Network Discovery Tools

Detect hosts, not limited by the LAN subnet or layer 2 networking.

nmap

To list hosts belonging to a certain subnet by setting the “-sL” switch

nmap -sL 192.168.9.0/24

For network discovery use the “-sn” switch

nmap -sn 192.168.9.0/24

ARP is a layer 2 protocol, it cannot discover systems through a router so when on the other side Nmap switches to ICMP requests which are layer 3; ARP within the local network, ICMP though the router.

netdiscover

Netdiscover is my preferred tool for local network discovery: it is pretty fast and offers the possibility to perform both active and passive ARP reconnaissance.

sudo apt-get install netdiscover
sudo netdiscover

sample output:

 Currently scanning: 172.23.153.0/16   |   Screen View: Unique Hosts                                                                                                                                                                         
                                                                                                                                                                                                                                             
 234 Captured ARP Req/Rep packets, from 1 hosts.   Total size: 15912                                                                                                                                                                         
 _____________________________________________________________________________
   IP            At MAC Address     Count     Len  MAC Vendor / Hostname      
 -----------------------------------------------------------------------------
 192.168.9.1     00:23:d0:1e:01:2f    234   15912  ASUSTek COMPUTER INC.