A network security tool that detects the presence of a Responder LLMNR/NBT-NS poisoner in the network.
Respounder is a network security tool that detects the presence of a Responder LLMNR/NBT-NS poisoner in the network. It sends LLMNR name resolution requests for non-existent hostnames, forcing a malicious responder to reveal itself and helping identify compromised machines before attackers can steal hashes.
Security professionals, network administrators, and penetration testers who need to detect LLMNR/NBT-NS poisoning attacks in corporate or public networks.
It provides a simple, cross-platform command-line tool for early detection of Responder attacks, with JSON output for easy integration into monitoring systems and no external dependencies.
Respounder detects presence of responder in the network.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Available for 32/64-bit Linux, macOS, and Windows systems, as stated in the README, making it versatile for diverse network environments.
Provides structured JSON output that can be piped to syslog or other systems, demonstrated in the crontab example for corporate usage.
Built in Go with no external dependencies, allowing easy compilation and deployment, as shown in the build instructions.
Supports custom or random hostnames for LLMNR requests, reducing the chance of evasion by predictable probes.
Only detects Responder-style LLMNR/NBT-NS poisoning, missing other network attacks like ARP spoofing or DNS hijacking.
Acts solely as a detection tool; it doesn't include capabilities to block or remediate the attack, limiting its role to early warning.
Lacks a GUI or web interface, which may hinder adoption in teams preferring visual dashboards or non-technical users.