laurigates/network-discovery

Network Discovery

When to Use This Skill

| Scenario | Use this skill | Alternative | |----------|---------------|-------------| | Scan all 65,535 TCP ports on a target quickly | Yes (RustScan) | | | Enumerate live hosts on a subnet | Yes (arp-scan-rs) | | | Identify running services and versions on open ports | Yes (nmap -sV) | | | Run NSE vulnerability or enumeration scripts | Yes (nmap --script) | | | Detect OS fingerprint of a remote host | Yes (nmap -O) | | | Discover which switch port a server is on (LLDP) | | layer2-discovery (lldpcli) | | Trace the route or diagnose latency to a host | | network-diagnostics (trippy, gping) | | Resolve DNS records for a domain | | dns-tools (dog, dig) | | Stress test an HTTP endpoint under load | | http-load-testing (oha) | | Monitor which process is using bandwidth | | network-monitoring (bandwhich) |

Core Expertise

Network discovery follows a two-phase approach: fast enumeration followed by deep analysis.

Why This Workflow

| Phase | Tool | Purpose | Time | |-------|------|---------|------| | Discovery | RustScan | Scan all 65,535 TCP ports | Seconds | | Discovery | arp-scan-rs | Find hosts on local network | Sub-second | | Analysis | nmap | Service detection, scripts | Minutes |

RustScan Advantages

• Scans all ports in 3-8 seconds (vs nmap's minutes/hours)
• Automatically chains into nmap for service detection
• Handles ulimit and batch sizing for reliability
• Written in Rust for memory safety and speed

arp-scan-rs Advantages

• Faster than traditional arp-scan
• Built-in scan profiles (default, fast, stealth)
• VLAN tagging support
• JSON output for parsing

Essential Commands

RustScan - Fast Port Discovery

# Scan single host (all 65k ports)
rustscan -a 192.168.1.100

# Scan with nmap service detection
rustscan -a 192.168.1.100 -- -sV

# Scan with nmap scripts (default safe scripts)
rustscan -a 192.168.1.100 -- -sV -sC

# Scan multiple hosts
rustscan -a 192.168.1.100,192.168.1.101

# Scan from file
rustscan -a hosts.txt

# Scan specific ports only
rustscan -a 192.168.1.100 -p 22,80,443

# Scan port range
rustscan -a 192.168.1.100 -r 1-1000

# Adjust for reliability (slower but more accurate)
rustscan -a 192.168.1.100 --ulimit 5000 --batch-size 2500

arp-scan-rs - Local Network Discovery

# Scan local network (auto-detect interface)
arp-scan-rs -l

# Scan specific interface
arp-scan-rs -i en0

# Scan specific range
arp-scan-rs 192.168.1.0/24

# Fast profile (less accurate, faster)
arp-scan-rs -l --profile fast

# Stealth profile (slower, harder to detect)
arp-scan-rs -l --profile stealth

# JSON output for parsing
arp-scan-rs -l --format json

# With VLAN tagging
arp-scan-rs -l --vlan 100

# Resolve hostnames
arp-scan-rs -l --resolve

nmap - Deep Service Analysis

Use nmap after RustScan identifies open ports:

# Service version detection
nmap -sV -p 22,80,443 192.168.1.100

# Service + default scripts
nmap -sV -sC -p 22,80,443 192.168.1.100

# OS fingerprinting (requires root)
sudo nmap -O -p 22,80,443 192.168.1.100

# Aggressive scan (version, scripts, OS, traceroute)
sudo nmap -A -p 22,80,443 192.168.1.100

# Vulnerability scripts
nmap --script vuln -p 80,443 192.168.1.100

# Specific service scripts
nmap --script http-* -p 80,443 192.168.1.100

# UDP scan (slower, requires root)
sudo nmap -sU -p 53,161 192.168.1.100

Common Patterns

Full Network Reconnaissance

# 1. Discover live hosts
arp-scan-rs -l --format json > hosts.json

# 2. Extract IPs and scan ports
arp-scan-rs -l | awk '{print $1}' > hosts.txt
rustscan -a hosts.txt -- -sV -oN scan-results.txt

