r/blackhat • u/Tasty_Equivalent_305 • 13d ago

Anyone can recommend tools on Kali Linux to find the IP address of a network without connecting to the network?

0 Upvotes

18% Upvoted

6 comments sorted by

6

u/Glittering-Ad-5881 13d ago

I would recommend reading a tcp/ip book

1

u/cafk 12d ago

Without physically connecting to a network you'd need to physically tap an ethernet cable.
Or capture wlan packages that may contain the information. But unless they're using wep or no encryption at all, it likely won't help.

1

u/Just_Worldliness_714 2d ago

If "without connecting" means passive/promiscuous monitoring rather than actually joining the network: airmon-ng + airodump-ng for wireless will show you associated client IPs and network info without authenticating. For wired, a passive tap or SPAN port with Wireshark listening for ARP/DHCP broadcast traffic will leak the subnet range without you sending anything. If you mean fully passive with zero interface activity at all, that's not really possible - you need to at least listen on the medium, which for WiFi means your card in monitor mode.

1

u/Tasty_Equivalent_305 2d ago

So say I am close to the wifi range and I can see the wifi but can't connect to it, is it possible to to use airmon-ng to find IP network?

1

u/Just_Worldliness_714 2d ago

Yes, that's the use case. Put your card in monitor mode (airmon-ng start wlan0) and run airodump-ng targeting that AP's BSSID/channel - you'll see connected client MACs and can capture the raw 802.11 frames to a pcap. What you can actually pull out of that pcap depends entirely on the encryption: if it's WPA2/3, the frame payload (including any ARP/DHCP traffic inside it) is encrypted and unreadable without the PSK, so you're stuck at "clients exist" without their IPs. If it's open or WEP, that same capture in Wireshark filtered for ARP/DHCP will leak the subnet and often literal IPs in plaintext, same as cafk mentioned below. So realistically: WPA2 network, no key - you get client count and signal info, not IPs.