PAGES
← all tools
◆ Reconnaissance & OSINT

netdiscover

0.20 open-source

Netdiscover is a network address discovering tool that sends ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. requests and sniffs for replies, working on wireless, hub, and switched networks.

Summary

netdiscover is an open-source command-line tool that finds live hosts on a local network by sending ARP requests and listening for replies, which makes it useful on wireless or switched networks with no DHCP server to query. You run it against a specific CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range and it reports responding hosts along with their MAC vendor, pulled from an OUI table it ships and updates. It suits network administrators and penetration testers doing local recon or wireless-network mapping rather than remote scanning, and it sits in the same space as ARP and host-discovery utilities bundled into broader recon toolkits, though nothing in its own documentation names a direct peer. Development dates back to 2005 and has drawn 8 contributors across three tracked releases, but there have been no commits in the past year, so it should be treated as stable rather than actively developed.

Netdiscover is a network address discovering tool that sends ARP requests and sniffs for replies, working on wireless, hub, and switched networks.

How netdiscover helps

Which devices are actually connected to this network right now, with no DHCP server to ask?

sends ARP requests across the range and lists every host that replies, updated live as replies come in

What kind of device is sitting behind an unfamiliar address on this network?

matches the responding MAC address against a bundled, updatable vendor table and shows the manufacturer name next to each host

Is there a rogue or unexpected device on this wireless segment?

surfaces every host that answers ARP traffic, so a MAC or vendor that doesn't belong to known equipment stands out in the list

Can I narrow a sweep to just the subnet I'm responsible for?

takes a CIDR range directly, so the scan covers exactly that block of addresses rather than guessing at boundaries

Will this scan work on a switched network with no broadcast visibility into other hosts' traffic?

relies on ARP requests and replies rather than sniffing existing traffic, so it still discovers hosts on switched networks where passive sniffing would miss them

all 10 features, with the evidence for each →

Languages

Not documented

Features

10 capabilities

Built from netdiscover's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • netdiscover covers 1 of the 13 network discovery and scanning capabilities we track.

What netdiscover offers you

  • Command-line interface2
Network host discovery 3 features Network discovery and scanning since 2005
CIDR subnet scanning shipped Enables targeted network discovery by accepting CIDR notation to define specific subnets for host scanning. 4 releases · 1 other source · first seen Jul 2005

Shared capability: Network host discovery

release

  • Adds full CIDR subnet notation support for targeted network discovery ranges. 0.20 · May 2025 · source · release history
  • Netmask defaults to /24 if omitted, changing behavior from previous unspecified default 0.3-beta7 · Mar 2015 · source · release history
  • Adds auto scan mode for automated network discovery 0.2 · Jul 2005 · source · release history
  • Adds support for /8, /16, and /24 subnet scan modes 0.2 · Jul 2005 · source · release history

example

  • Scan a specific CIDR subnet to discover live hosts and their MAC vendors in one shot. netdiscover -r 192.168.1.0/24 0.20 · May 2025 · source
Configurable ARP retry count shipped Allows specifying the exact number of ARP requests sent per target IP address to control scan behavior. 1 release · first seen Aug 2005

Shared capability: Network host discovery

Also counts toward: Command-line interface

release

  • Adds the -c command-line argument to specify the number of ARP requests sent per IP 0.3-beta4 · Aug 2005 · source · release history
IPv6 host discovery documented Enables discovery of live hosts on IPv6 networks using the Neighbor Discovery Protocol (NDP) as an experimental feature. 1 other source

Shared capability: Network host discovery

docs

  • Uh oh! There was an error while loading. Please reload this page . netdiscover-scanner / netdiscover Public Notifications You must be signed in to change notification settings Fork 47 Star 393 Feature: Add Support for IPv6 Host Discovery via Neighbor Discovery Protocol (NDP / ICMPv6) [EXPERIMENTAL] #43 Copy link Copy… seen Aug 2026 · source
Other / not yet classified 7 features Features we have not matched to a capability yet. A suggested match is marked.
Updated OUI database shipped suggested Provides more accurate MAC vendor identification by updating the internal Organizationally Unique Identifier table. 4 releases · 1 other source · first seen Oct 2005

