Netdiscover: The ARP-based Network Discovery Tool Every Pentester Should Know
When performing internal network reconnaissance, especially in unknown or restricted environments, one of the most powerful yet underutilized tools in a pentester’s arsenal is Netdiscover. Whether you're trying to identify active hosts or enumerate live systems without triggering alarms, Netdiscover excels in performing stealthy and effective network scans using ARP requests.
In this article, we will explore what Netdiscover is, how it works, its use cases in cybersecurity, detailed command-line options, example outputs, and pro-level tips to maximize its utility.
What is Netdiscover?
Netdiscover is a command-line tool used for ARP reconnaissance in local networks. It helps identify live hosts, their IP addresses, MAC addresses, and vendors, making it particularly useful in situations where traditional discovery tools (like nmap) may be blocked or logged.
It works by either passively listening to ARP traffic on the network or actively sending ARP requests to identify hosts.
How Netdiscover Works (ARP Scanning Explained)
ARP (Address Resolution Protocol) is used in local networks to resolve IP addresses to MAC addresses. When a device wants to communicate within a LAN, it broadcasts an ARP request asking, “Who has IP x.x.x.x? Tell me your MAC.”
Netdiscover takes advantage of this by:
- Passive mode: Listening for ARP requests already on the network.
- Active mode: Broadcasting ARP requests for each IP in the subnet.
This technique allows Netdiscover to:
- Bypass firewall rules that block ICMP or TCP/UDP scans.
- Operate quietly in passive mode (ideal for stealth).
- Quickly identify rogue or undocumented devices.
Installing Netdiscover
On Kali Linux and other Debian-based systems, it comes pre-installed. If not, install it using:
sudo apt update
sudo apt install netdiscover
On Arch-based systems:
sudo pacman -S netdiscover
Netdiscover Command Options (Explained)
| Option | Description |
|---|---|
-i <interface> |
Specify network interface (e.g., eth0, wlan0) |
-r <range> |
Active scan on specific IP range (CIDR) |
-p |
Passive scan (listen only, no ARP requests) |
-s <time> |
Time to sleep between packets |
-c <count> |
Number of times to send ARP request |
-l <file> |
Log results to a file |
-n |
Don’t resolve MAC vendor names |
-f |
Enable fast mode (scan fewer hosts for quicker results) |
-h |
Show help menu |
Common Netdiscover Use Cases
1. Reconnaissance in CTFs / Labs
Quickly map out a newly assigned internal subnet in HackTheBox, TryHackMe, or home labs.
sudo netdiscover -r 10.10.10.0/24
2. Identifying Rogue Devices in Office Networks
Detect unknown devices connected to a corporate LAN.
sudo netdiscover -i eth0 -r 192.168.1.0/24
3. Passive Monitoring for Stealth
For red teams or internal threat hunters, silently observe new devices connecting to the network.
sudo netdiscover -p
This generates no active ARP requests — ideal for avoiding detection by IDS/IPS systems.
Example Outputs
Active Scan Output
sudo netdiscover -r 10.10.10.0/24
Currently scanning: 10.10.10.0/24 | Screen View: Unique Hosts
2 Captured ARP Req/Rep packets, from 2 hosts. Total size: 120
______________________________________________________________________________
IP At MAC Address Count Len MAC Vendor
10.10.10.2 08:00:27:4b:2c:10 5 60 PCS Systemtechnik GmbH
10.10.10.3 08:00:27:f8:8b:10 4 60 Intel Corporate
Passive Scan Output
sudo netdiscover -p
Passive mode enabled: no active ARP requests sent
Listening for ARP replies on eth0...
Discovered:
10.10.10.2 08:00:27:4b:2c:10 PCS Systemtechnik GmbH
10.10.10.3 08:00:27:f8:8b:10 Intel Corporate
Pro Tips & Advanced Usage
Automating Scans with Cron
Schedule periodic scans to track new devices.
sudo crontab -e
Add this line to run every 6 hours:
0 */6 * * * /usr/sbin/netdiscover -r 192.168.1.0/24 -l /var/log/netdiscover_$(date +\%F).log
Using Output with Nmap
Extract IPs and pass to Nmap for deeper analysis:
sudo netdiscover -r 192.168.1.0/24 | awk '{print $1}' > live_hosts.txt
nmap -A -iL live_hosts.txt
Fast Mode for Larger Networks
sudo netdiscover -r 10.0.0.0/16 -f
Scans only first few hosts per subnet — much faster but less exhaustive.
Netdiscover vs. Other Recon Tools
| Tool | Protocol | Stealth | Accuracy | Best Use Case |
|---|---|---|---|---|
| Netdiscover | ARP | High | High | LAN Recon |
| Nmap | ICMP/TCP | Low | High | Port Scanning |
| ARP-scan | ARP | High | High | LAN Scan |
| Ping Sweep | ICMP | Low | Medium | Basic Host Discovery |
Limitations of Netdiscover
- Works only on local subnets (Layer 2) — cannot scan beyond router boundaries.
- No port scanning or service detection — it only tells you what is online.
- Not ideal for IPv6 networks, as ARP is used in IPv4.
Conclusion
Netdiscover is a lightweight, powerful, and stealthy tool for internal network reconnaissance. Its ARP-based discovery makes it ideal for environments where traditional scanners like Nmap may be detected or blocked. Whether you're a penetration tester, red teamer, network administrator, or CTF player, Netdiscover is a must-have for mapping your immediate network surroundings.
Summary
- Tool: Netdiscover
- Function: ARP-based host discovery
- Modes: Active & Passive
- Strengths: Fast, Stealthy, Effective in LANs
- Limitations: No port scan, no Layer 3 routing