command for MAC broadcast

I am looking for a command to discover all hosts on the same LAN segment from a host with unassigned IP, default gateway, and subnet. I know there's ping 255.255.255.255 but that operates at layer 3 and requires the sender have an IP address. Is there a simple Windows and Linux layer-2-only command to send a MAC broadcast FF:FF:FF:FF:FF:FF ?

Can this be done in 1 line, e.g. without arpping every possible IP address? I also tried the nmap broadcast-ping script but that doesn't work on my Linux hosts. )

Knowing the ARP packet structure helps.


I'm not sure you can do what you're asking for. What message could you send to all hosts at FF:FF:FF:FF:FF:FF that would compel them to reply to you? ARPs get sent to the broadcast address, but only the correct host responds.

I'd use a combination of pinging the broadcast (192.168.0.255 and 255.255.255.255), the MAC address table on the switch, and a Wireshark tap on the gateway's interface to gather practically all of them.

There's no L2 message I know of that will require a response from all L2 hosts regardless of L3 config.