Passive Reconnaissance

Passive techniques gather information without sending packets of your own, so they leave no log entry on the target and no traffic for an IDS to score. The cost is reach: on a switched network you see broadcast traffic and your own conversations unless the client has given you a span port or a tap.

Network Traffic Analysis

Capture first and ask questions later: a full-packet capture costs disk and nothing else, and the questions you have on day three are rarely the ones you had on day one. While reading it, the useful distinction is between broadcast protocols (LLMNR on UDP 5355, NBT-NS on 137, mDNS on 5353, DHCP, browser elections) — which every host on the segment sees and which therefore reveal the whole neighbourhood — and unicast traffic, which you only see if it is addressed to you or mirrored.

Capturing Broadcast Traffic

The LLMNR/NBT-NS capture is a decision, not a data-gathering step: if workstations are broadcasting name lookups for hosts that do not resolve, poisoning them in active mode will collect NetNTLMv2 hashes. If the capture is silent on those ports, LLMNR is disabled by policy and the Responder path is a dead end — do not spend the engagement on it. Capture DHCP alongside it: the offer/ack pair hands you the subnet mask, gateway, DNS servers, domain name and sometimes the WPAD option, which is the network map without a single scan.

# Capture all broadcast traffic
sudo tcpdump -i eth0 -w capture.pcap broadcast

# Listen for NetBIOS/LLMNR broadcasts (credential opportunities)
sudo tcpdump -i eth0 'udp port 137 or udp port 138 or udp port 5355'

# Capture DHCP traffic to identify network configuration
sudo tcpdump -i eth0 'udp port 67 or udp port 68' -w dhcp.pcap

# Capture mDNS (Multicast DNS)
sudo tcpdump -i eth0 'udp port 5353'

# Capture all traffic for later analysis
sudo tcpdump -i eth0 -w full_capture.pcap -s 0

Wireshark Filters

Read filters as questions rather than syntax: kerberos.as_req shows which hosts are authenticating and to which realm, ldap.bindRequest names the DCs in use, smb2.cmd == 3 is a tree connect and therefore names the file servers in play, and llmnr || nbns || mdns is the poisoning surface. A capture that carries Kerberos but no LDAP traffic is worth a second look — LDAPS or LDAP signing moves the bind off port 389 and out of the filter you were using, not off the wire.

# AD-related traffic
kerberos || ldap || smb || smb2 || dcerpc

# Find domain controllers
ldap.bindRequest || kerberos.as_req

# Credential-related broadcasts
llmnr || nbns || mdns

# DHCP (network config)
bootp

# Identify Windows hosts
browser || smb.cmd == 0x72

# HTTP traffic (internal web apps)
http.request

# Find printers (often less secured)
snmp || jetdirect

Extract Information from Captures

tshark -T fields plus sort -u turns a gigabyte of capture into a deduplicated inventory: hostnames from NBT-NS, the realm from Kerberos, share paths from SMB, virtual hosts from HTTP and usernames from NTLMSSP. Every username recovered this way is a validated account name obtained without a failed logon, which is the quietest possible start to a spray list. Note what does not appear: if the NTLM username field is empty everywhere, authentication is Kerberos-only and the capture will not hand you accounts.

# Extract hostnames from NetBIOS traffic
tshark -r capture.pcap -T fields -e ip.src -e nbns.name | sort -u

# Extract domain information from Kerberos
tshark -r capture.pcap -Y "kerberos" -T fields -e kerberos.realm | sort -u

# Find SMB shares being accessed
tshark -r capture.pcap -Y "smb2.cmd == 3" -T fields -e ip.dst -e smb2.tree

# Extract HTTP hostnames
tshark -r capture.pcap -Y "http.host" -T fields -e http.host | sort -u

# Find usernames in traffic
tshark -r capture.pcap -Y "ntlmssp.auth.username" -T fields -e ntlmssp.auth.username | sort -u

ARP Discovery

ARP is the one protocol you cannot avoid seeing on a local segment, which makes the cache a free host list. arp -a is retrospective — it shows who your machine has already talked to — while netdiscover -p and arpwatch build the list as hosts announce themselves. Sort the MAC addresses by OUI before you scan: VMware and Hyper-V prefixes flag virtualisation hosts worth targeting, printer and VoIP vendors usually run unpatched firmware, and a cluster of MACs from one vendor in a server VLAN tells you where the estate's hardware standard came from.

