network-radar's Introduction

network-radar

what it is

network-radar is the native replacement for the old dSploit NetworkDiscovery . it's completely written in C, using threads for faster execution and libcares for asynchronous name resolving.

how it works

send a NetBIOS request to all hosts of your subnet
listen for ARP and NetBIOS responses
analyze those packets to learn alive hosts
search a name for those hosts that do not have one
monitor found hosts by periodically sending them an ARP request

output format

corrently the output format is very simple. when an host is found the following line is printed.

HOST_ADD  { mac: 00:00:00:00:00:00, ip: 0.0.0.0, name: HOSTNAME }

where:

00:00:00:00:00:00 is the Ethernet MAC address of the found host ( or 00:00:00:00:00:00 if unknown )
0.0.0.0 is the IP address of the found host
HOSTNAME is the name for this host ( or an empty string if unknown )

when an host is modified the output is the same except for the first work that changes from HOST_ADD to HOST_EDIT .

when an host disappear from the radar the following line get printed:

HOST_DEL  { ip: 0.0.0.0 }

where:

0.0.0.0 is the IP address of the disconnected host

TODO

perform a traceroute to find all gateway between you and internet.
send NetBIOS requests to all hosts of the found private subnets ( outside your local one )
monitor found foreign hosts by sending a ping or some other packet
create a configure script to check libpcap and network headers

Recommend Projects