With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network.

How it's possible to prevent host discovery in a network?


There are multiple approaches an attacker can use for host discovery. I believe netdiscover uses ARP requests for host discovery, which operates on the Ethernet protocol (see https://github.com/alexxy/netdiscover). Other tools like nmap operate at higher protocol layers (ICMP, TCP/IP, UDP/IP, see https://nmap.org/book/man-host-discovery.html). A solution which prevents host discovery at higher protocol layers may not prevent host discovery at lower layers, and vice versa.

A firewall is a common solution for preventing host discovery. For example, Linux can use iptables to prevent host discovery at higher layers and arptables at the lower layers. This doesn't protect against sniffing of traffic by a passive attacker (netdiscover can do this).

Network segmentation or VLANs could further protect against host discovery at the Ethernet layer.

https://en.wikipedia.org/wiki/Private_VLAN https://en.wikipedia.org/wiki/Network_segmentation

  • In Network segmentation, even if I create a segment for guests, all guests can see each other, right? I'm trying to avoid this... – Mario Jul 5 '19 at 16:00
  • There are a few options for isolating guests and preventing them from discovering each other, but you may want to look into Private VLANs: en.m.wikipedia.org/wiki/Private_VLAN – zama Jul 5 '19 at 21:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.