# View current ARP cache
arp -a

# Linux ARP cache
ip neigh show

# Passive ARP monitoring (watch for new hosts)
sudo arpwatch -i eth0

# Netdiscover passive mode (listens without sending)
sudo netdiscover -p -i eth0

# Bettercap passive mode
sudo bettercap -iface eth0 -eval "net.recon on"

Responder in Analyze Mode

Analyze mode answers the only question that matters for the poisoning phase: would this segment give me hashes? Look at the frequency of failed-name lookups — a host asking for fileserver that no longer exists will repeat that query every few minutes, and each one is a hash the moment you answer it. A steady stream of WPAD requests is a separate finding: proxy auto-discovery is enabled, so a rogue WPAD record would put you in the path of browser traffic without touching a user's machine.

# Run Responder in analyze mode (passive - no responses)
sudo responder -I eth0 -A

# Output shows:
# - LLMNR queries (hostname resolution attempts)
# - NBT-NS queries
# - MDNS queries
# - Browser elections
# - WPAD requests

# Look for:
# - Frequently queried hostnames (typos, old servers)
# - Systems making WPAD requests (proxy config)
# - LLMNR enabled (credential capture possible)

DHCP Information

A DHCP lease is authoritative network documentation: your address and mask bound the segment, the gateway tells you where routing happens, the DNS servers are almost always domain controllers (so the list doubles as DC discovery), the domain name gives you the search suffix and therefore the LDAP base DN, and option 252 hands out the WPAD URL. The lease file is worth reading after the fact because it records the lease duration — short leases on a server VLAN suggest a lab or a rapidly changing environment.

# Request DHCP information
dhclient -v eth0

# Or use nmap
sudo nmap --script broadcast-dhcp-discover

# Information gathered:
# - IP range and subnet mask
# - Default gateway
# - DNS servers (often domain controllers)
# - Domain name
# - DHCP server IP

# Check lease file for details
cat /var/lib/dhcp/dhclient.leases

DNS Enumeration (Passive)

Only the first two commands below are genuinely passive: reading /etc/resolv.conf and asking a server for its own SOA record cost one query each. The reverse-lookup loop, the AXFR attempt and the SRV lookups are active techniques that appear in the DNS server's log with your source address, so treat them as the first move of the active phase rather than as free information. What they buy you is worth the exposure: the SOA names the authoritative server for the zone, a successful axfr hands over every record at once, and _ldap._tcp.dc._msdcs returns the DC list without touching SMB.

# Check DNS configuration
cat /etc/resolv.conf

# Identify domain from DHCP-assigned DNS
nslookup -type=SOA .

# Reverse DNS lookups on discovered IPs
for ip in $(cat discovered_ips.txt); do
  host $ip 2>/dev/null | grep "domain name pointer"
done

# Check for DNS zone transfer (often allowed internally)
dig axfr @DNS_SERVER DOMAIN.COM

# Find domain controllers via DNS
nslookup -type=SRV _ldap._tcp.dc._msdcs.
nslookup -type=SRV _kerberos._tcp.

Network Topology Discovery

The topology step is where a capture becomes a plan. Cluster the addresses you have seen by /24 and count hosts per cluster: the busiest subnet is the user network and the sparsest one, full of long-lived machines, is usually the server or management VLAN. TTL values separate local from routed traffic — 128 means no hop, 127 means one router in between — so every decrement is a boundary you may have to cross. If 802.1Q tags are visible, log the VLAN IDs: moving between VLANs is a different exercise from routing between them, and it changes what the network team has to authorise.

# Identify network segments from traffic
# Look for different subnets in captured traffic
tshark -r capture.pcap -T fields -e ip.src -e ip.dst | \
  awk '{print $1"\n"$2}' | sort -u | \
  cut -d'.' -f1-3 | sort -u

# Identify routers/gateways
# Look for TTL values indicating routing
tshark -r capture.pcap -T fields -e ip.src -e ip.ttl | sort -u

# Identify VLANs (if 802.1Q tagged)
tshark -r capture.pcap -Y "vlan" -T fields -e vlan.id | sort -u

Windows Event Analysis

This section is host-local enumeration rather than passive collection: it needs a session on a domain-joined machine, which is a foothold, not a reconnaissance position. It still belongs before any scanning because one workstation answers most of the phase's questions. net use and Get-NetTCPConnection name the file servers and internal applications staff actually use, ipconfig /displaydns reveals recently visited internal hostnames, cmdkey /list shows saved credential targets (not the secrets themselves), and nltest /dclist with %LOGONSERVER% confirms the DCs you already suspected. Record what you ran: on a mature estate these commands are audited themselves.

# View network connections
netstat -ano

# View DNS cache
ipconfig /displaydns

# View recent connections
Get-NetTCPConnection | Where-Object {$_.State -eq "Established"}

# View cached credentials
cmdkey /list

# View mapped drives
net use

# View network shares
net view

# View domain information
echo %USERDOMAIN%
echo %LOGONSERVER%
nltest /dclist:%USERDOMAIN%

Quick Reference

Evidence Collection

False Positive Identification

Testing Checklist

Remediation & Defense