Skip to content

Latest commit

 

History

History
49 lines (33 loc) · 1.65 KB

README.md

File metadata and controls

49 lines (33 loc) · 1.65 KB
Raw

network-radar

Build Status

what it is

network-radar is the native replacement for the old dSploit NetworkDiscovery . it's completely written in C, using threads for faster execution and libcares for asynchronous name resolving.

how it works

  • send a NetBIOS request to all hosts of your subnet
  • listen for ARP and NetBIOS responses
  • analyze those packets to learn alive hosts
  • search a name for those hosts that do not have one
  • monitor found hosts by periodically sending them an ARP request

output format

corrently the output format is very simple. when an host is found the following line is printed.

HOST_ADD  { mac: 00:00:00:00:00:00, ip: 0.0.0.0, name: HOSTNAME }

where:

  • 00:00:00:00:00:00 is the Ethernet MAC address of the found host ( or 00:00:00:00:00:00 if unknown )
  • 0.0.0.0 is the IP address of the found host
  • HOSTNAME is the name for this host ( or an empty string if unknown )

when an host is modified the output is the same except for the first work that changes from HOST_ADD to HOST_EDIT .

when an host disappear from the radar the following line get printed:

HOST_DEL  { ip: 0.0.0.0 }

where:

  • 0.0.0.0 is the IP address of the disconnected host

TODO

  • perform a traceroute to find all gateway between you and internet.
  • send NetBIOS requests to all hosts of the found private subnets ( outside your local one )
  • monitor found foreign hosts by sending a ping or some other packet
  • create a configure script to check libpcap and network headers