Disco is a passive IP discovery and fingerprinting utility designed to sit on segments distributed throughout a network to discover unique IP's on the network. In addition to IP discovery disco has the ability to passively fingerprint TCP SYN packets and TCP SYNACK packets.
Features:
* Option to fingerprint SYNACK packets
* Option to output more verbose fingerprint info to outfile
* A ton of new fingerprints (1214 SYN/SYNACK fingerprints)
* BSD compile support into codebase
* Option to run Disco on interfaces without an assigned IP
* Uniquely identify source IPs on the network
* Toggle discovery of only TCP SYN/SYNACK packets and fingerprint
* Ability to toggle fingerprinting on/off
* Output data to a flat text file
* Define TCPDUMP style rules to filter on a subset or range of IPs
* Able to turn "uniqueness" off when fingerprinting for fingerprinting all TCP SYN/SYNACK packets
* Parse a previously saved TCPDUMP file through DISCO
* Option to add a system timestamp to output file
* Natively pipe output to another program
