Network Discovery

When to Use This Skill

Scenario	Use this skill	Alternative
Scan all 65,535 TCP ports on a target quickly	Yes (RustScan)
Enumerate live hosts on a subnet	Yes (arp-scan-rs)
Identify running services and versions on open ports	Yes (nmap -sV)
Run NSE vulnerability or enumeration scripts	Yes (nmap --script)
Detect OS fingerprint of a remote host	Yes (nmap -O)
Discover which switch port a server is on (LLDP)		layer2-discovery (lldpcli)
Trace the route or diagnose latency to a host		network-diagnostics (trippy, gping)
Resolve DNS records for a domain		dns-tools (dog, dig)
Stress test an HTTP endpoint under load		http-load-testing (oha)
Monitor which process is using bandwidth		network-monitoring (bandwhich)
Inspect or configure the host's own IPs, links, or routes		interface-state (ip)

Core Expertise

Network discovery follows a two-phase approach: fast enumeration followed by deep analysis.

Why This Workflow

Phase	Tool	Purpose	Time
Discovery	RustScan	Scan all 65,535 TCP ports	Seconds
Discovery	arp-scan-rs	Find hosts on local network	Sub-second
Analysis	nmap	Service detection, scripts	Minutes

RustScan Advantages

Scans all ports in 3-8 seconds (vs nmap's minutes/hours)
Automatically chains into nmap for service detection
Handles ulimit and batch sizing for reliability
Written in Rust for memory safety and speed

arp-scan-rs Advantages

Faster than traditional arp-scan
Built-in scan profiles (default, fast, stealth)
VLAN tagging support
JSON output for parsing

Essential Commands

RustScan - Fast Port Discovery

# Scan single host (all 65k ports)
rustscan -a 192.168.1.100

# Scan with nmap service detection
rustscan -a 192.168.1.100 -- -sV

# Scan with nmap scripts (default safe scripts)
rustscan -a 192.168.1.100 -- -sV -sC

# Scan multiple hosts
rustscan -a 192.168.1.100,192.168.1.101

# Scan from file
rustscan -a hosts.txt

# Scan specific ports only
rustscan -a 192.168.1.100 -p 22,80,443

# Scan port range
rustscan -a 192.168.1.100 -r 1-1000

# Adjust for reliability (slower but more accurate)
rustscan -a 192.168.1.100 --ulimit 5000 --batch-size 2500

arp-scan-rs - Local Network Discovery

# Scan local network (auto-detect interface)
arp-scan-rs -l

# Scan specific interface
arp-scan-rs -i en0

# Scan specific range
arp-scan-rs 192.168.1.0/24

# Fast profile (less accurate, faster)
arp-scan-rs -l --profile fast

# Stealth profile (slower, harder to detect)
arp-scan-rs -l --profile stealth

# JSON output for parsing
arp-scan-rs -l --format json

# With VLAN tagging
arp-scan-rs -l --vlan 100

# Resolve hostnames
arp-scan-rs -l --resolve

nmap - Deep Service Analysis

Use nmap after RustScan identifies open ports:

# Service version detection
nmap -sV -p 22,80,443 192.168.1.100

# Service + default scripts
nmap -sV -sC -p 22,80,443 192.168.1.100

# OS fingerprinting (requires root)
sudo nmap -O -p 22,80,443 192.168.1.100

# Aggressive scan (version, scripts, OS, traceroute)
sudo nmap -A -p 22,80,443 192.168.1.100

# Vulnerability scripts
nmap --script vuln -p 80,443 192.168.1.100

# Specific service scripts
nmap --script http-* -p 80,443 192.168.1.100

# UDP scan (slower, requires root)
sudo nmap -sU -p 53,161 192.168.1.100

Common Patterns

Full Network Reconnaissance

# 1. Discover live hosts
arp-scan-rs -l --format json > hosts.json

# 2. Extract IPs and scan ports
arp-scan-rs -l | awk '{print $1}' > hosts.txt
rustscan -a hosts.txt -- -sV -oN scan-results.txt

