This file gives a brief overview of the major changes between each arp-scan

release. For more details please read the ChangeLog file.

2019-10-13 arp-scan 1.9.6

* Use libpcap function pcap_set_immediate_mode() instead of ioctl calls to

ensure packets are delivered immediately. This means that arp-scan now

requires libpcap 1.5.0 or later and will not work with earlier libpcap

versions.

2016-09-03 arp-scan 1.9.5

* Use posix hash table functions hcreate(), hsearch() and hdestroy() instead

of the gas hash table code. Thanks to nihilus for the suggestion.

* Remove function replacement for inet_aton, as this was only required for

Solaris 8, which is now considered obsolete.

* Added arp-fingerprint patterns for FreeBSD 10.3, DragonflyBSD 4.6, Windows10,

Linux 4.0, Linux 4.6, OpenBSD 5.9, NetBSD 7.0.

* Added "-l" option to arp-fingerprint to support fingerpringing all hosts on

the local network. Thanks to Rhig for the pull request.

* Use the source_mac rather than interface_mac in the pcap filter, to permit

reception of packets with spoofed MAC source address. Thanks to tissieres

for the pull request.

* Use the libpcap 1.0 API functions pcap_create() instead of pcap_open_live().

This means that arp-scan now requires libpcap 1.0 or later and will not work

with earlier libpcap versions.

* Updated IEEE OUI and IAB download locations to reflect IEEE website changes.

* Updated IEEE OUI and IAB MAC/Vendor files. There are now 22487 OUI entries

and 4575 IAB entries.

2013-11-24 arp-scan 1.9.2

* Added new --plain (-x) option to surpress printing of header and footer text,

and only display one output line for each responding host. Idea from Stefan

Tomanek's arp-scan fork on github at https://github.com/wertarbyte/arp-scan.

* Use LWP::UserAgent instead of LWP::Simple in get-oui and get-iab to enable

the raw content to be obtained, which avoids Unicode/UTF-8 issues.

* Added arp-fingerprint patterns for WIZnet W5100 and Cisco IOS 15.0.

* Moved arp-scan development from internal SVN repository to github at

https://github.com/royhills/arp-scan. The move to git means that the commit

object names are now SHA1 hashes instead of increasing integer values. So

they are longer suitable for internal file versions with rcsid variables.

Accordingly the rcsid varable have been removed.

2013-07-24 arp-scan 1.9:

* Updated IEEE OUI and IAB MAC/Vendor files. There are now 18157 OUI entries

and 4414 IAB entries.

* Use autoconf 2.69 and automake 1.11 to add support for ARM 64-bit CPUs.

* Use libpcap functions to obtain the interace IP address and send the ARP

packet, instead of using our own link-layer specific functions. The only

link-layer specific function that we still need is get_hardware_address()

to obtain the interface MAC address. This means we now require libpcap 0.9.3

or later.

* Added support for Dragonfly BSD.

* The -u option to get-iab and get-oui scripts now works.

* get-oui and get-iab scripts now get the OUI and IAB files from the new

locations on the IEEE website, and allow whitespace at the beginning of

the line.

* If the MAC/Vendor file locations are not explicitly specified, look for them

in the current directory and then in their default location.

* Raised default timeout from 100ms to 500ms.

* Added new --rtt (-D) option to display the packet round-trip time.

* Include <net/bpf.h> header file early in link-bpf.c to avoid BPF symbol

problems on some BSD based operating systems.

* Added arp-fingerprint patterns for GNU/Hurd, Amazon Kindle (Linux 2.6),

BeOS, Windows 8, Recent Linux, FreeBSD, NetBSD and OpenBSD versions, and

RiscOS.

* Added data file "pkt-custom-request-vlan-llc.dat" to the tarball to allow

the ARP request packet generation self test to complete successfully.

* Various minor bug fixes and improvements.

2011-03-01 arp-scan 1.8:

* Updated IEEE OUI and IAB MAC/Vendor files. There are now 14707 OUI entries

and 3542 IAB entries.

* Added support for trailer ARP replies, which were used in early versions

of BSD Unix on VAX.

* Added support for ARP packets with both 802.1Q VLAN tag and LLC/SNAP framing.

* The full help output is only displayed if specifically requested with

arp-scan --help. Usage errors now result in smaller help output.

