Add wired Ethernet connectivity to your Flipper Zero for network analysis, scanning, or sniffing in environments without WiFi. This Add-On, along with the Ethernet app, allows you to interact with networks working over Ethernet.

Is a stand-alone Ethernet controller with an SPI Interface. The ENC28J60 meets all of the IEEE 802.3 specifications. Provides an internal DMA module for fast data throughput and hardware-assisted checksum calculation, which is used in various network protocols.

• Operates from 3.3V - 5V
• Input Voltage 5V

Read more of its characteristics in the datasheet.

Find the project files here → FLIPPER_ETHERNET

This Add-On allows scanning wired networks and running essential network analysis tools. It includes features such as ARP scan, ARP Poison, ARP Spoofing, device detection, ping, PCAP file generation, and other basic network utilities. Perfect for pentesters, red teamers, and security researchers looking to expand their Flipper Zero’s capabilities in wired environments.

Use the pin headers to connect your Add-On to your Flipper.

The Get IP option allows the device to automatically request and obtain an IP address assigned by the router or modem connected to the Ethernet network.

When selecting this option, the request process starts automatically. After a few moments, the assigned IP address will be displayed on the screen. This feature is useful for quickly obtaining a valid network configuration before using other tools in the application.

The Scan Hosts feature allows scanning devices currently connected to the local Ethernet network by detecting active IPv4 addresses. Upon entering this menu, several configuration options become available.

Start IP: Before starting a scan, a starting IP address must be configured. This address will be used as the initial point for incremental host detection. Selecting Start IP opens the Set IP Address screen, where each digit of the IPv4 address can be configured individually using the Flipper Zero navigation buttons. Press the OK button to confirm the configured IP address.

Range: After configuring the starting IP address, the scan range must be defined. Selecting Range opens a decimal input screen where the desired scan range can be entered manually.

For example:

• Start IP: 192.168.0.1
• Range: 150

This configuration scans addresses between 192.168.0.1 and 192.168.0.150.

Start Scanning: Once the Start IP and Range values are configured, selecting Start Scanning begins the host detection process. A loading screen will briefly appear while the application scans the selected address range. After the scan completes, a list of detected IPv4 addresses will be displayed.

View Scanned Hosts: This option allows reviewing the hosts detected during the most recent scan session. The detected IP addresses remain available until a new scan is performed, or if you leave the app.

The Passive Discovery feature allows identifying devices on the local Ethernet network by listening for discovery information they advertise.

Unlike active scanning, Passive Discovery does not send requests to search for devices. Instead, the Add-On listens for supported Layer 2 discovery protocols. Currently, the feature supports LLDP (Link Layer Discovery Protocol), commonly used by network equipment to advertise information about itself.

Start Discovery: Selecting Start Discovery begins listening for LLDP advertisements. Discovered devices and their available information are automatically collected while the feature is running.

Neighbor List: The Neighbor List displays devices discovered through LLDP. Each detected device is stored as a neighbor, and repeated advertisements from the same device are updated whenever possible.

Selecting a neighbor opens the Neighbor Details screen.

Neighbor Details: Neighbor Details displays the information advertised by the selected LLDP device.

Depending on the device, the following information may be available:

• Name: Advertised device or system name.
• Source: Protocol used for discovery, currently LLDP.
• Port: Port or interface identifier advertised by the device.
• IP: Advertised management IPv4 address.
• Capabilities: Network capabilities advertised by the device, displayed as a hexadecimal value.
• TTL: Time, in seconds, for which the received neighbor information remains valid.

For example:

NAME: support
SOURCE: LLDP
PORT: 4x
IP: 172.18.0.1
CAPABILITIES: 0x009C
TTL: 120

The Ping Host feature allows testing network communication with a specific device by sending ICMP Echo Request packets to the target IPv4 address.

Target IP: Before starting the ping process, the destination IP address must be configured. Selecting Target IP opens the same IP selector interface used throughout the application, allowing the address to be configured digit by digit.

Start Ping: Selecting Start Ping begins the communication test with the configured host. During the process, a live status screen is displayed showing the target IP address and the communication statistics exchanged between the Add-On and the selected host.

The displayed counters should be interpreted as follows:

• The first number represents the number of replies received from the target host.
• The second number represents the number of ping requests sent by the Add-On.

If replies are not received, it may indicate one of the following situations:

• The host is offline.
• Communication could not be established.
• The host is ignoring requests.
• Network packet loss occurred during transmission.