# 3. Deep dive on specific services
nmap -sV -sC --script vuln -p 22 -iL hosts.txt

Quick Web Server Discovery

# Find hosts with web servers
rustscan -a 192.168.1.0/24 -p 80,443,8080,8443 -- -sV

# Enumerate web technologies
nmap --script http-headers,http-title -p 80,443 192.168.1.100

Quiet/Stealth Scanning

# Slow ARP discovery
arp-scan-rs -l --profile stealth

# RustScan with lower batch (less noisy)
rustscan -a 192.168.1.100 --batch-size 500 --ulimit 1000

# nmap timing template (T0=paranoid, T1=sneaky)
nmap -T1 -sV -p 22,80 192.168.1.100

Service-Specific Deep Dives

# SSH enumeration
nmap --script ssh-* -p 22 192.168.1.100

# SMB enumeration
nmap --script smb-* -p 445 192.168.1.100

# DNS enumeration
nmap --script dns-* -p 53 192.168.1.100

Agentic Optimizations

| Context | Command | |---------|---------| | Quick port check | rustscan -a $IP -p $PORTS 2>/dev/null | | Host discovery | arp-scan-rs -l --format json 2>/dev/null | | Minimal output | rustscan -a $IP --greppable | | JSON parsing | arp-scan-rs -l --format json \| jq -r '.[].ip' | | Service IDs only | nmap -sV -p $PORTS $IP -oG - \| grep open | | Suppress banners | rustscan -a $IP -q -- -sV | | Fast local scan | arp-scan-rs -l --profile fast --format json |

Quick Reference

RustScan Flags

| Flag | Description | |------|-------------| | -a | Target address(es) or file | | -p | Specific ports (comma-separated) | | -r | Port range (e.g., 1-1000) | | --ulimit | Max file descriptors (default: 5000) | | --batch-size | Ports per batch (default: 4500) | | --timeout | Timeout in ms (default: 1500) | | -g, --greppable | Greppable output format | | -q | Quiet mode | | -- | Pass remaining args to nmap |

arp-scan-rs Flags

| Flag | Description | |------|-------------| | -l | Scan local network | | -i | Interface to use | | --profile | Scan profile (default/fast/stealth) | | --format | Output format (plain/json) | | --vlan | VLAN ID for tagging | | --resolve | Resolve hostnames | | --timeout | Response timeout in ms |

nmap Common Flags

| Flag | Description | |------|-------------| | -sV | Service version detection | | -sC | Default script scan | | -O | OS detection (requires root) | | -A | Aggressive (version + scripts + OS) | | -p | Port specification | | -T<0-5> | Timing template (0=slowest) | | -oN | Normal output to file | | -oG | Greppable output | | -oX | XML output | | --script | Run specific NSE scripts | | -iL | Input from host list file |

nmap Timing Templates

| Template | Name | Use Case | |----------|------|----------| | -T0 | Paranoid | IDS evasion | | -T1 | Sneaky | IDS evasion | | -T2 | Polite | Less bandwidth | | -T3 | Normal | Default | | -T4 | Aggressive | Fast networks | | -T5 | Insane | Very fast networks |

Error Handling

RustScan Issues

"Too many open files":

# Reduce ulimit and batch size
rustscan -a $IP --ulimit 2000 --batch-size 1000

Slow scans:

# Increase batch size (if system allows)
rustscan -a $IP --batch-size 8000 --ulimit 10000

arp-scan-rs Issues

"Permission denied":

# ARP scanning requires raw socket access
sudo arp-scan-rs -l

No hosts found:

# Verify interface
arp-scan-rs -l -i en0  # Specify correct interface

nmap Issues

"requires root":

# OS detection and some scans need root
sudo nmap -O -p 22 $IP

Slow service detection:

# Limit version intensity
nmap -sV --version-intensity 2 -p $PORTS $IP