Arp Cache

[sirlollypop]

I am looking for a app that will be able to collect all of the ip address it can see on the network with their mac entries as well.

Currently I am using IPtools to do the ping sweep but it doesn’t list the macs as well.

Thanks

 

[burtsbees]

In just one network? After the ping sweep, try arp -a, or in a Cisco device, sh mac-add or sh arp...

Burt

 

[pansophic]

arpwatch is what you are looking for. It captures ARP broadcast messages and logs them. You can have it configured to send email messages to you each time a new MAC/IP address is added.

Look at:

http://24h.atspace.com/it/security/arpwatch.htm

There appear to be a couple of Windows ports of arpwatch.

http://sid.rstack.org/arp-sk/

You need to be running libpcap (WinPCAP) in order to listen for the ARP broadcasts, so you will need Administrator privileges to start PCAP.


pansophic

 

[VinceWhirlwind]

I use Solarwinds SwitchportMapper, but it isn't free.

 

[burtsbees]

Hell, you could span the ports on the main LAN switch ingress (LAN switchport) as input and output to a syslog or Wireshark, and set Wireshark to filter ARP traffic as one color, and ignore everything else, whatever. I have done that for STP, HTTP, SSH, etc.

/