工具说明书 - netdiscover

netdiscover

译文

Netdiscover 是一款主动/被动地址侦查工具，主要为那些没有 dhcp 服务器的无线网络开发，适用于巡查时使用。它也可用于集线器/交换网络。

它建立在 libnet 和 libpcap 的基础上，可以被动检测在线主机，或通过主动发送 ARP 请求来搜索主机。

Netdiscover 还可用于检测网络 ARP 流量，或使用自动扫描模式查找网络地址，该模式将扫描常见的本地网络。

Netdiscover 使用 OUI 表显示发现的每个 MAC 地址的供应商，这对安全检查或 pentests 非常有用。

root@kali:~# netdiscover --help

Netdiscover 0.10 [主动/被动 ARP 侦查工具]
撰写者: Jaime Penalba <jpenalbae@gmail.com>

使用方法: netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter] [-s time] [-c count] [-n node] [-dfPLNS]
  -i 设备: 您的网络设备
  -r 范围: 扫描指定范围，而不是自动扫描. 192.168.6.0/24,/16,/8
  -l 文件: 扫描给定文件中包含的范围列表
  -p 被动模式: 不要发送任何东西, 只嗅探
  -m 文件: 扫描已知 MAC 和主机名列表
  -F 过滤: 自定义 pcap 过滤器表达式 (默认: "arp")
  -s 时间: 每次 ARP 请求之间的休眠时间 (毫秒数)
  -c 次数: 发送每个 ARP 请求的次数 (对于有数据包丢失的网络)
  -n node: last source IP octet used for scanning (from 2 to 253)
  -d 忽略自动扫描和快速模式的主配置文件
  -f 启用快速模式扫描, 节省大量时间, 推荐自动
  -P 以适合其他程序解析的格式打印结果 并在活动扫描后停止打印
  -L 与 -P 类似，但在主动扫描完成后继续监听
  -N 不打印页眉. 仅在启用 -P 或 -L 时有效.
  -S 启用每次请求之间的睡眠时间抑制 (硬核模式)

如果 -r, -l 或者 -p 没有启用, netdiscover 将扫描通用局域网地址.

原文

Netdiscover is an active/passive address reconnaissance tool, mainly developed for those wireless networks without dhcp server, when you are wardriving. It can be also used on hub/switched networks.

Built on top of libnet and libpcap, it can passively detect online hosts, or search for them, by actively sending ARP requests.

Netdiscover can also be used to inspect your network ARP traffic, or find network addresses using auto scan mode, which will scan for common local networks.

Netdiscover uses the OUI table to show the vendor of the each MAC address discovered and is very useful for security checks or in pentests.

root@kali:~# netdiscover --help

Netdiscover 0.10 [Active/passive ARP reconnaissance tool]
Written by: Jaime Penalba <jpenalbae@gmail.com>

Usage: netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter] [-s time] [-c count] [-n node] [-dfPLNS]
  -i device: your network device
  -r range: scan a given range instead of auto scan. 192.168.6.0/24,/16,/8
  -l file: scan the list of ranges contained into the given file
  -p passive mode: do not send anything, only sniff
  -m file: scan a list of known MACs and host names
  -F filter: customize pcap filter expression (default: "arp")
  -s time: time to sleep between each ARP request (milliseconds)
  -c count: number of times to send each ARP request (for nets with packet loss)
  -n node: last source IP octet used for scanning (from 2 to 253)
  -d ignore home config files for autoscan and fast mode
  -f enable fastmode scan, saves a lot of time, recommended for auto
  -P print results in a format suitable for parsing by another program and stop after active scan
  -L similar to -P but continue listening after the active scan is completed
  -N Do not print header. Only valid when -P or -L is enabled.
  -S enable sleep time suppression between each request (hardcore mode)

If -r, -l or -p are not enabled, netdiscover will scan for common LAN addresses.