While arp -a works well for basic MAC address lookup in Windows, Linux users often find it less responsive. Nmap provides a more powerful cross-platform solution with additional features like OS detection and port scanning.

This simple command scans your local subnet and reveals both IPs and MAC addresses:

sudo nmap -sn 192.168.1.0/24

The -sn flag (ping scan) skips port scanning while still discovering hosts. On Linux, you'll need root privileges for MAC address detection.

On Windows systems, you'll need Npcap (Nmap's recommended packet capture library) installed. The command syntax remains identical, but you might need to run Command Prompt as Administrator:

nmap -sn 192.168.1.0/24

For more detailed output including vendor information from MAC addresses:

sudo nmap -sn --script hostmap-btraceroute 192.168.1.0/24

To save results to a file for later analysis:

sudo nmap -sn -oN scan_results.txt 192.168.1.0/24

If MAC addresses aren't appearing:

• Ensure you're using sudo/root privileges (Linux/Mac)
• Verify Npcap is properly installed (Windows)
• Try adding --send-eth to force raw Ethernet packets

For systems where direct MAC detection fails, you can pipe Nmap results to arp:

sudo nmap -sn 192.168.1.0/24 && arp -a

For large networks, adjust timing and parallelism:

sudo nmap -sn -T4 --min-parallelism 100 192.168.1.0/24

The -T4 sets aggressive timing, while --min-parallelism increases simultaneous probes.

Remember that network scanning may:

• Trigger intrusion detection systems
• Be restricted by corporate policies
• Require explicit permission on networks you don't own

---

While arp -a works for basic MAC address resolution, Nmap provides more comprehensive network discovery capabilities across platforms. Here's why it's superior:

• Cross-platform consistency (same command works on Linux/Windows)
• Customizable scan intensity and timing
• Ability to scan entire subnets efficiently
• Detailed output formatting options

The simplest way to discover devices with their MAC addresses:

nmap -sn 192.168.1.0/24

This performs a ping sweep (-sn) while still collecting MAC addresses. The /24 notation scans the entire Class C subnet.

On Windows systems, you'll need to run Nmap with administrator privileges and may want to add:

nmap -sn --packet-trace 192.168.1.1-100

The --packet-trace option helps troubleshoot when running under Windows Firewall.

For more detailed MAC information combined with OS detection:

nmap -O --script smb-os-discovery 192.168.1.0/24

This will:

1. Discover live hosts
2. Attempt OS detection (-O)
3. Run the SMB script for additional details

To extract just IP and MAC addresses in a clean format:

nmap -sn 192.168.1.0/24 | awk '/Nmap scan report/{ip=$NF} /MAC Address/{mac=$3; print ip,mac}'

For faster results on local networks, combine with ARP scanning:

nmap -PR -sn 192.168.1.0/24

The -PR option forces ARP ping scans which are typically faster than ICMP pings on LANs.

To create a CSV file of IP/MAC mappings:

nmap -sn 192.168.1.0/24 -oX scan.xml
xsltproc scan.xml -o devices.csv

Then process the XML output into your preferred format.