Network investigation guide
Investigating ARP Scan
An ARP scan occurs when a device queries many local IP addresses to discover which systems are active on the same network.
Understand the finding
What does ARP Scan mean?
ARP scanning is common during inventory and troubleshooting, but an attacker can also use it to map nearby systems before lateral movement. The scan is a discovery signal, so the source, timing, scope, and activity that follows determine its importance.
Triage workflow
How to investigate ARP Scan
- 1
Identify the source device, user, and process that generated the requests.
- 2
Check whether the source is an approved scanner or administrator system.
- 3
Compare the timing and target range with scheduled discovery activity.
- 4
Look for follow-on connections, login attempts, spoofing, or access to discovered hosts.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Network inventory, NAC, monitoring, or vulnerability scanning
- An administrator intentionally discovering local devices
- A misconfigured host treating too many addresses as local
Make a decision
When to escalate or de-escalate
Escalate when
- The source is an unexpected user endpoint, guest device, or newly observed system.
- The scan is followed by lateral movement, authentication attempts, or unusual connections.
De-escalate when
- The source and timing match an approved discovery job.
- A documented network or host misconfiguration explains the pattern.
Analyze the evidence
Investigate network behavior with Red Hand
Red Hand turns network traffic into a report that identifies meaningful behavior, adds endpoint and process context when available, and provides practical investigation guidance.