NAME

       netdiscover - active/passive ARP reconnaissance tool

SYNOPSIS

       netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter]
                   [-s time] [-c count] [-n node] [-dfPLNS]

DESCRIPTION

       netdiscover  is  an  active/passive  ARP  reconnaissance tool, initially developed to gain
       information about wireless networks without DHCP servers in wardriving scenarios.  It  can
       also  be  used  on switched networks. Built on top of libnet and libpcap, it can passively
       detect online hosts or search for them by sending ARP requests.

       Furthermore, it can be used to  inspect  your  network's  ARP  traffic,  or  find  network
       addresses using auto scan mode, which will scan for common local networks.

OPTIONS

       -i device
              The  network  interface  to sniff and inject packets. If no interface is specified,
              first available will be used.

       -r range
              Scan a given range instead of auto scan.  Valid  range  values  area  for  example:
              192.168.0.0/24,  192.168.0.0/16 or 192.168.0.0/8.  Currently, acceptable ranges are
              /8, /16 and /24 only.

       -l file
              Scan ranges contained on the given file. It must contain only one range per line.

       -p     Enable passive mode. In passive mode, netdiscover does not send anything, but  does
              only sniff.

       -m file
              Scan a list of known MACs and host names.

       -F filter
              Customize pcap filter expression (default: "arp").

       -s time
              Sleep given time in milliseconds between each ARP request injection. (default 1)

       -c count
              Number  of times to send each ARP request. Useful for networks with packet loss, so
              it will scan given times for each host. (default 1)

       -n node
              Last IP octet of the source IP used for scanning. You can change it if the  default
              host (x.x.x.67) is already used. (allowed range is 2 to 253, default 67)

       -d     Ignore configuration files at home dir (for autoscan and fast mode only). This will
              use default ranges and IPs for autoscan and fast mode. See  below  for  information
              about configuration files.

       -f     Enable  fast  mode scan. This will only scan for .1, .100 and .254 on each network.
              This mode is useful while searching for ranges being used.  After  you  found  such
              range you can make a specific range scan to find online boxes.

       -P     Produces an output suitable to be redirected into a file or to be parsed by another
              program, instead of using interactive mode.  Enabling this option, netdiscover will
              stop after scanning given ranges.

       -L     Similar to -P but continue program execution to capture ARP packets passively after
              the active scan.  phase to capture ARP packets passively.

       -N     Do not print header. Only valid when -P or -L is enabled.

       -S     (DEPRECATED)  Enable  sleep  time  suppression  between  each  request.   If   set,
              netdiscover  will  sleep  after  having scanned 255 hosts instead of sleeping after
              each one. This mode was used in netdiscover 0.3 beta4 and before. Avoid this option
              in  networks with packet loss, or in wireless networks with low signal level. (also
              called hardcore mode)

USAGE

       If passive mode  (-p),  scan  list  (-l)  or  scan  range  (-r)  options  aren't  enabled,
       netdiscover  will  scan  for  common  LAN  addresses  (192.168.0.0/16,  172.16.0.0/12  and
       10.0.0.0/8).

       Screen control keys:

           h  Show help screen.
           j  Scroll down (or down arrow).
           k  Scroll up (or up arrow).
           .  Scroll page up.
           ,  Scroll page down.
           q  Close help screen or end application.

       Screen views:

           a  Show ARP replies list.
           r  Show ARP requests list.
           u  Show unique hosts detected.

CONFIG FILES

       There are 2 configuration files that netdiscover will look for, each time it is  executed.
       If  files doesn't exist, netdiscover will use default values. You can use the -d switch to
       disable reading and loading configuration files.

       ~/.netdiscover/ranges
              This file contains a list of ranges (one per line) used for auto scan mode  instead
              of  default ranges. By default netdiscover will use a list of common ranges used on
              local networks.

       Example:

           192.168.21.0/24
           172.26.0.0/16
           10.0.0.0/8

       ~/.netdiscover/fastips
              List containing the last octet of the IPs to be scanned on each subnet, when  using
              fast mode (-f), by default (1,100,154). You must put a number per line.

USAGE EXAMPLES

       Scan common LAN addresses on eth0:

           # netdiscover -i eth0

       Fast scan common LAN addresses on eth0 (search only for gateways):

           # netdiscover -i eth0 -f

       Scan some fixed ranges:

           # netdiscover -i eth0 -r 172.26.0.0/24
           # netdiscover -r 192.168.0.0/16
           # netdiscover -r 10.0.0.0/8

       Scan common LAN addresses with sleep time 0.5 milliseconds instead of default 1:

           # netdiscover -s 0.5

       Scan fixed range on fast mode with sleep time 0.5 milliseconds instead of default 1:

           # netdiscover -r 192.168.0.0/16 -f -s 0.5

       Scan a range using 101 as last octet for SOURCE IP

           # netdiscover -r 10.1.0.0/16 -n 101

       Only sniff for ARP traffic, don't send nothing:

           # netdiscover -p

AUTHOR

       netdiscover was written by Jaime Penalba Estebanez <jpenalbae@gmail.com>.

       This  manual  page was originally written by Nicolas Weyland, for the Debian project. This
       man page has been merged into netdiscover project and modified from the original by  Jaime
       Penalba and Joao Eriberto Mota Filho.