Para verificar a rede local, você pode usar arp-scan
ou netdiscover
sudo arp-scan -local
você terá saída em todo pc na lan
xxx@xxx ~ $ sudo arp-scan -local
[sudo] password for xxx:
Interface: eth0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
xxx.xxx.xx.2 6c:62:6d:ce:71:0c Micro-Star INT'L CO., LTD
xxx.xxx.xx.3 74:d4:35:06:2a:e0 (Unknown)
xxx.xxx.xx.6 6c:62:6d:ce:84:8b Micro-Star INT'L CO., LTD
xxx.xxx.xx.1 ec:b1:d7:bd:a2:4e (Unknown)
xxx.xxx.xx.7 00:30:4f:18:b1:52 PLANET Technology Corporation
xxx.xxx.xx.8 00:25:22:e4:31:29 ASRock Incorporation
xxx.xxx.xx.9 6c:62:6d:ce:84:93 Micro-Star INT'L CO., LTD
sudo netdiscover -r xxx.xxx.xxx.0/24
Currently scanning: xxx.xxx.xx.0/24 | Screen View: Unique Hosts
46 Captured ARP Req/Rep packets, from 46 hosts. Total size: 2760
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor
-----------------------------------------------------------------------------
xxx.xxx.xx.1 ec:b1:d7:bd:a2:4e 01 060 Unknown vendor
xxx.xxx.xx.2 6c:62:6d:ce:71:0c 01 060 Unknown vendor
xxx.xxx.xx.3 74:d4:35:06:2a:e0 01 060 Unknown vendor
xxx.xxx.xx.6 6c:62:6d:ce:84:8b 01 060 Unknown vendor
xxx.xxx.xx.7 00:30:4f:18:b1:52 01 060 PLANET Technology Corporation
arp-scan
e netdiscover
enviar arp ping
na rede local e provavelmente todos os hosts devem responder. O trabalho de ping da Arp na camada 2 e a maioria dos firewalls não bloqueiam esse tráfego.