ARP Table – Why ARP Table is Not Updated with NMAP

arpipipv4mac addressping

Here is what I do and what happens :

  • Let assume I have a device A with IP X.X.X.200 connected to the network
  • I use Nmap to ping my local network, with the command "nmap –send-ip -sP 192.168.1.1/24"
  • Look at the arp table using "arp -a", the device A is displayed with his MAC, no problem
  • Now I change manually the IP for A, I set the static IP to X.X.X.201
  • I use the same Nmap command "nmap –send-ip -sP 192.168.1.1/24"
  • Look at the arp table with "arp -a", and then A appears 2 times. One for IP X.X.X.200 and one for IP X.X.X.201

So the Nmap command did not refresh the IP X.X.X.200, that means it does not really ping all IPs. Because if I ping manually X.X.X.200, then it would get no response and disappear from the arp table.

So I would like to know how to use this tool, to really refresh an re-populate the arp table.

Thank you.

Best Answer

What happens is desirable. It would not be desirable for an interface with multiple IP addresses to have the ARP cache changed every time one of the different addresses is used. The ARP cache will naturally timeout MAC addresses. You can probably clear the ARP cache, and it will get rebuilt naturally.

Related Topic