Host Discovery #

At a Glance #

One of the first steps during the network enumeration is to reduce a set of IPs into a list of active or interesting hosts. Depending on if you are inside the network or scanning remotely, how much noise you can make, and your discovery requirements, different tools, and options are available.

Internal #

Passive #

Passive discovery relies on monitoring network layer traffic to detect network topology, services, and applications.

As no packets are injected into the network, there is no risk of unintentional service disruption. It is also suitable for finding intermittently offered or protected services often missed by active scanning. ¹

netdiscover - ARP ² #

sudo netdiscover -p

• -p: passive mode. It does not send anything, but does only sniff.

p0f - Fingerprinting ³ #

sudo p0f -p

• -p: promiscuous mode; by default, it listens only to packet addressed or routed through. On IP-enabled interfaces can be detected remotely.

bettercap ⁴ #

net.recon on
net.show.meta true
net.show

Active #

In contrast, active discovery does inject a variety of packets into the network.

It is well suited for open port discovery and fingerprinting. However, these techniques are not without drawbacks. Scans can be invasive, generate too much noise, and in some cases, cause service interruptions due to the type of packets sent.

netdiscover - ARP ² #

sudo netdiscover -r 10.0.0.0/24

• -r <range>: scan a given range instead of auto scan.

Nmap #

nmap -sn 10.0.0.0/24

• -sn: No port scan AKA ping scan. ⁵ Consists of an ICMP echo request, TCP SYN to port 443, TCP ACK to port 80, and an ICMP timestamp request by default.

nbtscan - NetBIOS ⁶ #

sudo nbtscan 10.0.0.0/24

bettercap ⁷ #

net.probe on
net.show.meta true
net.show

ICMP #

Refer to External ICMP Scanning

External #

ICMP #

As defined in RFC 792, ICMP messages are typically used for diagnostic or control purposes or generated in response to errors in IP operations (as specified in RFC 1122).⁸ Although it is possible to use ICMP requests to discover if a host is up or not, it is common to find all these packets being filtered, making it an unreliable method.

ping #

ping -c 1 10.0.0.3

• -c <count>: stops after count replies.

fping ⁹ #

fping -g 10.0.0.0/24

• -g, --generate <target>: generates target list. target can be start and end IP or a CIDR address.

Nmap #

nmap -PEPM -sn -n 10.0.0.0/24

Port Discovery #

Another commonly used technique is port scanning. It allows you to identify running services, consequently, interesting hosts. See Port Scanning.