How to Build an ARP Scanner Using Scapy and Python

Jun 27, 2015 07:18 AM

Jun 27, 2015 07:27 AM

As you might know, there are a multitude of tools used to discover internal IP addresses. Many of these tools use ARP, address resolution protocol, in order to find live internal hosts. If we could write a script using this protocol, we would be able to scan for hosts on a given network. This is where scapy and python come in, scapy has modules we can import into python, enabling us to construct some tools of our own, which is exactly what we'll be doing here.

Step 1: Open Your Text Editor of Choice and Let's Get Started!

First, we'll import some needed modules

import sys

from datetime import datetime

These aren't all the modules we need, but we'll import the rest later on.

Next, we'll set up some user input that we need to begin the scan

We place these within a try so that we can add an exception, this exception will be in case the user decides that they don't want to continue with the scan.

Now, we'll add that exception we talked about

Now, on to the actual scanning portion of the script!

We'll start this by telling the user we've started scanning, starting the clock for the total scan duration, importing the needed scapy modules, and beginning the scan.

We simply print that we've started the scan, and set the start-time variable equal to the current time, datetime.now()

Then, we imported the necessary modules from scapy

from scapy.all import srp,Ether,ARP,conf

We set the conf.verb variable equal to 0

conf.verb = 0

Now we start the scanning, we set two variables, ans and unans equal to srp(Ether(dst="ff:ff:ff:ff:ff:ff")/ARP(pdst = ips), timeout = 2, iface = interface, inter = 0.1). the series of f's and colons is the default broadcast address, we set the pdst variable equal to the range of IP address we prompted the user for in the beginning, timeout is set to two, iface gets set to the interface to got from the user before, and the inter variable is set to 0.1, this helps to avoid skipping packets.

Now that we have this information, all we need to do is go through it and present it to the user!

We print MAC - IP so that we can set up a format for the results to be displayed, we then use a for loop to iterate through the results and print the values, once we're through with that, we stop the clock for the scan duration by declaring another variable equal to datetime.now(). We find the total scan time by subtracting the two and print the result.