ARP scanning

By using ARP broadcast, we can take advantage of getting IP information. Each ARP broadcast frame requests who has which IP address—the IP address is increased by one each time. Once a host has that IP address, it will respond to the request with the requested IP address and its MAC address.

ARP scanning is an effectively fast method, and typically won't set off any alarms; the issue with this is that ARP is a layer 2 protocol so it can't go over network boundaries. Meaning if the red team is on network 192.100.0.0/24 and your target(s) is on network 10.16.X.0/24, you can't send ARP requests to 10.16.X.0/24.