Bien he dado con algo, usando la libreria libnet, he hecho unas peticiones ARP, para descubrir todos los host vivos en mi red ya que todos los dispositivos responden rapida mente a las peticiones ARP

he aqui el codigo que utilize, recien lo hice el otro dia, si tengo algun error me avisan por este mismo hilo.
#include<libnet.h>
#include<stdio.h>
int main(void) {
int n;
u_int8_t c; //contador
u_int32_t src_ip; // Para nuestra direccion IP
u_int8_t *dts_ip; // Para la direccion IP Destino
libnet_t *l; // The libnet context
libnet_ptag_t t=0,arp = 0; // ptag
char *device = NULL; //Primera Interfas de Red ~Sup~T que se pueda encontrar
u_int8_t *packet; //Apuntador al Paquete
u_int32_t packet_s; //Packet Size
u_char difucion[6] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; //Direccion de Destino "Difusion Ethernet"
u_char zero[6] = {0x0,0x0,0x0,0x0,0x0,0x0}; //Direccion Zero
struct libnet_ether_addr *origen; //Nuestra MAC
char *lib_error = malloc(sizeof(char)*LIBNET_ERRBUF_SIZE); //Reservamos Memoria para los mensajes de Errores
dts_ip = (u_int8_t*) malloc(sizeof(u_int8_t)*4);
dts_ip[0] = 192;
dts_ip[1] = 168;
dts_ip[2] = 1;
l = libnet_init(
LIBNET_LINK_ADV, //injection type
device, //network interface
lib_error); //errbuf
if (l == NULL) {
fprintf(stderr, "libnet_init(): %s", lib_error);
exit(EXIT_FAILURE);
}
src_ip = libnet_get_ipaddr4(l); //Obtenemos Direccion IP
origen = libnet_get_hwaddr(l); //Obtenetmos Nuestra MAC
c = 1;
while(c<255) {
dts_ip[3] = c;
arp = libnet_build_arp(
ARPHRD_ETHER, /* hardware addr */
ETHERTYPE_IP, /* protocol addr */
6, /* hardware addr size */
4, /* protocol addr size */
ARPOP_REQUEST, /* operation type */
origen->ether_addr_octet, /* sender hardware addr */
(u_int8_t *)&src_ip, /* sender protocol addr */
zero, /* target hardware addr */
dts_ip, /* target protocol addr */
NULL, /* payload */
0, /* payload size */
l, /* libnet context */
arp) ; /* libnet id */
if(arp==-1) {
fprintf(stderr,"libnet_build_arp(): %s",libnet_geterror(l));
goto bad;
}
t = libnet_build_ethernet(
difucion,
zero,
ETHERTYPE_ARP,
NULL,
0,
l,
t);
if(t==-1) {
fprintf(stderr,"libnet_build_ethernet(): %s",libnet_geterror(l));
goto bad;
}
if(libnet_adv_cull_packet(l,&packet,&packet_s)==-1) {
fprintf(stderr,"libnet_adv_cull_packet(): %s",libnet_geterror(l));
}
else {
fprintf(stderr,"Packet size: %d\n",packet_s);
libnet_adv_free_packet(l,packet);
}
if((n=libnet_write(l))== -1) {
fprintf(stderr,"Write error: %s\n",libnet_geterror(l));
goto bad;
}
else {
fprintf(stderr,"Wrote %d bytes ARP packet from context %s check the wire\n",n,libnet_cq_getlabel(l));
}
c++;
}
libnet_destroy(l);
return(EXIT_SUCCESS);
bad:
libnet_destroy(l);
return(EXIT_SUCCESS);
}
y el resultado con el log de snort
06/11-09:58:29.910702 ARP who-has 192.168.5.1 tell 192.168.5.238
06/11-09:58:29.910914 ARP reply 192.168.5.1 is-at 0:3:47:B0:F9:C1
06/11-09:58:29.910919 ARP reply 192.168.5.1 is-at 0:30:F1:53:91:93
06/11-09:58:29.911008 ARP reply 192.168.5.1 is-at 0:50:FC:B6:F4:26
06/11-09:58:29.911012 ARP reply 192.168.5.1 is-at 0:B:CD:C5:5C:3F
06/11-09:58:29.912326 ARP who-has 192.168.5.2 tell 192.168.5.238
06/11-09:58:29.919400 ARP who-has 192.168.5.3 tell 192.168.5.238
06/11-09:58:29.919442 ARP who-has 192.168.5.4 tell 192.168.5.238
06/11-09:58:29.919471 ARP who-has 192.168.5.5 tell 192.168.5.238
06/11-09:58:29.919499 ARP who-has 192.168.5.6 tell 192.168.5.238
06/11-09:58:29.919528 ARP who-has 192.168.5.7 tell 192.168.5.238
06/11-09:58:29.919557 ARP who-has 192.168.5.8 tell 192.168.5.238
06/11-09:58:29.919585 ARP who-has 192.168.5.9 tell 192.168.5.238
06/11-09:58:29.919614 ARP who-has 192.168.5.10 tell 192.168.5.238
06/11-09:58:29.919642 ARP who-has 192.168.5.11 tell 192.168.5.238
06/11-09:58:29.919670 ARP who-has 192.168.5.12 tell 192.168.5.238
06/11-09:58:29.919751 ARP who-has 192.168.5.13 tell 192.168.5.238
06/11-09:58:29.919762 ARP reply 192.168.5.8 is-at 0:D:61:3F:2D:77
06/11-09:58:29.919843 ARP reply 192.168.5.11 is-at 0:20:ED:1D:89:6B
06/11-09:58:29.919882 ARP who-has 192.168.5.14 tell 192.168.5.238
06/11-09:58:29.919910 ARP who-has 192.168.5.15 tell 192.168.5.238
06/11-09:58:29.920393 ARP reply 192.168.5.14 is-at B6:7C:AE:85:11:0
06/11-09:58:29.927297 ARP who-has 192.168.5.16 tell 192.168.5.238
06/11-09:58:29.932246 ARP who-has 192.168.5.17 tell 192.168.5.238
06/11-09:58:29.951634 ARP who-has 192.168.5.18 tell 192.168.5.238
06/11-09:58:29.952942 ARP who-has 192.168.5.19 tell 192.168.5.238
06/11-09:58:29.953077 ARP reply 192.168.5.19 is-at 0:11:85:AE:8C:D
Y el resultado que me interesaba:
06/11-09:58:29.910702 ARP who-has 192.168.5.1 tell 192.168.5.238
06/11-09:58:29.910914 ARP reply 192.168.5.1 is-at 0:3:47:B0:F9:C1
06/11-09:58:29.910919 ARP reply 192.168.5.1 is-at 0:30:F1:53:91:93
06/11-09:58:29.911008 ARP reply 192.168.5.1 is-at 0:50:FC:B6:F4:26
06/11-09:58:29.911012 ARP reply 192.168.5.1 is-at 0:B:CD:C5:5C:3F
Hay 4 Maquinas en mi escuela con la misma IP de Gareway