arp-scan sends ARP (Address Resolution Protocol) queries to the specified targets, and displays any responses that are received. It allows any part of the outgoing ARP packets to be changed, allowing the behavior of targets to non-standard ARP packets to be examined. The IP address and hardware address of received packets are displayed, together with the vendor details. These details are obtained from the IEEE OUI and IAB listings, plus a few manual entries. It includes arp-fingerprint, which allows a system to be fingerprinted based on how it responds to non-standard ARP packets.
ike-scan discovers IPsec VPN servers, and can fingerprint them using UDP backoff and Vendor ID fingerprinting techniques. It supports IKE Main Mode and Aggressive Mode. ike-scan allows flexible specification of the outgoing IKE packet, and decodes the response packets. It also supports pre-shared key cracking for IKE aggressive mode with pre-shared key authentication.