netdiscover(8)

💖 netdiscover — the manual page (but make it cute)

okay bestie, welcome to the netdiscover(8) glow-up. this is a section 8 manual page for netdiscover, the active/passive ARP reconnaissance tool. yes it's a real tool, yes it's iconic, and yes we're going to read the whole thing together. no skimming. 🫶

---

✨ NAME ✨

netdiscover — active/passive ARP reconnaissance tool

---

🌸 SYNOPSIS 🌸

netdiscover [-i device] [-r range | -l file | -p] [-m file] [-F filter]
            [-s time] [-c count] [-n node] [-dfPLNS]

like. look at that. all those little flags just vibing together. slay.

---

🦋 DESCRIPTION 🦋

so netdiscover is an active/passive ARP reconnaissance tool, and it was originally built to get info about wireless networks that have no DHCP servers — you know, wardriving scenarios. main character energy from day one fr fr. it also works totally fine on switched networks.

it's built on top of libnet and libpcap, which means it can passively detect online hosts, or go out there and search for them by sending ARP requests. lowkey powerful.

and wait, there's more: you can also use it to inspect your network's ARP traffic, or find network addresses using auto scan mode, which scans for common local networks. she does it all. 💅

---

👑 OPTIONS 👑

every single one. we're not skipping a single flag, bestie. this is a full set, no crumbs.

• -i device — the network interface to sniff and inject packets on. if you don't specify one, the first available interface gets used. she'll pick for you, she's generous like that.
• -r range — scan a given range instead of doing auto scan. valid range values include, for example: 192.168.0.0/24, 192.168.2.0/23, 192.168.0.0/12, 192.168.0.0/8. note that netdiscover is also a passive scanner, so all detected IPs get displayed, in addition to the ones inside the range you specified. it's giving overachiever.
• -l file — scan the ranges contained in the given file. it must contain only one range per line. one. per. line. don't get creative.
• -p — enable passive mode. in passive mode, netdiscover does not send anything, it only sniffs. literally just vibing and watching. 🙈
• -m file — scan a list of known MACs and host names.
• -F filter — customize the pcap filter expression (default: "arp").
• -s time — sleep the given time in milliseconds between each ARP request injection. (default 1)
• -c count — number of times to send each ARP request. useful on networks with packet loss, so it'll scan the given number of times for each host. (default 1)
• -n node — last IP octet of the source IP used for scanning. you can change it if the default host (x.x.x.67) is already taken. (allowed range is 2 to 253, default 67)
• -d — ignore the configuration files in your home dir (for autoscan and fast mode only). this makes it use the default ranges and IPs for autoscan and fast mode. there's more info about config files further down, keep scrolling. ⬇️
• -R — assume the user is root, or that they have the required capabilities, without running any checks. bold. confident. no notes.
• -f — enable fast mode scan. this only scans for .1, .100 and .254 on each network. super useful when you're hunting for ranges that are actually in use. once you find one, you can go do a specific range scan to find the online boxes. it's giving recon speedrun. 🔥
• -P — produces output suitable to be redirected into a file or parsed by another program, instead of using interactive mode. with this enabled, netdiscover stops after scanning the given ranges.
• -L — similar to -P, but it keeps the program running to capture ARP packets passively after the active scan phase, to capture ARP packets passively.
• -N — do not print the header. only valid when -P or -L is enabled.
• -S — (DEPRECATED) enable sleep time suppression between each request. if set, netdiscover will sleep after having scanned 255 hosts instead of sleeping after each one. this mode was used in netdiscover 0.3 beta4 and before. > ⚠️ avoid this option on networks with packet loss, or on wireless networks with a low signal level. (also called hardcore mode) — and yeah it's called that for a reason, bestie.

---

🌈 USAGE 🌈

if passive mode (-p), scan list (-l) or scan range (-r) aren't enabled, netdiscover will scan for common LAN addresses: 192.168.0.0/16, 172.16.0.0/12 and 10.0.0.0/8.

Screen control keys:

• h — show help screen.
• j — scroll down (or down arrow).
• k — scroll up (or up arrow).
• . — scroll page up.
• , — scroll page down.
• q — close help screen or end application.

Screen views:

• a — show ARP replies list.
• r — show ARP requests list.
• u — show unique hosts detected.

---

🎀 CONFIG FILES 🎀

there are 2 configuration files that netdiscover looks for, each time it's executed. if the files don't exist, netdiscover just uses default values. you can use the -d switch to disable reading and loading config files entirely. (boundaries! we love to see it.)

~/.netdiscover/ranges

this file contains a list of ranges (one per line) used for auto scan mode instead of the default ranges. by default, netdiscover uses a list of common ranges used on local networks.

Example:

192.168.21.0/24
172.24.0.0/14
10.0.0.0/12

~/.netdiscover/fastips

a list containing the last octet of the IPs to be scanned on each subnet, when using fast mode (-f), by default (1,100,154). you must put a number per line.

---

⭐ USAGE EXAMPLES ⭐

okay now the fun part. copy these, they're exact, don't freestyle. 🧚

scan common LAN addresses on eth0:

# netdiscover -i eth0

fast scan common LAN addresses on eth0 (search only for gateways):

# netdiscover -i eth0 -f

scan some fixed ranges:

# netdiscover -i eth0 -r 172.26.0.0/24
# netdiscover -r 192.168.0.0/16
# netdiscover -r 10.0.0.0/8

scan common LAN addresses with sleep time 0.5 milliseconds instead of the default 1:

# netdiscover -s 0.5

scan a fixed range on fast mode with sleep time 0.5 milliseconds instead of the default 1:

# netdiscover -r 192.168.0.0/16 -f -s 0.5

scan a range using 101 as the last octet for SOURCE IP:

# netdiscover -r 10.1.0.0/16 -n 101

only sniff for ARP traffic, don't send nothing:

# netdiscover -p

---

💜 AUTHOR 💜

netdiscover was written by Jaime Penalba Estebanez <jpenalbae@gmail.com>.

this manual page was originally written by Nicolas Weyland, for the Debian project. this man page has been merged into the netdiscover project and modified from the original by Jaime Penalba and Joao Eriberto Mota Filho.

---

and that's the whole page, bestie. no cap, you now know netdiscover better than most people on your subnet. 🍓

signing off from netdiscover-0.21, dated 14 Aug 2025 — stay curious, stay root, and pls don't run -S on a flaky wireless network. mwah. 💋