Network investigation guide
Investigating ARP Scans
An ARP scan occurs when a device queries many local IP addresses to discover which systems are active on the same network.
Understand the finding
What do ARP Scans mean?
ARP scanning is common during inventory and troubleshooting, but an attacker can also use it to map nearby systems before lateral movement. The scan is a discovery signal, so the source, timing, scope, and activity that follows determine its importance.
Triage workflow
How to investigate ARP Scans
- 1
Identify the source device, user, and process that generated the requests.
- 2
Check whether the source is an approved scanner or administrator system.
- 3
Compare the timing and target range with scheduled discovery activity.
- 4
Look for follow-on connections, login attempts, spoofing, or access to discovered hosts.
Interpret the context
Common benign explanations
Finding this behavior does not by itself prove malicious intent. Common explanations include:
- Network inventory, NAC, monitoring, or vulnerability scanning
- An administrator intentionally discovering local devices
- A misconfigured host treating too many addresses as local
Make a decision
When to escalate or de-escalate
Escalate when
- The source is an unexpected user endpoint, guest device, or newly observed system.
- The scan is followed by lateral movement, authentication attempts, or unusual connections.
De-escalate when
- The source and timing match an approved discovery job.
- A documented network or host misconfiguration explains the pattern.
Analyze the evidence
Investigate network behavior with Red Hand Analytics
Upload a PCAP or connect Red Hand Collector. Both use Red Hand Analytics, where meaningful behavior, endpoints, DNS, data flows, and connection evidence stay connected.