ARP-FINGERPRINT(1)

✨ NAME ✨

Okay bestie, welcome to the ARP-FINGERPRINT(1) page from the General Commands Manual 💖 — this is all about arp-fingerprint, the icon that fingerprints a system using ARP. Periodt.

---

🌸 SYNOPSIS 🌸

arp-fingerprint [options] target

The target has to be one single IP address or hostname. Not multiple targets, not IP networks, not ranges — one target only, bestie 🎀.

If you use an IP address for the target, you can use the -o option to pass the --numeric option to arp-scan. That prevents arp-scan from attempting DNS lookups, which can speed up the fingerprinting process — especially on systems with a slow or faulty DNS configuration. Slay for slow DNS, honestly 🦋.

---

💅 DESCRIPTION 💅

arp-fingerprint fingerprints the specified target host using the ARP protocol ✨.

It sends various different types of ARP request to the target, and records which types it responds to. From that, it constructs a fingerprint string made of "1" where the target responded and "0" where it did not. An example of a fingerprint string is 01000100000. Then that fingerprint string is used to look up the likely target operating system 👑.

Many of the fingerprint strings are shared by several operating systems, so there is not always a one-to-one mapping between fingerprint strings and operating systems. Also: just because a system’s fingerprint matches a certain operating system (or list of operating systems), that does not necessarily mean the system being fingerprinted is that operating system — although it is quite likely. Why? Because the list of operating systems is not exhaustive; it is just what I have discovered to date, and there are bound to be operating systems that are not listed. No cap 💀.

The ARP fingerprint of a system is generally a function of that system’s kernel — although it is possible for the ARP function to be implemented in user space, it almost never is 🧚.

Sometimes an operating system can give different fingerprints depending on the configuration. An example is Linux, which will respond to a non-local source IP address if that IP is routed through the interface being tested. This is both good and bad: on one hand it makes the fingerprinting task more complex; but on the other, it can allow some aspects of the system configuration to be determined. It’s giving “messy but useful” 😭.

Sometimes the fact that two different operating systems share a common ARP fingerprint string points to a re-use of networking code. One example of this is Windows NT and FreeBSD 👀.

arp-fingerprint uses arp-scan to send the ARP requests and receive the replies. Bestie does not raw-dog the packets herself, okay? 🫶

There are other methods that can be used to fingerprint a system using arp-scan which can be used in addition to arp-fingerprint. These additional methods are not included in arp-fingerprint either because they are likely to cause disruption to the target system, or because they require knowledge of the target’s configuration that may not always be available. So we keep them out of the group chat 🙈.

Most of the ARP requests that arp-fingerprint sends are non-standard, so it could disrupt systems that don’t have a robust TCP/IP stack. That’s a real warning, bestie — not a vibe check 💀.

---

🎀 OPTIONS 🎀

• -h — Display a brief usage message and exit. Short and sweet, iconic.
• -v — Display verbose progress messages. She’s narrating the whole process 💬.
• -o <option-string> — Pass specified options to arp-scan. You need to enclose the options string in quotes if it contains spaces, e.g. -o "-I eth1". The commonly used options are --interface (-I) and --numeric (-N) ✨.
• -l — Fingerprint all hosts on the local network. You do not need to specify any target hosts if this option is given. Local-network main character energy 👑.

---

🌈 EXAMPLES 🌈

$ arp-fingerprint 192.168.0.1
192.168.0.1   01000100000     Linux 2.2, 2.4, 2.6

$ arp-fingerprint -o "-N -I eth1" 192.168.0.202
192.168.0.202 11110100000     FreeBSD 5.3, Win98, WinME, NT4, 2000, XP, 2003

---

🦋 NOTES 🦋

arp-fingerprint is implemented in Perl, so you need to have the Perl interpreter installed on your system to use it. Perl girlies rise 🐪💖.

---

⭐ SEE ALSO ⭐

• arp-scan(1)
• http://www.royhills.co.uk/wiki/ — the arp-scan wiki page 🌐

---

That’s the whole page, bestie — ARP-FINGERPRINT(1) from the General Commands Manual, dated October 27, 2022. Mwah 💋💖