NETRECON(1)

NAME
netrecon - Recon a network

SYNOPSIS
netrecon scan [--ping][--conn][--dgram][--port n-N][--time s.ms][--extra][-V] {target} netrecon scan6 [--dgram] [--port N] {ipv6addr} netrecon passive [--if <dev>] [--threshold <n>] [--polls <count>] [--extra] {pcap-expr} netrecon tcpdump [--if <dev>] [--polls] <count> [--decode] {pcap-expr} netrecon arpsniff [--if <dev>] [--polls <count>] [--decode] {pcap-expr}

DESCRIPTION
The netrecon command can scan hosts actively or passively, sniff tcp data, sniff arp data and decode packets.

SCAN OPTIONS

-V Be verbose

--ping Pingonly

--conn Perform a full TCP connect to each port (can take longer)

--dgram Set socket type to datagram

--port n-N Scan a port range. Also takes a single port.

--time s.ms Set the timeout for each port connect.

--extra Scan ports above 1024

SCAN6 OPTIONS (EXPERIMENTAL)

--dgram Set the socket type to datagram

--port N Set port. (Required)

PASSIVE SCAN OPTIONS

--if <dev> Set the interface.

--threshold <n> Set the per port and protocol threshold to n (this flags the port and protocol as a possible open)

--polls <count> Exit after capturing a certain number of polls.

--extra Look for ports above 1024

TCPDUMP/ARPSNIFF OPTIONS

--if <dev> Set the interface.

--polls <count> Exit after capturing a certain number of polls.

--decode Decode packet data.

EXAMPLES
Scan only for port 22:
   netrecon scan --port 22 somehost Scan ports 22-80 on 192.168.1.0 and be verbose:
   netrecon --port 22-80 -V 192.168.1.1-255 Passively scan for 32 packets, look for extra ports and use device en1:
   netrecon passive --extra --polls 32 --if en1 Sniff for web traffic
   netrecon tcpdump port 80 Decode ARP packets and use device eth1:
   netrecon arpsniff --if eth1 --decode

NOTES
There is currently limited single port single host ipv6 support:
    netrecon -6 -p 22 ::1 For example works great. Also works with LAN accessible ipv6.

AUTHOR
Jason R Fink <pantos.sys@gmail.com>