2

I have a setup of two routers like this:

 internet ---- Router A ---- Router B  -- Host A
                  \               \
                webserver       Host B
  • Webserver resides in a DMZ and all ports on Router B are closed.
  • Router A and B have a different subnet mask

I've written a script which outputs a html page (which should be hosted by the webserver) showing all online Hosts. It uses arp-scan but it only works "behind" router B. So Host A and Host B can see each other but the webserver can not see the Hosts.

I resolved this issue by making a LAN-to-LAN network between the two routers. But now I caused a security threat by putting the hosts together with the webserver (with open ports) on one network.

How can I let my webserver still arp-scan Hosts on the network without having hosts exposed to security threats? (I can provide extra information if desired. Excuse me if haven't used correct terminology)

3
  • arp-scan shouldn't be used to go passed router B, use ping or tcp scan instead.
    – Bulki
    Commented Feb 17, 2016 at 6:28
  • will this also return mac addresses? Commented Feb 17, 2016 at 9:25
  • 1
    MAC addresses are only significant on the local LAN. They are not seen on a different LAN. The frames containing the MAC addresses are stripped off by a router, which will then build a new frame with new MAC addresses when the packet is encapsulated in a frame for a different LAN.
    – Ron Maupin
    Commented Feb 17, 2016 at 20:41

1 Answer 1

4

You are trying to use a layer-2 broadcast across a layer-3 device (router). That's not how it works. ARP is restricted to the local LAN for requests, and replies are to the requesting host, so they will not be sent across layer-3.

If you want to use ARP to scan, you would need a scan device on each LAN you want to scan. You could have it report back to a central location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.