ICMP Scan: sending ICMP for IPs not listed in the ARP cache about sx HOT 3 CLOSED

Ok @v-byte-cpu , I got it.

Thanks very much for your answer.

I'm just experimenting "sx" and I'd say that I'm liking it. It seems a very nice tool. :)

from sx.

Hi @ronaldoafonso !

sx had sent ICMP packets for all the subnet I provided in the command line.

yes, sx tries to scan all ip addresses provided in the command line, arp cache file just provides initial information (starting context) that is necessary to perform the scan.

Another thing that I noticed was that for each ICMP packet sent and which the MAC was not listed in the ARP cache, "sx" included the MAC address of the first entry in the ARP cache as the Ethernet frame destination address.

I can guess that 192.168.15.1 address is the default gateway for your network, sx tries to find mac address for a scanned ip address in ARP cache and if it is not present in the cache then sx fallbacks to the mac address of the default gateway. This is why d8:c6:78:1f:bc:90 address is used for packets for all addresses that were not explicitly specified in the arp cache file.

Would like to note that If you want to exclude IPs from the scan you can use --exclude option. Also you can override default gateway MAC address (that is usually detected automatically) using --gwmac option.

P.S. In your case I would just use -f option with arp cache file (if you want to scan only IPs in arp cache file).

from sx.

Thank you for the kind words :)

from sx.