the main goal of our sniffer is to perform udp-based host discovery on target network attackers want to be able to see all of the potential targets on network so that they can focus their reconnaissance and exploitation attempts we'll use known behavior of most operating systems when handling closed udp ports to determine if there is an active host at particular ip address when you send udp datagram to closed port on hostthat host typically sends back an icmp message indicating that the port is unreachable this icmp message indicates that there is host alive because we' assume that there was no host if we didn' receive response to the udp datagram it is essential that we pick udp port that will not likely be usedand for maximum coverage we can probe several ports to ensure we aren' hitting an active udp service why udpthere' no overhead in spraying the message across an entire subnet and waiting for the icmp responses to arrive accordingly this is quite simple scanner to build with most of the work going into decoding and analyzing the various network protocol headers we will implement this host scanner for both windows and linux to maximize the likelihood of being able to use it inside an enterprise environment we could also build additional logic into our scanner to kick off full nmap port scans on any hosts we discover to determine if they have viable network attack surface these are exercises left for the readerand look forward to hearing some of the creative ways you can expand this core concept let' get started