net.recon - rhaidiz/bettercap GitHub Wiki
This module is enabled by default and is responsible for reading periodically the ARP cache in order to monitor for new hosts on the network.
Commands
command | description |
---|---|
net.recon on |
Start network hosts discovery. |
net.recon off |
Stop network hosts discovery. |
net.show |
Show cache hosts list (default sorting by ip). |
net.show ADDRESS1, ADDRESS2 |
Show information about a specific list of addresses (by IP or MAC). |
net.show.meta ADDRESS1, ADDRESS2 |
Show metadata (mDNS, UPnP, open ports, etc) about a specific list of addresses (by IP or MAC). |
Parameters
parameter | default | description |
---|---|---|
net.show.meta |
false |
If true, the net.show command will show all metadata collected about each endpoint. |
net.show.filter |
Defines a regular expression filter for net.show . |
|
net.show.sort |
ip asc |
Defines sorting field (ip , mac , seen , sent , rcvd ) and direction (asc or desc ) for net.show . |
net.show.sort |
asc |
Defines sorting direction for net.show . |
net.show.limit |
0 |
If greater than zero, defines limit for net.show . |
Examples
Sort by IP and filter for MAC addresses starting with B8
:
> set net.show.sort ip asc
> set net.show.filter ^B8
> net.show
Filter by endpoints with the string Apple
in their hostname or vendor fields:
> set net.show.filter Apple
> net.show
Show top 10 endpoints sorted by last activity timestamp:
> set net.show.sort seen desc
> set net.show.limit 10
> net.show