ARP! Tell your network to explain itself
36 points by benj
36 points by benj
arp-scan is also an excellent "well crap, I plugged my RPi in, but I have no idea what its IP is" tool. Much faster than needing to log into your router or whip out an IP scanner.
(Of course, if I was smarter, I'd just give it a static local IP, but alas...)
hehe, I hear you! nmap is way to slow for this, and what if my rpi firewal is blocking icmp? Then it digging into the router's DHCP leases... ugh!
It should be noted that ARP is IPv4 only. IPv6 has NDP which fulfills a similar role but in a different way. For example, arp-scan does not work with it but ip neigh mostly does.
Loved the way you wrote the article, I enjoyed a lot reading it!
Even if I already knew about arp-scan (it is awesome indeed!), I learnt a lot from the journey and the pointers to ARP spoofing + broadcast storms.
Previously I used proprietary software (Fing) which apparently works using ARP as well.
Thanks :-) I enjoy writing the most when it is akin to a discord chat I'd have with a friend dumping on him something I find cool! I need to be mindful of too many exclamation marks tho!
This made me think of Scotty/tkined, a cool Tcl based network management tool I used many years ago. I thought that ARP scans were one of the discovery methods we used but I think I was mistaken, it was just ICMP broadcasts and SNMP.
I was surprised to discover however that Flightaware maintains an active fork: https://github.com/flightaware/scotty
So, I can never remember what IP addresses I have given to devices on my network, or which IP my router has assigned to each one
i noticed the mikrotik mac in your arp table, so here's another tip: automatic dns entries for all (dhcp) devices on your network. :)
The RouterOS DHCP Server (MRDS) from MikroTik doesn’t natively support registering hostnames from DHCP leases to its DNS server.
That article is a bit outdated now :-)
RouterOS now has add-dns-entries and add-dns-entries-suffix settings in the DHCP server!
https://manual.mikrotik.com/docs/network-management/dhcp/server#dns-entries-for-clients
Ohh, finally! Personally, not a fan of long ttls. And i wonder how they handle conflicting hostnames.
I had some manually added entries that would conflict with the automatically generated one, and it seems in this case Mikrotik just doesn't add the new entry, so I'm guessing it operates on a first come first serve basis.
RouterOS now has add-dns-entries and add-dns-entries-suffix settings in the DHCP server!
Ah, leave it to Mikrotik to wait for 10 years before providing a solution to an incredibly demanded feature, and then half-ass it to the point where you'd rather it continued to not exist.
Still no equivalent to dnsmasq' ra-names, and even DHCPv6 AAAA support is pretty much DoA — DHCPv6 clients generally do not send FQDN options, and it does not seem to cross-query hostnames from the related DHCP server (like dnsmasq does).
Yes, ARP is not the right tool to introspect your network.
Unfortunately, most home networks use an ISP router that does not do DHCP/DNS properly. I set up dnsmasq as DHCP/DNS because it works properly (and I also need it to do VPN duties). I've seen some ISP routers show host names on their admin UI, though.
ARP is for dealing with MAC addresses. Unless you note them down, the only "information" they carry is a) there's a device using this MAC address b) the MAC address is in this manufacturer's range.