How to Discover Devices and IP Addresses on Local Networks in Linux Using arp-scan

Auditing connected hosts on an Ethernet or Wi-Fi local area network (LAN) is a fundamental task for system administrators, network engineers, and home lab builders. While tools such as ping sweeps and nmap scans are commonplace, they often encounter obstacles: operating system firewalls frequently block ICMP echo requests, and network intrusion detection systems may flag aggressive TCP handshakes. Furthermore, standard ping utilities cannot reveal physical hardware identifiers or locate unconfigured network nodes.

The arp-scan command offers an exceptionally fast, low-overhead, and stealthy alternative. Operating strictly at Layer 2 (Data Link layer) using raw Address Resolution Protocol (ARP) packets, arp-scan bypasses host-based OS packet filters entirely. Every active network interface on an Ethernet segment is architecturally forced to respond to ARP broadcast requests to establish Layer 2 communication, allowing arp-scan to reveal every active workstation, printer, IoT sensor, and managed switch alongside their respective MAC addresses and vendor names.

Installing arp-scan on Linux

The arp-scan utility is readily packaged in the official repositories of all major Linux distributions.

On Debian, Ubuntu, and Linux Mint

sudo apt update && sudo apt install -y arp-scan

On Fedora, RHEL, and AlmaLinux

sudo dnf install -y arp-scan

On Arch Linux and Manjaro

sudo pacman -S arp-scan

Note: Because generating raw ARP frames requires root network privileges, all arp-scan execution commands require sudo or root execution.

Finding Your Active Network Interface

Before launching a network discovery scan, identify the exact network interface name bound to your local subnet using the ip command:

ip -br link show

Look for interfaces with an UP status, such as eth0, enp3s0 (wired Ethernet), or wlan0 (wireless Wi-Fi).

How to Scan the Local Subnet Using arp-scan

1. Automatic Local Subnet Discovery

The most straightforward method to survey your entire local subnet is using the --localnet (or -l) switch:

sudo arp-scan --localnet

This command queries your network stack for the primary IP address and subnet mask of the default interface, automatically constructs ARP request frames for every potential host address within the CIDR block, and parses the inbound replies.

2. Targeting a Specific Network Interface

If your system features multiple network adapters (such as physical Ethernet alongside a virtual machine bridge), explicitly designate the target interface using the -I flag:

sudo arp-scan -I enp3s0 --localnet

3. Scanning a Custom IP Subnet or Range

If you want to probe an isolated VLAN or distinct CIDR network block rather than relying on automatic configuration, supply the CIDR subnet notation directly:

sudo arp-scan -I eth0 192.168.10.0/24

You can also define discrete IP address ranges:

sudo arp-scan -I eth0 10.0.0.50-10.0.0.100

Understanding arp-scan Terminal Output

When arp-scan completes its sweep, it prints a clean tabular output similar to the following:

Interface: enp3s0, type: EN10MB, MAC: 52:54:00:12:34:56, IPv4: 192.168.1.105
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.1.1     00:11:32:89:ab:cd   Synology Incorporated
192.168.1.50    b8:27:eb:14:52:19   Raspberry Pi Foundation
192.168.1.65    3c:22:fb:45:90:12   Apple, Inc.
192.168.1.120   e4:5f:01:2b:88:94   Raspberry Pi Trading Ltd
192.168.1.200   70:4f:57:6d:31:c2   Intel Corporate

5 packets received by filter, 0 packets dropped by kernel
Ending arp-scan: 256 hosts scanned in 1.482 seconds (172.74 hosts/sec). 5 responded

The output columns display:

• IP Address: The assigned IPv4 address responding on the wire.
• MAC Address: The unique 48-bit Media Access Control hardware identifier.
• Vendor String: The hardware manufacturer resolved from the IEEE Organizationally Unique Identifier (OUI) database.

Advanced arp-scan Techniques and Options

Updating the Hardware Vendor Database

To ensure newly manufactured network cards and IoT chips are accurately categorised by vendor name, update the local IEEE OUI database using the companion script:

sudo get-oui -v

Adjusting Bandwidth and Packet Timing

On delicate embedded networks or saturated wireless links, high-speed ARP sweeps can cause packet loss or trigger network alarms. Throttle packet generation with --bandwidth (bits per second) or --interval (milliseconds between frames):

sudo arp-scan -I wlan0 --localnet --bandwidth=256000

Suppressing Scanner Headers and Footers for Shell Scripting

When feeding active IP addresses into automated deployment pipelines or monitoring scripts, suppress introductory text using --quiet (-q) and omit decorative borders:

sudo arp-scan -I eth0 --localnet --plain -q | awk '{print $1, $2}'

Troubleshooting Common arp-scan Pitfalls

• Cannot Scan Across Routers: Remember that ARP packets do not traverse Layer 3 network boundaries. You cannot use arp-scan to discover hosts across a remote WAN, internet connection, or routed subnet without a local presence or Layer 2 relay.
• Wireless Interface Packet Filtering: Certain low-end Wi-Fi drivers or access points filter broadcast ARP responses to conserve wireless airtime. If wireless scans produce sparse results, run the scan via a wired Ethernet cable or test promiscuous mode via sudo ip link set wlan0 promisc on.
• Duplicate IP Address Warnings: If arp-scan flags (DUP: 2) next to a host, two distinct hardware interfaces share the same IP address on your network. This indicates an IP address collision or rogue DHCP assignment requiring prompt remediation.

Using arp-scan in Linux provides an indispensable, lightning-fast diagnostic technique for mapping local network infrastructure and detecting uninvited devices with pinpoint Layer 2 precision.