--- name: "netdiscover" section: "8" platform: "linux" package: "netdiscover" version: "0.11-3" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/netdiscover" --- # netdiscover(8) active/passive ARP reconnaissance tool ## NAME **netdiscover** - active/passive ARP reconnaissance tool ## SYNOPSIS ``` netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter] [-s time] [-c count] [-n node] [-dfPLNS] ``` ## DESCRIPTION **netdiscover is an active/passive ARP reconnaissance tool, initially developed** **to gain information about wireless networks without DHCP servers in wardriving** **scenarios. It can also be used on switched networks. Built on top of libnet** **and libpcap, it can passively detect online hosts or search for them by** **sending ARP requests.** **Furthermore, it can be used to inspect your network's ARP traffic, or find** **network addresses using auto scan mode, which will scan for common local** **networks.** ## OPTIONS - **-i *device*** **The network interface to sniff and inject packets. If no interface** **is specified, first available will be used.** - **-r *range*** **Scan a given** *range* **instead of auto scan. Valid** *range* **values area** **for example: 192.168.0.0/24, 192.168.0.0/16 or 192.168.0.0/8.** **Currently, acceptable ranges are /8, /16 and /24 only.** - **-l *file*** **Scan ranges contained on the given** *file***. It must contain only one** *range* **per line.** - **-p** **Enable passive mode. In passive mode, netdiscover does not send** **anything, but does only sniff.** - **-m *file*** **Scan a list of known MACs and host names.** - **-F *filter*** **Customize pcap** *filter* **expression (default: "arp").** - **-s *time*** **Sleep given** *time* **in milliseconds between each ARP request** **injection. (default 1)** - **-c *count*** **Number of times to send each ARP request. Useful for networks with** **packet loss, so it will scan given times for each host. (default 1)** - **-n *node*** **Last IP octet of the source IP used for scanning. You can change** **it if the default host (x.x.x.67) is already used. (allowed** *range* **is 2 to 253, default 67)** - **-d** **Ignore configuration files at home dir (for autoscan and fast mode** **only). This will use default ranges and IPs for autoscan and fast** **mode. See below for information about configuration files.** - **-R** **Assume user is root or that he has the required capabilities** **without running any checks.** - **-f** **Enable fast mode scan. This will only scan for .1, .100 and .254** **on each network. This mode is useful while searching for ranges** **being used. After you found such** *range* **you can make a specific** *range* **scan to find online boxes.** - **-P** **Produces an output suitable to be redirected into a** *file* **or to be** **parsed by another program, instead of using interactive mode.** **Enabling this option, netdiscover will stop after scanning given** **ranges.** - **-L** **Similar to -P but continue program execution to capture ARP packets** **passively after the active scan.** **phase to capture ARP packets passively.** - **-N** **Do not print header. Only valid when -P or -L is enabled.** - **-S** **(DEPRECATED) Enable sleep** *time* **suppression between each request.** **If set, netdiscover will sleep after having scanned 255 hosts** **instead of sleeping after each one. This mode was used in** **netdiscover 0.3 beta4 and before. Avoid this option in networks** **with packet loss, or in wireless networks with low signal** **level. (also called hardcore mode)** ## USAGE **If passive mode (-p), scan list (-l) or scan** *range* **(-r) options aren't** **enabled, netdiscover will scan for common LAN addresses (192.168.0.0/16,** **172.16.0.0/12 and 10.0.0.0/8).** **Screen control keys:** ``` h Show help screen. j Scroll down (or down arrow). k Scroll up (or up arrow). . Scroll page up. , Scroll page down. q Close help screen or end application. ``` **Screen views:** ``` a Show ARP replies list. r Show ARP requests list. u Show unique hosts detected. ``` ## CONFIG FILES **There are 2 configuration files that netdiscover will look for, each** *time* **it** **is executed. If files doesn't exist, netdiscover will use default values. You** **can use the -d switch to disable reading and loading configuration files.** - **~/.netdiscover/ranges** **This** *file* **contains a list of ranges (one per line) used for auto scan** **mode instead of default ranges. By default netdiscover will use a list** **of common ranges used on local networks.** **Example:** ``` 192.168.21.0/24 172.26.0.0/16 10.0.0.0/8 ``` - **~/.netdiscover/fastips** **List containing the last octet of the IPs to be scanned on each** **subnet, when using fast mode (-f), by default (1,100,154). You must** **put a number per line.** ## USAGE EXAMPLES **Scan common LAN addresses on eth0:** ``` # netdiscover -i eth0 ``` **Fast scan common LAN addresses on eth0 (search only for gateways):** ``` # netdiscover -i eth0 -f ``` **Scan some fixed ranges:** ``` # netdiscover -i eth0 -r 172.26.0.0/24 # netdiscover -r 192.168.0.0/16 # netdiscover -r 10.0.0.0/8 ``` **Scan common LAN addresses with sleep** *time* **0.5 milliseconds instead of** **default 1:** ``` # netdiscover -s 0.5 ``` **Scan fixed** *range* **on fast mode with sleep** *time* **0.5 milliseconds instead of** **default 1:** ``` # netdiscover -r 192.168.0.0/16 -f -s 0.5 ``` **Scan a** *range* **using 101 as last octet for SOURCE IP** ``` # netdiscover -r 10.1.0.0/16 -n 101 ``` **Only sniff for ARP traffic, don't send nothing:** ``` # netdiscover -p ``` ## AUTHOR **netdiscover was written by Jaime Penalba Estebanez \.** **This manual page was originally written by Nicolas Weyland, for the Debian** **project. This man page has been merged into netdiscover project and** **modified from the original by Jaime Penalba and Joao Eriberto Mota Filho.**