Re: nmap -sP does not populate arp table

[Michael Convey <smconvey () gmail com>]

On Wed, Feb 29, 2012 at 5:49 PM, Fyodor <fyodor () insecure org> wrote:

> On Wed, Feb 29, 2012 at 05:44:35PM -0800, Michael Convey wrote:
> > I used the command "nmap -sP" for host discovery, but also with the hope
> > that it would populate my host's ARP table. Although, I'm getting the
> > expected output from the nmap command, my ARP table is not being
> populated.
> > When I ping the hosts individually, the ARP table is populated.
> >
> > The following seems to imply that nmap -sn (formerly nmap -sP) sends ICMP
> > echo requests just like ping:
> >
> > http://nmap.org/book/man-host-discovery.html
> >
> > What am I doing wrong?
>
> Hi Michael.  By default on Linux and most other platforms, Nmap sends
> ARP requests on the LAN itself, so the OS doesn't add it to its ARP
> table.  However, if you run Nmap with the --send-ip option, Nmap uses
> the OS raw sockets interface and your ARP table should get populated.
>
> Cheers,
> -F

That worked, thank you. It did take more time than running without the
--send-ip argument. Does this use more bandwidth. Also, is it less
stealthy?
_______________________________________________
Sent through the nmap-dev mailing list
http://cgi.insecure.org/mailman/listinfo/nmap-dev
Archived at http://seclists.org/nmap-dev/