You previously probably used this on smaller networks. That means that it will hold some values that are probably needed soon, but can be discarded to make place for others.Ī /21 Network has 2048 addresses, so some of them are removed from the cache to free slots for other entries.

What's going on here? Why isn't arp showing what nmap is showing? Is nmap perhaps not populating the cache correctly?Īnother thing I've noticed, using the arp-scan utility shows everything that nmap finds I have tried increasing the timeout of items in the arp cache by doing the following echo '.gc_stale_time=600' | sudo tee -a /etc/nfĮcho '.base_reachable_time_ms=1200000' | sudo tee -a /etc/nfīut this doesn't seem to make a difference. (note that both of these outputs are incomplete)Įssentially, nmap shows the IP/MAC of items that are either entirely missing from the subsequent arp command dump or the IP is there but the MAC address is shown as (incomplete) I only get this, with many of the items shown in the prior scan missing Address HWtype HWaddress Flags Mask Ifaceġ0.199.206.73 ether f4:5c:89:XX:XX:XX C enp2s0ġ0.199.200.2 ether c2:ea:e4:XX:XX:XX C enp2s0ġ0.199.206.139 ether f4:5c:89:XX:XX:XX C enp2s0 MAC Address: 68:72:51:XX:XX:XX(Ubiquiti Networks)īut when I then immediately try to dump the arp cache /usr/sbin/arp MAC Address: 7C:AD:74:XX:XX:XX(Cisco Systems) MAC Address: FC:AA:14:XX:XX:XX(Giga-byte Technology)

This shows all of the devices it has found Starting Nmap 7.01 ( ) at 15:45 MDT This has generally worked rather well but I'm in a case now where this is not working. parse the arp-cache to get (IP-address, MAC-address) pairs of everything on the subnet.use the /usr/sbin/arp tool to dump the arp cache.use nmap to scan every item in the subnet to populate the arp cache.Powerful results, yet easy and intuitive to use. It was designed to allow you to customize your scan results once a device has been identified, you may assign it a custom icon and name to more easily recognize it at a glance. IP Scanner scans your local area network to determine the identity of all machines and Internet devices on the LAN.

Scan network mac address