1

I am trying to discover hosts in my network. So I have connected external TPLINK wireless card to my virtual computer for internet and when I do ifconfig, it gives me IP address, 192.168.2.6

I used netdiscover and works perfectly. Out of curiosity I wanted to see on wireshark how the scan happens. What amazed me was requests are sent from completely another IP address which is not even in the network. My sender IP address in wireshark is 192.168.2.67. If you look at the first request to my router, thats the only request sent using my ip address, i.e 192.168.2.6

1) Why is that?

2) and, how this works?how the reply comes to me even if the sender ip is different than the original one?

Image

1

netdiscover forges ARP packets, and one of the fields of an ARP packet is the source address. To ensure that the packet appears to be from a host on the current targeted subnet, netdiscover chooses an source address ending in 67 (not really sure why 67 was chosen). It's not actually changing the address of your adapter, it's just the content of the crafted packet.

The reason you are able to see the reply is because netdiscover is listening for responses, and your actual MAC address is what other devices will reply to. Here, the IP address is fairly irrelevant.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.