StaticDet5 wrote:OK, I had some weird results yesterday using arp, but didn't have them this morning. I initially started using arp, but I didn't seem to get all the systems that were on the network, therefore I started looking at nmap.
It seemed like I wasn't getting complete results using arp, unless I ran an nmap scan before, (nmap -sP) over the subnet.
That is how it should
work. ARP entries are cached, and you're viewing that cache with the arp command. Until your Pi has a reason to resolve the Layer 3 IP address to a Layer 2 MAC address, there won't be an entry for an IP address. When you ping an IP address, if there's not already an entry mapping the IP address to a MAC address in your Pi's arp cache, It sends and ARP request ("who has ip X.X.X.X?") and if the device with that IP is alive, it will respond with an ARP reply ("I have X.X.X.X and here's my MAC address"). The result is cached for a period of time, typically a few minutes. You can watch this in action with Wireshark.
You can, of course, just sniff traffic to map IP addresses to MAC addresses, but that assumes you'll see every device communicating. On a switch, you aren't guaranteed to see activity from other devices unless you try to talk to them directly or they send multicast or broadcast traffic that your switch forwards, or you configure a SPAN or monitor port to see all traffic. The ping sweep ensures that your device's ARP cache will have a recent match for every live IP device by communicating directly with each one (unicast). Without that ping sweep or other unicast communication, you'll have to wait until each device sends broadcast or multicast traffic that the switch forwards to you. For long-term passive monitoring, this might be acceptable.
You certainly don't have to use nmap
to do a ping sweep. You might want to check out the arpwatch
package from the repository, although it too resides in /usr/sbin so will require root. Same for arping
. Doing a simple ping sweep and checking the ARP table does not require root. arp -n
or ip neighbor
commands will work without root. Unfortunately, most modern device ignore ICMP ping broadcasts. Otherwise, you could use ping -b 255.255.255.255
to combine steps.
I'm still coming up to speed with python myself, but you should certainly be able to code a solution to do an ICMP ping request and check the response.