# 3. Deep dive on specific services
nmap -sV -sC --script vuln -p 22 -iL hosts.txt

Quick Web Server Discovery

# Find hosts with web servers
rustscan -a 192.168.1.0/24 -p 80,443,8080,8443 -- -sV

# Enumerate web technologies
nmap --script http-headers,http-title -p 80,443 192.168.1.100

Quiet/Stealth Scanning

# Slow ARP discovery
arp-scan-rs -l --profile stealth

# RustScan with lower batch (less noisy)
rustscan -a 192.168.1.100 --batch-size 500 --ulimit 1000

# nmap timing template (T0=paranoid, T1=sneaky)
nmap -T1 -sV -p 22,80 192.168.1.100

Service-Specific Deep Dives

# SSH enumeration
nmap --script ssh-* -p 22 192.168.1.100

# SMB enumeration
nmap --script smb-* -p 445 192.168.1.100

# DNS enumeration
nmap --script dns-* -p 53 192.168.1.100

Agentic Optimizations

Context	Command
Quick port check	`rustscan -a $IP -p $PORTS 2>/dev/null`
Host discovery	`arp-scan-rs -l --format json 2>/dev/null`
Minimal output	`rustscan -a $IP --greppable`
JSON parsing	`arp-scan-rs -l --format json \| jq -r '.[].ip'`
Service IDs only	`nmap -sV -p $PORTS $IP -oG - \| grep open`
Suppress banners	`rustscan -a $IP -q -- -sV`
Fast local scan	`arp-scan-rs -l --profile fast --format json`

Quick Reference

RustScan Flags

Flag	Description
`-a`	Target address(es) or file
`-p`	Specific ports (comma-separated)
`-r`	Port range (e.g., 1-1000)
`--ulimit`	Max file descriptors (default: 5000)
`--batch-size`	Ports per batch (default: 4500)
`--timeout`	Timeout in ms (default: 1500)
`-g, --greppable`	Greppable output format
`-q`	Quiet mode
`--`	Pass remaining args to nmap

arp-scan-rs Flags

Flag	Description
`-l`	Scan local network
`-i`	Interface to use
`--profile`	Scan profile (default/fast/stealth)
`--format`	Output format (plain/json)
`--vlan`	VLAN ID for tagging
`--resolve`	Resolve hostnames
`--timeout`	Response timeout in ms

nmap Common Flags

Flag	Description
`-sV`	Service version detection
`-sC`	Default script scan
`-O`	OS detection (requires root)
`-A`	Aggressive (version + scripts + OS)
`-p`	Port specification
`-T<0-5>`	Timing template (0=slowest)
`-oN`	Normal output to file
`-oG`	Greppable output
`-oX`	XML output
`--script`	Run specific NSE scripts
`-iL`	Input from host list file

nmap Timing Templates

Template	Name	Use Case
`-T0`	Paranoid	IDS evasion
`-T1`	Sneaky	IDS evasion
`-T2`	Polite	Less bandwidth
`-T3`	Normal	Default
`-T4`	Aggressive	Fast networks
`-T5`	Insane	Very fast networks

Error Handling

RustScan Issues

"Too many open files":

# Reduce ulimit and batch size
rustscan -a $IP --ulimit 2000 --batch-size 1000

Slow scans:

# Increase batch size (if system allows)
rustscan -a $IP --batch-size 8000 --ulimit 10000

arp-scan-rs Issues

"Permission denied":

# ARP scanning requires raw socket access
sudo arp-scan-rs -l

No hosts found:

# Verify interface
arp-scan-rs -l -i en0  # Specify correct interface

nmap Issues

"requires root":

# OS detection and some scans need root
sudo nmap -O -p 22 $IP

Slow service detection:

# Limit version intensity
nmap -sV --version-intensity 2 -p $PORTS $IP

network-discovery