Table of Contents
- Overview
- Installation
- Basic Usage
- Scan Modes
- Output Options
- Advanced Features
- Best Practices
- Troubleshooting
Overview
Netdiscover is an active/passive ARP reconnaissance tool, useful for network discovery and mapping local networks without the need for SNMP.
Key Features
- Active and passive ARP scanning
- Network range scanning
- MAC vendor identification
- Fast host discovery
- Interface selection
- Custom scan ranges
- Multiple output formats
- Low network footprint
Installation
Ubuntu (22.04/24.04)
# Install netdiscover
sudo apt update
sudo apt install netdiscover
Build from Source
# Install dependencies
sudo apt install build-essential libpcap-dev
# Clone and build
git clone https://github.com/netdiscover-scanner/netdiscover.git
cd netdiscover
./configure
make
sudo make install
Basic Usage
Simple Scans
# Basic scan
sudo netdiscover
# Scan specific range
sudo netdiscover -r 192.168.1.0/24
# Scan with specific interface
sudo netdiscover -i eth0
# Fast scan
sudo netdiscover -f
Common Options
# Passive mode
sudo netdiscover -p
# Show only active hosts
sudo netdiscover -N
# Custom sleep time
sudo netdiscover -s 1
Scan Modes
Active Scanning
# Full range scan
sudo netdiscover -r 192.168.1.0/24
# Multiple ranges
sudo netdiscover -r 192.168.1.0/24,10.0.0.0/24
# Specific interface scan
sudo netdiscover -i eth0 -r 192.168.1.0/24
Passive Scanning
# Basic passive mode
sudo netdiscover -p
# Passive with interface
sudo netdiscover -p -i eth0
# Passive with timeout
sudo netdiscover -p -L -t 3600
Custom Scans
# Fast mode
sudo netdiscover -f -r 192.168.1.0/24
# Slow mode
sudo netdiscover -s 1 -r 192.168.1.0/24
# No header mode
sudo netdiscover -N -r 192.168.1.0/24
Output Options
Display Formats
# No header output
sudo netdiscover -N
# Quiet mode
sudo netdiscover -q
# Show packets
sudo netdiscover -d
File Output
# Write to file
sudo netdiscover -r 192.168.1.0/24 > network_map.txt
# Append to file
sudo netdiscover -r 192.168.1.0/24 >> network_map.txt
# With timestamp
sudo netdiscover -r 192.168.1.0/24 | ts > network_map.txt
Advanced Features
Interface Control
# List interfaces
sudo netdiscover -l
# Multiple interfaces
sudo netdiscover -i eth0,wlan0
# Specific interface options
sudo netdiscover -i eth0 -f
Range Control
# Custom range
sudo netdiscover -r 192.168.1.1-192.168.1.254
# Multiple subnets
sudo netdiscover -r 192.168.1.0/24,172.16.0.0/16
# Exclude ranges
sudo netdiscover -r 192.168.1.0/24 -x 192.168.1.1/32
Timing Options
# Fast scan
sudo netdiscover -f
# Custom sleep time
sudo netdiscover -s 0.5
# Extended timeout
sudo netdiscover -t 3600
Best Practices
Scanning Guidelines
# Network discovery
sudo netdiscover -r 192.168.1.0/24 -f -N
# Passive monitoring
sudo netdiscover -p -i eth0 -L
# Thorough scan
sudo netdiscover -r 192.168.1.0/24 -s 1
Resource Management
# Low impact scan
sudo netdiscover -s 2 -r 192.168.1.0/24
# Fast network mapping
sudo netdiscover -f -N -r 192.168.1.0/24
# Extended monitoring
sudo netdiscover -p -L -t 7200
Quick Reference
Essential Commands
# Basic scan
sudo netdiscover
# Range scan
sudo netdiscover -r 192.168.1.0/24
# Passive mode
sudo netdiscover -p
# Fast scan
sudo netdiscover -f
Common Options
-r # Scan range
-i # Interface
-p # Passive mode
-f # Fast mode
-s # Sleep time
-N # No header
-L # List mode
Example Scripts
Network Mapping Script
#!/bin/bash
# Comprehensive network mapping
OUTPUT_DIR="netdiscover_results"
INTERFACE="eth0"
NETWORK="192.168.1.0/24"
mkdir -p "$OUTPUT_DIR"
timestamp=$(date +%Y%m%d_%H%M%S)
# Active scan
echo "Running active scan..."
sudo netdiscover -i "$INTERFACE" \
-r "$NETWORK" \
-N > "$OUTPUT_DIR/active_scan_${timestamp}.txt"
# Passive scan
echo "Running passive scan..."
sudo timeout 300 netdiscover -p -i "$INTERFACE" \
-N > "$OUTPUT_DIR/passive_scan_${timestamp}.txt"
Continuous Monitoring
#!/bin/bash
# Continuous network monitoring
INTERFACE="eth0"
LOG_DIR="netdiscover_logs"
ROTATE_SIZE=100M
mkdir -p "$LOG_DIR"
rotate_logs() {
if [ $(du -s "$LOG_DIR" | cut -f1) -gt $(numfmt --from=iec $ROTATE_SIZE) ]; then
oldest_file=$(ls -t "$LOG_DIR" | tail -n 1)
rm "$LOG_DIR/$oldest_file"
fi
}
while true; do
timestamp=$(date +%Y%m%d_%H%M%S)
log_file="$LOG_DIR/netdiscover_${timestamp}.log"
sudo netdiscover -p -i "$INTERFACE" -N > "$log_file" &
pid=$!
sleep 3600 # Run for 1 hour
kill $pid
rotate_logs
done
Network Change Detection
#!/bin/bash
# Detect network changes
NETWORK="192.168.1.0/24"
BASELINE="baseline.txt"
CURRENT="current.txt"
DIFF="changes.txt"
# Create baseline if it doesn't exist
if [ ! -f "$BASELINE" ]; then
sudo netdiscover -r "$NETWORK" -N > "$BASELINE"
echo "Baseline created"
exit 0
fi
# Current scan
sudo netdiscover -r "$NETWORK" -N > "$CURRENT"
# Compare results
diff "$BASELINE" "$CURRENT" > "$DIFF"
if [ -s "$DIFF" ]; then
echo "Network changes detected:"
cat "$DIFF"
# Update baseline
mv "$CURRENT" "$BASELINE"
else
echo "No changes detected"
rm "$CURRENT"
fi
Remember:
- Always run with sudo
- Consider network impact
- Use appropriate scan speeds
- Document findings
- Regular monitoring
- Handle results securely
For detailed information, consult the netdiscover documentation (man netdiscover
).