Nmap – Host Discovery to Get MAC Address

nmap

I notice that nmap -sn is no longer provide the MAC address for remote host as discussed in Can I use nmap to discover IPs and mac addresses?

I would like to get something like netdiscover output. Just IP & MAC Address only.

Nmap version 7.80

wolf@linux:~$ nmap -V
Nmap version 7.80 ( https://nmap.org )
Platform: x86_64-pc-linux-gnu

e.g.

wolf@linux:~$ nmap -sn -oG - 10.10.10.*
# Nmap 7.80 scan initiated Wed May 20 12:38:57 2020 as: nmap -sn -oG - 10.10.10.*
Host: 10.10.10.1 () Status: Up
Host: 10.10.10.2 () Status: Up
Host: 10.10.10.3 () Status: Up
# Nmap done at Wed May 20 12:38:59 2020 -- 256 IP addresses (3 hosts up) scanned in 2.25 seconds
wolf@linux:~$

Best Answer

1st of all, you won't be able to see MAC Address if -oG - being used (even with root/sudo).

user@linux:~$ sudo nmap -n -sn 10.10.10.* -oG -
# Nmap 7.60 scan initiated Sat May 29 12:10:09 2020 as: nmap -n -sn -oG - 10.10.10.*
Host: 10.10.10.1 () Status: Up
Host: 10.10.10.2 () Status: Up
Host: 10.10.10.3 () Status: Up
# Nmap done at Sat May 29 12:10:11 2020 -- 256 IP addresses (3 hosts up) scanned in 2.31 seconds
user@linux:~$

2nd, even after -oG - being removed, you still won't be able to see the MAC Address.

user@linux:~$ nmap -n -sn 10.10.10.*

Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-29 12:11 +00
Nmap scan report for 10.10.10.1
Host is up (0.00086s latency).
Nmap scan report for 10.10.10.2
Host is up (0.0020s latency).
Nmap scan report for 10.10.10.3
Host is up (0.00082s latency).
Nmap done: 256 IP addresses (3 hosts up) scanned in 2.71 seconds
user@linux:~$

Run it as root or with sudo so that nmap can send raw packets in order to get remote MAC 

user@linux:~$ sudo nmap -n -sn 10.10.10.*

Starting Nmap 7.60 ( https://nmap.org ) at 2020-05-29 12:11 +00
Nmap scan report for 10.10.10.2
Host is up (0.00022s latency).
MAC Address: AA:AA:AA:AA:AA:02 (NIC manufacturer here)
Nmap scan report for 10.10.10.1
Host is up (-0.100s latency).
MAC Address: AA:AA:AA:AA:AA:01 (NIC manufacturer here)
Nmap scan report for 10.10.10.3
Host is up (0.00061s latency).
MAC Address: AA:AA:AA:AA:AA:03 (NIC manufacturer here)
Nmap done: 256 IP addresses (4 hosts up) scanned in 3.60 seconds
user@linux:~$
Related Topic