What is netrecon?

NetRecon is a network reconnaissance and defensive intelligence toolkit written in Python. It helps security teams and network administrators discover, analyze, and understand the devices and services running on a network. When you point NetRecon at a network range, it first discovers which devices are active using several techniques including ARP (a protocol for mapping IP addresses to hardware addresses), ICMP ping-style probes, TCP, and UDP scanning. Discovered devices are then probed to identify which services they are running, and those services are enriched with additional context: DNS hostnames, service banners, TLS certificate information, and HTTP fingerprints. Optional SNMP data collection is also supported. NetRecon can layer in offline vulnerability context by ingesting local data in NVD JSON 2.0 format, letting you cross-reference discovered services against known security issues without sending data to an external service. All scan results are stored locally. Results can be exported in a wide range of formats including JSON, GraphML, GEXF, Cytoscape, Obsidian Canvas, Neo4j CSV, Sigma.js JSON, and STIX bundle, catering to different visualization and analysis tools. A live web interface can display scan results in real time as the scan runs. An agent mode supports continuous periodic monitoring. Three predefined scan profiles control intensity: Light for fast minimal scanning, Medium for a balanced approach, and Deep for maximum discovery and enrichment. Some scan modes require elevated system privileges. The README notes that NetRecon should only be used on networks you own or have explicit permission to test.