arp-scan-rs
A fast, minimalistic ARP scanner CLI written in Rust for discovering hosts on local networks.
What is arp-scan-rs?
arp-scan-rs is a command-line ARP scanner written in Rust that discovers active hosts on a local network. It provides a fast, efficient, and customizable alternative to traditional network scanning tools, focusing on minimalism and performance for network diagnostics and security assessments.
Network administrators, security professionals, and developers who need to perform local network discovery, diagnostics, or security assessments via ARP scanning.
Developers choose arp-scan-rs for its speed, extensive customization options (like adjustable timings, bandwidth limits, and ARP packet field tuning), and multiple output formats (JSON, YAML, CSV, plain text), offering a lightweight yet powerful tool without unnecessary bloat.
Overview
A minimalistic ARP scan tool written in Rust for fast local network scans
Use Cases
Best For
- Performing fast ARP scans to quickly discover active hosts on a local network.
- Customizing network scans with adjustable timings, bandwidth limits, retry counts, and interface selection.
- Identifying device manufacturers via MAC vendor lookup using IEEE OUI data or custom vendor files.
- Exporting scan results in structured formats like JSON, YAML, or CSV for further processing or reporting.
- Using pre-defined scan profiles (e.g., default, fast, stealth, chaos) for different scanning scenarios.
- Fine-tuning ARP packets with VLAN tagging, source/destination MAC/IP overrides, and other advanced customizations for specialized network diagnostics.
Not Ideal For
- Windows environments needing out-of-the-box network scanning without compilation or additional setup
- Comprehensive network audits requiring multi-protocol support (e.g., TCP, UDP, ICMP) beyond ARP
- Teams preferring graphical interfaces or web-based tools for network discovery and visualization
- Real-time network monitoring or continuous scanning workflows, as it's designed for one-off scans
Pros & Cons
Pros
Optimized for speed with efficient packet handling, as shown in examples where scans complete in seconds, like the 1.623-second scan in the README.
Offers adjustable timings (-t), bandwidth limits (-B), retry counts (-r), and ARP packet field tuning (e.g., --arp-op), allowing fine-grained control over scans.
Supports exports in JSON, YAML, CSV, and plain text via the -o option, enabling easy integration with other tools and reporting.
Identifies device manufacturers using IEEE OUI data, with support for custom vendor files (--oui-file), aiding in device identification as demonstrated in scan results.
Cons
Windows support is listed in the roadmap and not yet complete, making it less suitable for environments requiring seamless Windows operation without compilation.
Fine-tuning ARP packets with options like --hw-type or --proto-addr can lead to scan failures if misconfigured, requiring in-depth networking knowledge.
MAC vendor lookup requires downloading an external IEEE OUI file separately, adding an extra setup step and maintenance overhead.
While basic VLAN tagging is supported (-Q), the roadmap notes 'Complete VLAN support' is pending, which may limit use in complex network environments.
Frequently Asked Questions
Related Projects
rustscan🤖 The Modern Port Scanner 🤖
feroxbusterA fast, simple, recursive content discovery tool written in Rust.
rayhunterRust tool to detect cell site simulators on an orbic mobile hotspot
rustnetPer-process network monitoring for your terminal with deep packet inspection. Cross-platform, sandboxed.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.