Netdiscover

Netdiscover is an ARP-based network reconnaissance tool that discovers live hosts on a local network. It sends ARP requests (active) or listens for ARP traffic (passive) to identify devices by IP, MAC address, and vendor.

Netdiscover uses ARP at Layer 2 for host discovery within local networks, which is faster and more reliable than Nmap's IP-based scanning. Nmap provides deeper service and OS information after hosts are discovered.

Yes, Netdiscover has a passive mode (-p) that listens for ARP traffic without sending any packets. This is useful for stealthy reconnaissance where you cannot risk detection.

Netdiscover displays IP addresses, MAC addresses, MAC vendor names, packet counts, and response timing for each discovered host.

ARP scanning works by broadcasting ARP requests to all possible IP addresses in a target range. Live hosts respond with their MAC addresses, allowing Netdiscover to build a table of IP-to-MAC mappings that identify all active devices on the local network segment.

Yes, Netdiscover can detect rogue devices by comparing discovered MAC addresses against known device inventories. Unexpected MAC addresses from unfamiliar vendors indicate unauthorized devices that may need investigation for security compliance.

Passive ARP detection (-p mode) listens for ARP traffic already present on the network without sending any packets. It captures ARP requests and replies from other devices, building a host list completely stealthily without generating any network noise.

Active probing sends ARP requests to all IPs in a range and waits for responses, which is faster but generates detectable traffic. Passive detection only listens for existing ARP traffic, which is stealthy but only discovers hosts that are actively communicating.

Yes, Netdiscover resolves MAC address prefixes to vendor names using the OUI (Organizationally Unique Identifier) database. This helps identify device types such as routers (Cisco), computers (Dell, HP), and mobile devices (Apple) on the network.

Netdiscover maps network topology by discovering all live hosts through ARP scanning. It reveals IP addresses, MAC addresses, and vendor information, creating a comprehensive inventory of devices that can be used as input for deeper enumeration with Nmap or other tools.

Use the -c flag: netdiscover -r 192.168.1.0/24 -c 20 stops after discovering 20 hosts. This is useful for quick scans where you don't need a complete inventory of all devices.

No, Netdiscover operates at Layer 2 using ARP, which works at the network layer independent of ports. For port-specific scanning, use Nmap on hosts discovered by Netdiscover.

Use the -c flag without a count for continuous scanning: netdiscover -r 192.168.1.0/24 -c 0. Netdiscover continuously monitors for new hosts appearing on the network, useful for detecting intermittent devices.

Netdiscover shows current ARP mappings but is not specifically designed for ARP spoofing detection. For ARP anomaly detection, use arpwatch, XARP, or network IDS solutions that monitor for ARP table changes.

Use the -i flag: netdiscover -i eth0 -r 192.168.1.0/24. This specifies the network interface for scanning, useful on systems with multiple network adapters or when targeting specific network segments.

Yes, Netdiscover identifies devices by MAC vendor prefix. Router manufacturers (Cisco, TP-Link, Netgear) are shown in the vendor field. Gateway devices are typically at .1 or .254 IP addresses.

Use the -P flag to save results in pcap format for Wireshark analysis: netdiscover -r 192.168.1.0/24 -P capture.pcap. For text output, redirect stdout: netdiscover -r 192.168.1.0/24 > hosts.txt.

Netdiscover works on virtual networks (VMware, VirtualBox, Hyper-V) when the VM adapter is in bridged mode. Host-only or NAT mode limits ARP visibility to the virtual network only.

Run periodic Netdiscover scans and compare results against your device inventory. Unexpected MAC addresses indicate unauthorized devices. Document findings for compliance reports showing network device inventory changes.