Techzone/Netdiscover

Netdiscover

3 min readArticle

Netdiscover is an active/passive ARP reconnaissance tool. It discovers hosts on a local network by sending ARP requests (active mode) or by passively sniffing ARP traffic (passive mode). Fast, simple, and useful for quickly mapping what's on a network after gaining access through a wireless attack or other vector.

Why ARP for Host Discovery

ARP (Address Resolution Protocol) operates at Layer 2 and every device on a subnet responds to ARP requests for IP-to-MAC resolution. Unlike ICMP (ping), ARP works even when hosts have ICMP blocked by firewalls. This makes ARP scanning more reliable on local networks.

Installation

bash 
sudo apt install netdiscover

Basic Usage

bash 
# Scan a network (active mode — sends ARP requests)
sudo netdiscover -r 192.168.1.0/24

# Scan without specifying range (uses routing table)
sudo netdiscover

# Passive mode — just sniff ARP traffic, don't send anything
sudo netdiscover -p

# Specify interface
sudo netdiscover -i eth0 -r 192.168.1.0/24

# Fast mode
sudo netdiscover -f -r 192.168.1.0/24

Output Format

shell 
IP            At MAC Address     Count     Len  MAC Vendor / Hostname
192.168.1.1   aa:bb:cc:dd:ee:ff      3      180  Cisco Systems, Inc
192.168.1.10  11:22:33:44:55:66      1       60  Apple, Inc.
192.168.1.100 aa:11:bb:22:cc:33      2      120  NETGEAR

The MAC vendor lookup tells you what kind of device it is — router, Apple device, network equipment, etc.

Scanning After WiFi Attack

After connecting to a target network (evil twin, WPA crack, etc.):

bash 
# Quick network map
sudo netdiscover -r 192.168.1.0/24 -f

# Then hit interesting hosts with nmap
sudo nmap -sV -A 192.168.1.1    # Router
sudo nmap -sV 192.168.1.0/24   # Full subnet scan

Passive Mode (Stealthy)

Passive mode just listens to existing ARP traffic — useful when you want to discover hosts without generating any traffic of your own:

bash 
# Run passively — devices appear as they send ARP
sudo netdiscover -p -i wlan0
# Sits and waits — IPs show up as devices talk

Flags Reference

Flag Description
-i Specify interface
-r IP range (CIDR)
-p Passive mode
-f Fast mode (fewer ARP packets)
-c Number of ARP requests to send
-s Time between packets
-n Suppress header
-L Print to screen, save to file

Comparison to Similar Tools

Tool Method Speed Notes
Netdiscover ARP Fast Layer 2, LAN only
Nmap -sn ICMP/ARP Moderate More comprehensive
arp-scan ARP Very fast Similar to netdiscover
netdiscover -p Passive n/a Zero traffic

arp-scan Alternative

bash 
# arp-scan is often faster
sudo arp-scan --interface=eth0 192.168.1.0/24

# More verbose
sudo arp-scan -l -v  # Scan local network

After Discovery — Next Steps

bash 
# 1. Note the gateway (usually .1 or .254)
# 2. Note interesting hostnames/vendors
# 3. Scan specific targets with nmap
sudo nmap -sS -sV -O 192.168.1.1        # Router
sudo nmap -A 192.168.1.100             # Interesting device
sudo nmap -p- 192.168.1.0/24           # Full port scan of subnet

See Also

  • nmap-network-scanning - Comprehensive scanning after discovery
  • scapy-packet-crafting - Build custom ARP packets
  • tcpdump-packet-capture - Capture the ARP traffic
techzonesite.comUnlock Your IT Potential