netdiscover: Active/passive reconnaissance tool for networks

1. Tool Introduction

Netdiscover is an active/passive ARP reconnaissance tool, originally developed for wireless networks without a DHCP server, but equally useful on any wired LAN. It works by sending ARP requests across a range of addresses and listening for replies, which reveals live hosts along with their MAC addresses and, when possible, the vendor/manufacturer associated with the MAC’s OUI prefix. Because it operates at Layer 2, Netdiscover is fast, stealthy relative to Layer 3 scanners, and does not require IP routing — making it a go-to first step for enumerating devices on a local segment during an internal penetration test.

2. Installation

sudo apt update
sudo apt install netdiscover -y

Verify:

netdiscover --version

Expected output:

Netdiscover version 0.8.5

3. Syntax

netdiscover [OPTIONS]

4. Command-Line Options (Full Reference)

• -i <interface> — Use specified network interface
• -r <range> — Scan a given CIDR range (e.g., 192.168.1.0/24) instead of auto-detecting
• -l <file> — Scan a list of ranges from a file
• -p — Passive mode: only sniff ARP traffic, don’t send any requests
• -m <file> — Use a custom MAC vendor OUI file
• -F <filter> — Custom pcap filter expression
• -s <milliseconds> — Set time to sleep between each ARP request
• -c <count> — Number of times to send each ARP request
• -n <node> — Set last source IP octet for requests
• -d — Ignore local ARP cache entries when displaying results
• -S — Enable sleep time auto-adjustment (rate limiting)
• -f — Enable “fast” mode — scan only for the first IP in the range that responds (used with -r)
• -P — Print results in a script-friendly (parsable) format, then exit
• -L — Similar to -P but loop continuously, useful for logging
• -N — Do not print the header banner
• --help — Show help/usage summary

5. Basic Usage

sudo netdiscover -i eth0

Expected output:

 Currently scanning: 192.168.1.0/24   |   Screen View: Unique Hosts

 4 Captured ARP Req/Rep packets, from 4 hosts.   Total size: 240
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname
 -----------------------------------------------------------------------------
 192.168.1.1     aa:bb:cc:11:22:33      1      60  TP-Link Corporation
 192.168.1.10    de:ad:be:ef:00:01      1      60  Dell Inc.
 192.168.1.15    11:22:33:44:55:66      1      60  Apple, Inc.

6. Practical Examples

Example 1 — Auto-detect interface and scan local range

sudo netdiscover

Currently scanning: 192.168.1.0/24 | Screen View: Unique Hosts
3 Captured ARP Req/Rep packets, from 3 hosts.
192.168.1.1   aa:bb:cc:dd:ee:ff   1   60   Netgear

Example 2 — Specify a target range explicitly

sudo netdiscover -r 10.10.10.0/24

Currently scanning: 10.10.10.0/24 | Screen View: Unique Hosts
10.10.10.1   00:11:22:33:44:55   1   60   Cisco Systems
10.10.10.5   66:77:88:99:aa:bb   1   60   VMware, Inc.

Example 3 — Passive mode (listen only, send nothing)

sudo netdiscover -p -i eth0

Currently sniffing on eth0
192.168.1.20   cc:dd:ee:ff:00:11   2   120   Samsung Electronics

Example 4 — Fast mode to quickly find the first live host

sudo netdiscover -r 192.168.1.0/24 -f

192.168.1.1   aa:bb:cc:dd:ee:ff   1   60   TP-Link Corporation

Example 5 — Scan a list of ranges from a file

sudo netdiscover -l ranges.txt

Currently scanning: (multiple ranges from ranges.txt)
10.0.0.5    11:22:33:44:55:66   1   60   Hewlett Packard
172.16.5.9  aa:11:bb:22:cc:33   1   60   Raspberry Pi Foundation

Example 6 — Adjust request sleep interval for a quiet, slow scan

sudo netdiscover -r 192.168.1.0/24 -s 500

Currently scanning: 192.168.1.0/24 (slower, stealthier)
192.168.1.10   de:ad:be:ef:00:01   1   60   Dell Inc.

Example 7 — Script-friendly parsable output

sudo netdiscover -r 192.168.1.0/24 -P

192.168.1.1,aa:bb:cc:dd:ee:ff,1,60,TP-Link Corporation
192.168.1.10,de:ad:be:ef:00:01,1,60,Dell Inc.

Example 8 — Continuous logging loop

sudo netdiscover -r 192.168.1.0/24 -L >> arp_log.csv

[appends new discoveries to arp_log.csv continuously]

Example 9 — Increase repeat count per host for reliability

sudo netdiscover -r 192.168.1.0/24 -c 3

192.168.1.15   11:22:33:44:55:66   3   180   Apple, Inc.

Example 10 — Use a custom pcap filter

sudo netdiscover -i eth0 -F "arp and host 192.168.1.50"

192.168.1.50   aa:bb:cc:dd:ee:ff   1   60   Unknown Vendor

7. Common Use Cases

• First step during internal/on-site penetration tests to enumerate hosts on a LAN without needing DHCP or a routable configuration.
• Passive reconnaissance to quietly observe ARP traffic without generating detectable requests.
• Identifying rogue or unexpected devices connected to a network segment.
• Wireless network host discovery immediately after associating to an access point.

8. Automation with Bash

#!/bin/bash
# netdiscover_sweep.sh - passive then active sweep, log results
IFACE="eth0"
RANGE="192.168.1.0/24"
OUT="netdiscover_results.csv"

echo "[*] Passive listen for 30 seconds..."
timeout 30 sudo netdiscover -p -i "$IFACE" -P > "$OUT"

echo "[*] Active ARP sweep of $RANGE..."
sudo netdiscover -r "$RANGE" -P >> "$OUT"

echo "[+] Combined results saved to $OUT"
sort -u "$OUT" -o "$OUT"

9. Tips and Best Practices

• Run with sudo, since ARP packet crafting and raw socket access require root privileges.
• Use -p (passive mode) first on sensitive networks to avoid generating traffic that could trigger IDS alerts.
• Combine with arp-scan to cross-validate results, since each tool has slightly different timing/output behavior.
• Use -P for parsable output whenever piping into other scripts or tools.
• Increase -s (sleep) to slow down scanning and reduce the chance of detection on monitored networks.

10. Troubleshooting

• No hosts discovered despite known live devices: verify you’re on the correct interface with -i, and ensure you are physically on the same broadcast domain (ARP does not cross routers/VLANs).
• “Unable to find default interface” error: manually specify with -i eth0 (or the appropriate interface name from ip a).
• Duplicate entries for the same host: some devices respond from multiple virtual interfaces; deduplicate with sort -u on parsable output.
• Netdiscover freezes on large ranges: reduce the CIDR scope or increase -s sleep interval to avoid overwhelming the local segment.

11. References

• GitHub repository: https://github.com/netdiscover-scanner/netdiscover
• Kali Linux tool page: https://www.kali.org/tools/netdiscover/
• Man page: man netdiscover (installed locally)