Where to run an agent

An agent finds devices only on the networks its own interfaces are attached to. ARP does not cross routers or NAT, so place the agent first, then install it.

To scan several VLANs, give one agent an interface on each VLAN, or run one agent per VLAN.

Where	What it sees
Linux machine or Raspberry Pi	The networks it is plugged into. The simplest choice.
The MiniPAM server's machine	The server's own networks.
Virtual machine, bridged NIC	The bridged network, like a physical machine.
Virtual machine, NAT network	Only the private virtual network, not your LAN.
LXC container, bridged	The bridged network. Unprivileged is fine. See Proxmox.
LXC container, NAT bridge	Only the private bridge network, for example LXD's default lxdbr0.
Container with a macvlan NIC	The network, except the container's own host.

The agent needs no TUN device.

Proxmox

Run the agent in a small Debian container on the host:

1. Create the container. Unprivileged is fine. On the Network tab, set Bridge to the bridge your LAN is on (usually vmbr0), add a VLAN Tag if the network is a VLAN, and choose DHCP or a static address.

2. For each extra VLAN to scan, add a network device on the same bridge with that VLAN's tag:

   pct set 120 --net1 name=eth1,bridge=vmbr0,tag=30,ip=dhcp

3. If the container's firewall is on, allow its outgoing traffic to the server and to the networks it scans.

4. Inside the container, run the installer as in Install it as a service.

5. Check that ARP scanning kept its capability: getcap /usr/local/bin/minipam-agent shows cap_net_raw=ep. If it is missing (the installer warns about it), ARP scanning needs root in that container.