12 net.recon

evilsocket edited this page 2019-02-19 11:11:44 +01:00

This module is enabled by default and is responsible for reading periodically the ARP cache in order to monitor for new hosts on the network.

Commands

command	description
net.recon on	Start network hosts discovery.
net.recon off	Stop network hosts discovery.
net.clear	Clear all endpoints collected by the hosts discovery module.
net.show	Show cache hosts list (default sorting by ip).
net.show ADDRESS1, ADDRESS2	Show information about a specific list of addresses (by IP or MAC).
net.show.meta ADDRESS1, ADDRESS2	Show metadata (mDNS, UPnP, open ports, etc) about a specific list of addresses (by IP or MAC).

Parameters

parameter	default	description
net.show.meta	false	If true, the net.show command will show all metadata collected about each endpoint.
net.show.filter		Defines a regular expression filter for net.show.
net.show.sort	ip asc	Defines sorting field (ip, mac, seen, sent, rcvd) and direction (asc or desc) for net.show.
net.show.limit	0	If greater than zero, defines limit for net.show.

Examples

Sort by IP and filter for MAC addresses starting with B8:

> set net.show.sort ip asc
> set net.show.filter ^B8
> net.show

Filter by endpoints with the string Apple in their hostname or vendor fields:

> set net.show.filter Apple
> net.show

Show top 10 endpoints sorted by last activity timestamp:

> set net.show.sort seen desc
> set net.show.limit 10
> net.show

• Known Issues
• Using with Docker
• Compilation
  • on Linux and macOS
  • on Windows
  • on Android
  • cross compilation (ARM example)
• Interactive Mode and Command Line Arguments
• Changing the Prompt
• Caplets

Modules

• Core
  • events.stream
  • ticker
  • api.rest
  • update
  • caplets
• HID on 2.4Ghz (mousejacking)
  • hid.recon / sniff / inject
• Bluetooth Low Energy
  • ble.recon / enum / write
• 802.11
  • wifi.recon / assoc / deauth / ap
• Ethernet and IP
  • net.recon
  • net.probe
  • net.sniff / net.fuzz
  • syn.scan
  • wake on lan
  • Spoofers
    • arp.spoof
    • dhcp6.spoof
    • dns.spoof
  • Proxies
    • any.proxy
    • packet.proxy
    • tcp.proxy
      • modules
    • http.proxy
    • https.proxy
      • modules
• Servers
  • http.server
  • https.server
• Rogue Servers
  • mysql.server
• Utils
  • mac.changer
  • gps

bettercap.org | @bettercap | team