If communication is not established during the first attempt, the process can be stopped and repeated manually to verify if there is possible communication.

The Scan Ports feature allows scanning TCP ports on a specific host to identify which ports are currently open and accepting connections. Its workflow is similar to the Scan Hosts function.

Target IP: The target IPv4 address must first be configured using the Target IP selector.

Start Port: This option configures the initial TCP port number from which the scan will begin. For better scanning results, it is recommended to use port 22 as the initial port, as it provides a more reliable starting point for the detection process.

Range: The Range option defines how many ports will be scanned, starting from the selected Start Port value.

For example:

• Start Port: 22
• Range: 1000

This configuration scans ports between 22 and 1022.

Protocol: Currently, this section only displays the network protocol used during the scan process. At this time, only TCP port scanning is supported.

Start Scanning: After configuring the required parameters, selecting Start Scanning begins the port scan. During the process, the screen first displays the initial port number and then continuously updates while scanning progresses incrementally through the configured range. Every detected open port is stored and displayed on the same screen, gradually building a list of open ports until the scan is fully completed

The Detect OS feature attempts to estimate the operating system running on a target host by analyzing responses obtained through network communication.

Currently, the application supports four primary detection results:

• Windows
• Linux
• iOS/macOS
• OS Not Detected

Target IP: The destination IPv4 address must first be configured using the Target IP selector.

Start Detection: Selecting Start Detection begins the operating system detection process. A loading screen will appear for a few moments while the application performs the scan and analyzes the obtained responses.

After the detection process completes, a results screen is displayed containing detailed scan information. The displayed information includes the following:

• Target IP: The scanned host IPv4 address.
• Detection Result:
  • OS Detected: Indicates a higher confidence level that the detected operating system is likely correct.
  • OS Guessed: Indicates a lower-confidence estimation based on partial scan results.
  • OS Not Detected: Insufficient or no useful communication data was obtained during the scan.

• Initial Source Port: Randomly assigned source port used by the application during the detection process.

• Scanned Ports: List of predefined ports used during detection, including their status:
  • OPEN
  • CLOSED
  • FILTERED
  • UNKNOWN

The following ports are currently used for OS estimation; these ports were selected because they are commonly associated with services frequently enabled on specific operating systems, helping improve detection accuracy.

The ARP Actions section contains tools related to ARP-based network interactions and spoofing attacks.

Spoof All Hosts: The Spoof All Hosts option allows launching an ARP spoofing attack against multiple devices connected to the local network simultaneously. When selecting this option, your current IP address is displayed on the screen.

Next, a static screen where a cat sleeping appears, waiting for you to press the select button to start the attack. An animation indicates that the attack is currently active. Pressing the OK button again stops the spoofing process and returns to the initial menu.

The Packet Sniffer feature allows capturing and monitoring Ethernet network packets in real time. The function begins immediately after entering the Packet Sniffer menu.

If the Add-On is not connected to a valid network, a waiting screen will remain visible until communication becomes available.

Once packets are detected, the interface starts displaying captured network traffic in real time. To stop the sniffing process, press the OK button. This automatically opens the packet viewer screen, where captured packets and their information can be reviewed.

Inside the packet viewer, the left and right navigation buttons can be used to browse through the captured packets individually. Exiting the viewer returns the user to the main menu.

The View Packets option allows opening and reviewing previously saved PCAP files generated during packet sniffing sessions. When entering this menu, a list of available PCAP files is displayed.

Each file follows the naming format:

pcap_DD_MM_YYYY_N

Where:

• DD = Day
• MM = Month
• YYYY = Year
• N = File number created during that day

Opening a file displays a packet viewer interface similar to the one used after completing a sniffing session.

The left and right navigation buttons allow browsing through the stored packets individually.

These PCAP files can also be exported and analyzed using external packet analysis software such as Wireshark. All packet files are stored in the following directory on the SD Card: SD Card/apps_data/ethernet/files.

Files can be copied directly from this folder for further inspection and analysis on a computer.

The Settings menu displays the currently configured MAC address and IP address used by the Add-On.

By default:

• MAC Address: ba:3f:91:c2:7e:5d
• IP Address: 192.168.0.2

The MAC Address section includes the following options:

• Set Random MAC: Generates and assigns a random MAC address automatically.
• Set MAC Manually: Allows entering a custom MAC address manually.

The IP Address section includes:

• Get IP: Requests an IP address automatically from the router or modem.
• Set IP Manually: Opens the IP configuration screen for manually assigning a custom IPv4 address.