Host discovery quick tools
The tools you reach for basic discovery.
bash·1 min read··INE Certification
These tools should be the fast first pass before a proper nmap sweep, especially on networks where ICMP is filtered.
Tools
# ping: basic ICMP echo
ping <target_ip>
# fping: ping an entire subnet in one go
fping -I eth0 -g <target_network>.0/24 -a
# arp-scan: ARP-based discovery (Sees hosts that are filtering ICMP)
arp-scan -I eth1 192.168.31.0/24
# netdiscover: active/passive ARP discovery
netdiscover -r 192.168.31.0/24
# nmblookup: NetBIOS name lookup over TCP
nmblookup -A <target_ip>Which to use
| Tool | Best for |
|---|---|
ping | Checking a single host |
fping | Quickly sweeping a large subnet |
arp-scan / netdiscover | Local network, hosts that filter ICMP |
nmblookup | Resolving NetBIOS names once you have a list of IPs |
Related
- Host discovery & network mapping workflow: the full recon sequence
- Nmap: the proper sweep that follows
- SMB & NetBIOS enumeration: what to do with the NetBIOS names