Arp-scan option summary

This page gives a brief overview of the various arp-scan options. It does not go into detail - for that, see the help output or read the man pages.

Target selection options

Long Option	Short Option	Description
--file	-f	Read the list of targets from the specified file
--localnet	-l	Generate the list of targets from the outgoing interface address and netmask
--random	-R	Randomise the target list so hosts are scanned in a random order
--numeric	-N	Only allow IP addresses, no hostnames. Never perform DNS lookup

If neither the --file or --localnet options are specified, then targets must be specified as arguments. The target argument can either be a list of addresses or names, an IP network in the form <network>/<bits> or <network>:<netmask>, or a range of IP addresses in <start>-<end> format.

Network interface options

Long Option	Short Option	Description	Default
--interface	-I	Specify the network interface to use	First up, configured, non-loopback interface
--snap	-n	Specify the frame capture length	64 Bytes

Outgoing Ethernet Frame Options

Long Option	Short Option	Header Field	Default
--destaddr	-T	Destination Address	FF:FF:FF:FF:FF:FF (Ethernet broadcast)
--srcaddr	-S	Source Address	Outgoing interface address
--prototype	-y	Protocol Type	0x0806 (ARP)
--padding	-A	N/A	No padding (added by network driver)
--llc	-L	N/A	Ethernet-II Framing
--vlan	-Q	N/A	No 802.1Q tag

Outgoing ARP Packet Options

Long Option	Short Option	ARP Field	Default
--arphrd	-H	ar$hrd	1 (Ethernet)
--arppro	-p	ar$pro	0x0800 (IPv4)
--arphln	-a	ar$hln	6 (Ethernet address length)
--arppln	-P	ar$pln	4 (IPv4 address length)
--arpop	-o	ar$op	1 (ARP Request)
--arpsha	-u	ar$sha	Outgoing interface h/w address
--arpspa	-s	ar$spa	Outgoing interface IP address
--arptha	-w	ar$tha	zero (00:00:00:00:00:00)

The ARP field ar$tpa is set to the target IP address.

Outgoing packet timing options

Long Option	Short Option	Description	Default
--retry	-r	Total number of ARP request attempts for each target address	2
--timeout	-t	Timeout in milliseconds	500
--interval	-i	Inter-packet interval	Calculated from bandwidth
--bandwidth	-B	Outbound Bandwidth	256,000 bits/sec
--backoff	-b	Timeout backoff factor	1.5

Received packet decoding and display options

Long Option	Short Option	Description
--quiet	-q	Don't decode Vendor string
--ignoredups	-g	Don't display duplicate ARP responses
--ouifile	-O	Specify location of IEEE OUI MAC/Vendor file
--iabfile	-F	Specify location of IEEE OUI MAC/Vendor file
--macfile	-m	Specify location of manual MAC/Vendor file
--pcapsavefile	-W	Write received packets to pcap savefile
--rtt	-D	Display the packet round-trip time

Miscellanous Options

Long Option	Short Option	Description
--help	-h	Display usage message and exit
--verbose	-v	Display extra debugging information
--version	-V	Display arp-scan program version and exit