Physical Link Mapping

Cheat Sheet

ARP Scan

Nmap -sn -Pn -PR --send-eth $TARGET

Build a Layer-2 Topology

sudo netdiscover -r 192.168.1.0/24

ARP scan on local network

sudo arp-scan --localnet

ARP scan on a subnet using a specific interface

sudo arp-scan -I eth0 192.168.1.0/24

1. Open Wireshark

2. Capture traffic on a specific interface

3. Filter layer 2 protocols: arp or lldp or cdp or stp or l2tp

Passive layer-2 packet capture

sudo tshark -i eth0 \
    -Y "arp or lldp or cdp or stp or l2tp" \
    > capture-layer2.txt

Passive ARP Monitoring

sudo netdiscover -p

Sniffs the network for incoming broadcast communication

nmap –script broadcast-listener

Last updated 26 days ago