1. Tool Introduction
Netdiscover is an active/passive ARP reconnaissance tool, originally developed for wireless networks without a DHCP server, but equally useful on any wired LAN. It works by sending ARP requests across a range of addresses and listening for replies, which reveals live hosts along with their MAC addresses and, when possible, the vendor/manufacturer associated with the MAC’s OUI prefix. Because it operates at Layer 2, Netdiscover is fast, stealthy relative to Layer 3 scanners, and does not require IP routing — making it a go-to first step for enumerating devices on a local segment during an internal penetration test.
2. Installation
sudo apt update
sudo apt install netdiscover -y
Verify:
netdiscover --version
Expected output:
Netdiscover version 0.8.5
3. Syntax
netdiscover [OPTIONS]
4. Command-Line Options (Full Reference)
-i <interface>— Use specified network interface-r <range>— Scan a given CIDR range (e.g.,192.168.1.0/24) instead of auto-detecting-l <file>— Scan a list of ranges from a file-p— Passive mode: only sniff ARP traffic, don’t send any requests-m <file>— Use a custom MAC vendor OUI file-F <filter>— Custom pcap filter expression-s <milliseconds>— Set time to sleep between each ARP request-c <count>— Number of times to send each ARP request-n <node>— Set last source IP octet for requests-d— Ignore local ARP cache entries when displaying results-S— Enable sleep time auto-adjustment (rate limiting)-f— Enable “fast” mode — scan only for the first IP in the range that responds (used with-r)-P— Print results in a script-friendly (parsable) format, then exit-L— Similar to-Pbut loop continuously, useful for logging-N— Do not print the header banner--help— Show help/usage summary
5. Basic Usage
sudo netdiscover -i eth0
Expected output:
Currently scanning: 192.168.1.0/24 | Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240
_____________________________________________________________________________
IP At MAC Address Count Len MAC Vendor / Hostname
-----------------------------------------------------------------------------
192.168.1.1 aa:bb:cc:11:22:33 1 60 TP-Link Corporation
192.168.1.10 de:ad:be:ef:00:01 1 60 Dell Inc.
192.168.1.15 11:22:33:44:55:66 1 60 Apple, Inc.
6. Practical Examples
Example 1 — Auto-detect interface and scan local range
sudo netdiscover
Currently scanning: 192.168.1.0/24 | Screen View: Unique Hosts
3 Captured ARP Req/Rep packets, from 3 hosts.
192.168.1.1 aa:bb:cc:dd:ee:ff 1 60 Netgear
Example 2 — Specify a target range explicitly
sudo netdiscover -r 10.10.10.0/24
Currently scanning: 10.10.10.0/24 | Screen View: Unique Hosts
10.10.10.1 00:11:22:33:44:55 1 60 Cisco Systems
10.10.10.5 66:77:88:99:aa:bb 1 60 VMware, Inc.
Example 3 — Passive mode (listen only, send nothing)
sudo netdiscover -p -i eth0
Currently sniffing on eth0
192.168.1.20 cc:dd:ee:ff:00:11 2 120 Samsung Electronics
Example 4 — Fast mode to quickly find the first live host
sudo netdiscover -r 192.168.1.0/24 -f
192.168.1.1 aa:bb:cc:dd:ee:ff 1 60 TP-Link Corporation
Example 5 — Scan a list of ranges from a file
sudo netdiscover -l ranges.txt
Currently scanning: (multiple ranges from ranges.txt)
10.0.0.5 11:22:33:44:55:66 1 60 Hewlett Packard
172.16.5.9 aa:11:bb:22:cc:33 1 60 Raspberry Pi Foundation
Example 6 — Adjust request sleep interval for a quiet, slow scan
sudo netdiscover -r 192.168.1.0/24 -s 500
Currently scanning: 192.168.1.0/24 (slower, stealthier)
192.168.1.10 de:ad:be:ef:00:01 1 60 Dell Inc.
Example 7 — Script-friendly parsable output
sudo netdiscover -r 192.168.1.0/24 -P
192.168.1.1,aa:bb:cc:dd:ee:ff,1,60,TP-Link Corporation
192.168.1.10,de:ad:be:ef:00:01,1,60,Dell Inc.
Example 8 — Continuous logging loop
sudo netdiscover -r 192.168.1.0/24 -L >> arp_log.csv
[appends new discoveries to arp_log.csv continuously]
Example 9 — Increase repeat count per host for reliability
sudo netdiscover -r 192.168.1.0/24 -c 3
192.168.1.15 11:22:33:44:55:66 3 180 Apple, Inc.
Example 10 — Use a custom pcap filter
sudo netdiscover -i eth0 -F "arp and host 192.168.1.50"
192.168.1.50 aa:bb:cc:dd:ee:ff 1 60 Unknown Vendor
7. Common Use Cases
- First step during internal/on-site penetration tests to enumerate hosts on a LAN without needing DHCP or a routable configuration.
- Passive reconnaissance to quietly observe ARP traffic without generating detectable requests.
- Identifying rogue or unexpected devices connected to a network segment.
- Wireless network host discovery immediately after associating to an access point.
8. Automation with Bash
#!/bin/bash
# netdiscover_sweep.sh - passive then active sweep, log results
IFACE="eth0"
RANGE="192.168.1.0/24"
OUT="netdiscover_results.csv"
echo "[*] Passive listen for 30 seconds..."
timeout 30 sudo netdiscover -p -i "$IFACE" -P > "$OUT"
echo "[*] Active ARP sweep of $RANGE..."
sudo netdiscover -r "$RANGE" -P >> "$OUT"
echo "[+] Combined results saved to $OUT"
sort -u "$OUT" -o "$OUT"
9. Tips and Best Practices
- Run with
sudo, since ARP packet crafting and raw socket access require root privileges. - Use
-p(passive mode) first on sensitive networks to avoid generating traffic that could trigger IDS alerts. - Combine with
arp-scanto cross-validate results, since each tool has slightly different timing/output behavior. - Use
-Pfor parsable output whenever piping into other scripts or tools. - Increase
-s(sleep) to slow down scanning and reduce the chance of detection on monitored networks.
10. Troubleshooting
- No hosts discovered despite known live devices: verify you’re on the correct interface with
-i, and ensure you are physically on the same broadcast domain (ARP does not cross routers/VLANs). - “Unable to find default interface” error: manually specify with
-i eth0(or the appropriate interface name fromip a). - Duplicate entries for the same host: some devices respond from multiple virtual interfaces; deduplicate with
sort -uon parsable output. - Netdiscover freezes on large ranges: reduce the CIDR scope or increase
-ssleep interval to avoid overwhelming the local segment.
11. References
- GitHub repository: https://github.com/netdiscover-scanner/netdiscover
- Kali Linux tool page: https://www.kali.org/tools/netdiscover/
- Man page:
man netdiscover(installed locally)