arp-scan issue on macOS 15

[mikemadden42]

Does anyone else see this issue on macOS 15? This was working on macOS 14.

$ sudo arp-scan -l
WARNING: Could not obtain IP address for interface ap1. Using 0.0.0.0 for
the source address, which may not be what you want.
Either configure ap1 with an IP address, or manually specify the address
with the --arpspa option.
Interface: ap1, type: EN10MB, MAC: 6e:85:ca:2a:51:25, IPv4: (none)
ERROR: Could not obtain interface IP address and netmask
ERROR: pcap_lookupnet: ap1: no IPv4 address assigned

$ sw_vers 
ProductName:		macOS
ProductVersion:		15.0.1
BuildVersion:		24A348

$ brew info arp-scan
==> arp-scan: stable 1.10.0 (bottled), HEAD
ARP scanning and fingerprinting tool
https://github.com/royhills/arp-scan
Installed
/opt/homebrew/Cellar/arp-scan/1.10.0 (18 files, 1.6MB) *
  Poured from bottle on 2022-12-21 at 16:52:51
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/a/arp-scan.rb
License: GPL-3.0-or-later AND BSD-3-Clause AND ISC
==> Dependencies
Build: autoconf ✔, automake ✔
==> Options
--HEAD
	Install HEAD version
==> Analytics
install: 489 (30 days), 1,714 (90 days), 6,339 (365 days)
install-on-request: 489 (30 days), 1,714 (90 days), 6,337 (365 days)
build-error: 0 (30 days)

[royhills]

This error is coming from the libpcap function pcap_lookupnet():
ERROR: pcap_lookupnet: ap1: no IPv4 address assigned

https://www.tcpdump.org/manpages/pcap_lookupnet.3pcap.html

Are you using the latest version of libpcap? Running arp-scan --version will display the version number.

[mikemadden42]

@royhills thanks for the reply. I am using this version.

$ arp-scan --version
arp-scan 1.10.0

Copyright (C) 2005-2022 Roy Hills
License GPLv3+: GNU GPL version 3 or later <https://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.

libpcap version 1.10.5

This looks like the current version of libpcap.

$ brew info libpcap
==> libpcap: stable 1.10.5 (bottled), HEAD [keg-only]
Portable library for network traffic capture
https://www.tcpdump.org/
Installed
/opt/homebrew/Cellar/libpcap/1.10.5 (111 files, 1MB)
  Poured from bottle using the formulae.brew.sh API on 2024-09-05 at 19:38:02
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/lib/libpcap.rb
License: BSD-3-Clause
==> Options
--HEAD
	Install HEAD version
==> Caveats
libpcap is keg-only, which means it was not symlinked into /opt/homebrew,
because macOS already provides this software and installing another version in
parallel can cause all kinds of trouble.

If you need to have libpcap first in your PATH, run:
  echo 'export PATH="/opt/homebrew/opt/libpcap/bin:$PATH"' >> ~/.zshrc

For compilers to find libpcap you may need to set:
  export LDFLAGS="-L/opt/homebrew/opt/libpcap/lib"
  export CPPFLAGS="-I/opt/homebrew/opt/libpcap/include"
==> Analytics
install: 3,046 (30 days), 9,258 (90 days), 25,446 (365 days)
install-on-request: 1,131 (30 days), 3,149 (90 days), 8,213 (365 days)
build-error: 0 (30 days)

[jasonbcodd]

If you need to work around this, you can manually specify the interface and arp-scan works as expected

$ sudo arp-scan -I en0 -l