* Added support for Apple Mac OS X with Xcode 2.5 and later. This allows

arp-scan to build on Tiger, Leopard and Snow Leopard.

* Changed license from GPLv2 to GPLv3.

* Added warning about possible DoS when setting ar$spa to the destination IP

address to the help output and man page.

* Added arp-fingerprint patterns for 2.11BSD, NetBSD 4.0, FreeBSD 7.0,

Vista SP1, Windows 7 and Blackberry OS.

* Enabled compiler security options -fstack-protect, -D_FORTIFY_SOURCE=2 and

-Wformat-security if they are supported by the compiler. Also enabled extra

warnings -Wwrite-strings and -Wextra.

* Added new "make check" tests to check packet generation, and packet decoding

and display.

* Modified get-oui and get-iab perl scripts so they will work on systems where

the perl interpreter is not in /usr/bin, e.g. NetBSD.

* Various minor bug fixes and improvements.

2008-07-24 arp-scan 1.7:

* new --pcapsavefile (-W) option to save the ARP response packets to a pcap

savefile for later analysis with tcpdump, wireshark or another program that

supports the pcap file format.

* new --vlan (-Q) option to create outgoing ARP packets with an 802.1Q VLAN tag

ARP responses with a VLAN tag are interpreted and displayed.

* New --llc (-L) option to create outgoing ARP packets with RFC 1042 LLC/SNAP

framing. Received ARP packets are decoded and displayed with either

LLC/SNAP or the default Ethernet-II framing irrespective of this option.

* Avoid double unmarshalling of packet data: once in callback, then again in

display_packet().

* New arp-fingerprint patterns for ARP fingerprinting: Cisco 79xx IP Phone

SIP 5.x, 6.x and 7.x; Cisco 79xx IP Phone SIP 8.x.

* Updated IEEE OUI and IAB MAC/Vendor files. There are now 11,697 OUI entries

and 2,386 IAB entries.

2007-04-12 arp-scan 1.6:

* arp-scan wiki at http://www.nta-monitor.com/wiki/

This contains detailed documentation on arp-scan, and is intended to be

the primary documentation resource.

* Added support for Sun Solaris. Tested on Solaris 9 (SPARC). arp-scan may

also work on other systems that use DLPI, but only Solaris has been tested.

* New arp-fingerprint patterns for ARP fingerprinting: IOS 11.2, 11.3 and 12.4;

ScreenOS 5.1, 5.2, 5.3 and 5.4; Cisco VPN Concentrator 4.7; AIX 4.3 and 5.3;

Nortel Contivity 6.00 and 6.05; Cisco PIX 5.1, 5.2, 5.3, 6.0, 6.1, 6.2, 6.3

and 7.0.

* Updated IEEE OUI and IAB MAC/Vendor files. There are now 10,214 OUI entries

and 1,858 IAB entries.

* Added HSRP MAC address to mac-vendor.txt.

2006-07-22 arp-scan 1.5:

* Reduced memory usage from 44 bytes per target to 28 bytes. This reduces

the memory usage for a Class-B network from 2.75MB to 1.75MB, and a Class-A

network from 704MB to 448MB.

* Reduced the startup time for large target ranges. This reduces the startup

time for a Class-A network from 80 seconds to 15 seconds on a Compaq laptop

with 1.4GHz CPU.

* Added support for FreeBSD, OpenBSD, NetBSD and MacOS X (Darwin). arp-scan

will probably also work on other operating systems that implement BPF, but

only those listed have been tested.

* Improved operation of the --srcaddr option. Now this will change the

source hardware address in the Ethernet header without changing the

interface address.

* Additional fingerprints for arp-fingerprint.

* Improved manual pages.

* Updated IEEE OUI and IAB files. There are now 9,426 OUI entries and 1,568

IAB entries.

2006-06-26 arp-scan 1.4:

* Added IEEE IAB listings and associated get-iab update script and --iabfile

option.

* Added manual MAC/Vendor mapping file: mac-vendor.txt and associated

--macfile option.

* New --localnet option to scan all IP addresses on the specified interface

network and mask.

2006-06-23 arp-scan 1.3:

* Initial public release. Source distribution only, which will compile and

run on Linux.