19.5 Netdiscover: Finding Lab Hosts

By Ravindra Bagale Last updated: 27 September 2026

Ata active recon suru. Pahila prashna: majhya network var konte machines jivant aahet? Netdiscover uses ARP (Address Resolution Protocol) to find live hosts on the local network segment. Because ARP works at layer 2, hosts that block ping still have to answer ARP – so it is very reliable on a LAN, but it only works on the network you are directly connected to.

ip a                                             # find your host-only interface (eth0 or eth1) and IP
sudo netdiscover -i eth1 -r 192.168.56.0/24      # active: send ARP requests to the lab range
sudo netdiscover -i eth1 -p                      # passive: only listen to ARP traffic, send nothing
sudo netdiscover -i eth1 -r 192.168.56.0/24 -P   # print results once and exit (good for notes)

The output shows IP, MAC address, count and MAC vendor. On VirtualBox, lab VMs show vendor "PCS Systemtechnik GmbH" (VirtualBox's MAC prefix); the .1 address is usually your host's host-only adapter and .100 (or similar) the VirtualBox DHCP server.

Mode	What it does	Detectable?
Active (`-r`)	Sends ARP "who has" for every IP in the range	Yes – ARP bursts are visible to ARP-watch tools
Passive (`-p`)	Listens for ARP from other machines	Almost no traffic sent

How defenders detect or block it: ARP scanning cannot be blocked by a host firewall (ARP is below IP), but it can be seen: tools like arpwatch, switch features (Dynamic ARP Inspection, port security) and IDS rules flag one MAC asking for a whole range. Network segmentation (VLANs) limits what an attacker on one segment can discover.

Ravindra Bagale's Tip

Students netdiscover interface dilyashivay chalavtat – mag to NAT kiwa chukichya adapter var scan karto aani "kahich sapadla nahi" mhantat. Aadhi ip a, mag -i madhe host-only interface. Aani range nehmi 192.168.56.0/24 – kadhihi ghar kiwa office chi range deu naka.

Lab

With Kali and Metasploitable 2 running on the host-only network, run sudo netdiscover -i <your host-only interface> -r 192.168.56.0/24 -P. Record every IP, MAC and vendor, and identify which one is Metasploitable 2 (192.168.56.20), your host and the DHCP server. Then run passive mode while you ping 192.168.56.20 from another terminal and watch the ARP entries appear.