Speed up on single mac target

[adminy]

When I do a scan:

arp-scan -lg -I wlan0

24 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.403 seconds (106.53 hosts/sec). 23 responded

but when I just want to find out the IP of a known mac address:

arp-scan -lg -I wlan0 -T e8:db:23:c4:1f:36

2 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.408 seconds (106.31 hosts/sec). 1 responded

I don't understand why there is more time to find out 1 IP targetting a specific mac than it is to find out all the IPs of all the devices.

also is there a way to stop looking up the name or something like with arp -n which resolves instantly? What's the 2.4 seconds delay for?

[royhills]

The -T option only changes the destination MAC address that arp-scan sends the ARP request packets to. It doesn't change the number of IP addresses scanned.

In both cases, arp-scan sends ARP requests for all 256 IP addresses on the specified network interface. In the first instance the requests are sent to the broadcast address so all active hosts will respond, but in the second example it is sending to the specified MAC address so only the host with that address will respond.

The 2.4 seconds is the time taken to scan 256 IP addresses with the default bandwidth limit and retry count.

[adminy]

I set -M 1 and that seems much faster. Thanks