Use with authorization only. Scan networks and hosts you own or have explicit written permission to assess. Unauthorized scanning can violate acceptable-use policies and, in some jurisdictions, the law.

Every admin eventually meets the network where nothing pings back. Firewalls drop ICMP, hosts are configured to stay quiet, and your usual discovery scan comes up empty even though the segment is clearly busy. Netdiscover is built for that situation. Instead of asking hosts to answer a ping, it works at the ARP layer — the low-level conversation devices have to take part in just to talk on a local network. It’s a small, focused Linux command-line tool, and on the right segment it finds things other scanners miss.

What Netdiscover actually does

Netdiscover discovers hosts on a local network segment using ARP (Address Resolution Protocol). In its active mode it sends ARP requests across a range and notes who replies, building a list of live devices with their IP and MAC addresses and a guess at the hardware vendor from the MAC prefix. Because ARP is fundamental to how a local Ethernet segment functions, devices tend to respond even when they’ve been told to ignore pings.

Its more distinctive trick is passive mode. Here it sends nothing at all — it simply listens to the ARP traffic already flowing on the segment and records the devices it overhears. That makes it quiet on the wire and useful when you’d rather not announce yourself, or when active probing is undesirable. It’s a Linux command-line utility, at home on security-oriented distributions and in the toolkit of anyone doing local reconnaissance.

Where it shines

Its reason to exist is finding hosts when ICMP is filtered. On a segment where a ping sweep returns nothing, an ARP scan often reveals the full picture, because a device that wants to communicate locally can’t stay silent at the ARP layer. That single capability makes Netdiscover worth keeping around even if you have fancier tools.

Passive mode is the other standout. Being able to inventory a segment without transmitting a single probe is genuinely useful — for stealth during an authorized assessment, or simply to avoid stirring up a sensitive network. And it’s tiny, fast, and dependency-light: it does one job, starts instantly, and doesn’t ask you to learn much. On the local segment you’re plugged into, it’s about as quick a way to see what’s really there as exists.

Where it falls short

The catch is right in the name of the technique: ARP is local-only. Netdiscover sees the segment you’re attached to and nothing beyond the first router. It cannot discover hosts across subnets or over the internet, so it’s a local-reconnaissance tool, full stop — not a network-wide inventory system.

It’s also Linux and command-line only, with no GUI and no Windows build, which rules it out for a lot of everyday office admins. It reports presence — IP, MAC, vendor — but not open ports, services, or operating systems, so it’s a first step rather than a full assessment. And like any active scanner, its active mode is noticeable on the wire; the passive mode helps, but you still need to be somewhere you’re allowed to be.

Who it’s for

Linux-comfortable admins, security testers, and anyone doing hands-on work on a local segment — especially where pings are blocked or where staying quiet matters. If you’re on the network in question and want to know what’s really on it, Netdiscover is a great, sharp little tool. If you need cross-subnet discovery, a graphical interface, or service and port detail, look to something broader.

Licensing and cost

Netdiscover is open source, released under the GNU General Public License version 3 (GPLv3), and free to use under that license. Maintained as a community project, it’s commonly available through Linux package managers as well as from its source repository.

How it compares — real alternatives

For anything beyond local presence, pair it with Nmap, which adds port scanning, service and OS detection, and scripting — Netdiscover finds the hosts, Nmap tells you what they’re running. If you want a graphical, cross-platform discovery tool rather than an ARP-focused CLI, Angry IP Scanner covers ranges with a friendly table, and on Windows Advanced IP Scanner is an easy free option — though neither leans on ARP the way Netdiscover does, so on an ICMP-filtered segment Netdiscover can still surface hosts they’d miss.

Getting it safely

Netdiscover is hosted on GitHub, under the Netdiscover Project (github.com, netdiscover-scanner/netdiscover) — we host nothing and only point you to the project’s own repository. On Linux it’s also packaged in many distributions’ repositories, which is a convenient and trustworthy route; either way, it’s worth understanding how to verify a download. Because even passive listening means being present on a network, use Netdiscover only on segments you own or are explicitly authorized to assess — the authorization checklist is a quick way to confirm you’re in the clear.

FAQ

Why use Netdiscover when ping scanning exists? Because ping relies on ICMP, which is frequently blocked. ARP operates at a lower layer that local devices generally have to honour, so an ARP scan often finds hosts a ping sweep can’t. That’s Netdiscover’s whole niche.

What’s the difference between active and passive mode? Active mode sends ARP requests and waits for replies — faster and more complete, but visible on the network. Passive mode sends nothing and just listens to existing ARP traffic — quieter and stealthier, but it only sees devices that happen to talk while you’re listening.

Can it scan devices on other subnets? No. ARP is confined to the local segment, so Netdiscover only sees what’s on the same segment as your machine. For discovery across subnets, use a tool that scans routed networks, such as Nmap.

About the project

Netdiscover is developed and maintained by Netdiscover Project. This is an independent catalog — we don't host or distribute the software. For source code, documentation and official releases, see the project's own site.