0.0 to 10.0.0.255 inclusive.
If you use this option, you cannot specify the –file option or specify any target hosts on the command line.
The interface specifications are taken from the interface that arp-scan will use, which can be changed with the –interface option.

–interface=<s> or -I
Use network interface.
If this option is not specified, arp-scan will search the system interface list for the lowest numbered, configured up interface (excluding loopback).
The interface specified must support ARP.

※ 1개의 IP에 2개이상의 MAC이 올라왔을경우…아래처럼 나타나게 됩니다.
1XX.XXX.XXX.31    0c:c4:7a:7a:16:3c    (Unknown) (DUP: 2)

다음은… netdiscover

• netdiscover – an active/passive arp reconnaissance tool
  # apt-get install netdiscover
  # netdiscover -r 192.168.0.0/24