Suggested capability: Attack surface inventory. This is our guess, not confirmed.

release

  • Updated OUI table for more accurate vendor identification of discovered hosts. 0.20 · May 2025 · source · release history
  • Updated OUI table for more accurate vendor identification of discovered hosts. 0.11 · Mar 2025 · source · release history
  • Adds --insecure flag to allow downloading OUI tables from the unencrypted IEEE source. 0.9 · Feb 2022 · source · release history
  • New visual screen dedicated to displaying live ARP requests 0.3-beta6 · Oct 2005 · source · release history

example

  • Scan a network while explicitly allowing insecure OUI table updates if the secure source is unreachable. netdiscover --interface eth0 --insecure 0.9 · Feb 2022 · source
Non-root execution support shipped Allows running netdiscover in environments with limited privileges by skipping pre-flight root capability checks, using the -R flag. 3 releases · 1 other source · first seen Aug 2005

Also counts toward: Command-line interface

release

  • New -R flag skips root/capability checks, letting privileged containers or capability-granted users run netdiscover without the pre-flight verification overhead. 0.11 · Mar 2025 · source · release history
  • Adds custom pcap filter option via patch by Gustavo Chain allowing advanced packet filtering during scans 0.3-beta7 · Mar 2015 · source · release history
  • Adds a customizable array for IPs scanned during fast mode 0.3-beta4 · Aug 2005 · source · release history

example

  • Run a passive ARP scan inside a Docker container where CAP_NET_RAW is granted but root checks would otherwise fail. netdiscover -R -p -r 192.168.1.0/24 0.11 · Mar 2025 · source
Granular packet timing control shipped Enables precise control over network traffic spacing through fractional sleep times and decimal values. 2 releases · 1 other source · first seen Jul 2005

release

  • Enables decimal values for sleep time configuration (e.g., fractional seconds between scans) 0.3-beta4 · Aug 2005 · source · release history
  • Adds sleep time parameter control 0.2 · Jul 2005 · source · release history

example

  • Use fractional sleep times for more granular control over packet spacing. netdiscover -s 0.5 192.168.1.0/24 0.3-beta4 · Aug 2005 · source
File-based target loading shipped Enables scanning hosts defined in an external text file instead of command-line arguments. 1 release · 1 other source · first seen Mar 2015

release

  • Adds the -l flag to read target IP ranges from a specified file instead of command-line arguments 0.3-beta7 · Mar 2015 · source · release history

example

  • Scan targets defined in an external file rather than typing them on the CLI netdiscover -l targets.txt 0.3-beta7 · Mar 2015 · source
Configurable default settings shipped Allows defining persistent defaults for IP ranges and scan modes via user configuration files. 1 release · first seen Mar 2015

release

  • Adds support to read user config files for defining default IP ranges and fast mode lists 0.3-beta7 · Mar 2015 · source · release history
Parsable output mode shipped Enables structured, machine-readable output for automated processing of scan results. 1 release · first seen Mar 2015

release

  • Adds parsable output format for automated processing, contributed by Guillaume Pratte 0.3-beta7 · Mar 2015 · source · release history
Packet transmission statistics shipped Provides output counters to track the number of packets sent during network discovery operations. 1 release · first seen Jul 2005

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for netdiscover, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail netdiscover puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

7 entries

  1. May 20251
  2. March 20251
  3. February 20221
  4. March 20151
  5. October 20051
  6. August 20051
  7. July 20051
    Show

    7 entries

    Project health

    Issue, contributor and maintainer activity in netdiscover-scanner/netdiscover, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 −4 vs prior 12 months
    2. Maintainers 0 +0 joined · −1 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed 100% of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 3 of 23 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 3
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 397
    Issue themes, last 12 months
    • other 100%

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    browse all tools → score card for your toolchain →