netdiscover — ARP Host Discovery
Ctrl+F:
netdiscover·-i eth0·-r· ARP scan · VirtualBox · lab VM IP
What is netdiscover?
netdiscover sends ARP requests on a local Ethernet segment and lists hosts that reply. It does not need open ports — it finds live MAC/IP pairs on your LAN.
OSCP / lab use: After importing a VM (VirtualBox, VMware, HackTheBox VPN lab on same subnet), you often don’t know the box IP. Run netdiscover before
nmapto find it.
Install (Kali)
sudo apt update && sudo apt install -y netdiscover
which netdiscoverSyntax
netdiscover [options]📌 1) All Common Flags
| Flag | Description |
|---|---|
-i <iface> | Network interface (e.g. eth0, tun0, wlan0) |
-r <range> | IP range to scan (e.g. 192.168.1.0/24, 192.168.1.1-254) |
-p | Passive mode — only listen for ARP traffic (no active probes) |
-l <file> | Load range from file |
-f <file> | Enable fast mode (first + last IP in range) |
-s <seconds> | Sleep time between ARP requests (default 1) |
-c <count> | Number of ARP requests per IP |
-n <node> | Last IP octet for fast mode auto-detect |
-d <mask> | Custom netmask for auto-detect |
-P | Do not print header |
-S <seconds> | Time to sleep when no ARP activity (passive mode) |
-N | Do not resolve MAC vendor |
📌 2) OSCP / Lab Workflow
DC-9 style — find VM IP after VirtualBox import
# Identify your interface
ip a
# Look for eth0 / ens33 on 192.168.x.x
# Active ARP scan on local segment
sudo netdiscover -i eth0
# Or explicit range
sudo netdiscover -i eth0 -r 192.168.185.0/24Example output:
Currently scanning: 192.168.185.0/16 | Screen View: Unique Hosts
IP At MAC Address Count Len MAC Vendor / Hostname
192.168.185.1 00-50-56-c0-00-08 1 60 VMware
192.168.185.217 08-00-27-xx-xx-xx 1 60 PCS Systemtechnik GmbH ← targetThen scan the discovered IP:
nmap -sC -sV -p- 192.168.185.217 -oN nmap/target.txt📌 3) Common Examples
# Auto-detect range on interface (most common)
sudo netdiscover -i eth0
# HTB / lab VPN — sometimes tun0
sudo netdiscover -i tun0
# Specific /24
sudo netdiscover -i eth0 -r 192.168.56.0/24
# Passive — sniff ARP only (stealthier on shared LAN)
sudo netdiscover -i eth0 -p
# Faster sweep (adjust sleep)
sudo netdiscover -i eth0 -r 192.168.1.0/24 -s 0📌 4) netdiscover vs nmap vs rustscan
| Tool | Layer | When to use |
|---|---|---|
| netdiscover | ARP (L2) | Don’t know target IP on local subnet |
| nmap -sn | ICMP/ARP | Host discovery when you know subnet |
| RustScan / nmap -p- | TCP ports | After you have the IP — find services |
# nmap host discovery alternative (needs range)
nmap -sn 192.168.185.0/24
# ARP scan via nmap (same segment, needs root)
sudo nmap -PR -sn 192.168.185.0/24Workflow: netdiscover → get IP → Nmap full port scan → UseCases for ports
📌 5) Troubleshooting
| Problem | Fix |
|---|---|
| No results | Wrong interface — ip a and match subnet |
| Only gateway shows | VM network = NAT vs Bridged — set Bridged/Host-only in VirtualBox |
| Permission denied | Run with sudo (raw sockets) |
| Wrong subnet | Match -r to your ip a address (e.g. 192.168.185.0/24) |
📌 Quick Cheat Sheet
ip a
sudo netdiscover -i eth0
sudo netdiscover -i eth0 -r 192.168.185.0/24
nmap -sC -sV -p- <DISCOVERED_IP>