> For the complete documentation index, see [llms.txt](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d4rk1337.gitbook.io/the-pentesters-cheat-sheet/enumeration/01-network-discovery.md).

# Network discovery

## netdiscover

[netdiscover(8)](https://manpages.debian.org/unstable/netdiscover/netdiscover.8.en.html) - active/passive ARP reconnaissance tool

```bash
netdiscover -i eth0
```

```bash
netdiscover -r <ip>/24
```

## nmap

```bash
nmap -sn <ip>/24
```

## bash

```bash
for i in {1..255}; do (ping -c 1 xxx.xxx.xxx.${i} | grep "bytes from" &); done
```

## powershell

```powershell
$ping = New-Object System.Net.Networkinformation.Ping
1..254 | % { $ping.send("xxx.xxx.xxx.$_") | select address, status }
```