The underlying principle that describes ARP discovery with netdiscover is essentially the same as what we discussed with the previous layer 2 discovery approaches. The major differences between this tool and some of the others that we have discussed include the passive discovery mode and inclusion of the MAC vendor in the output. Passive mode is, in most cases, useless on a switched network, because the receipt of an ARP response will still require some interaction with discovered clients, albeit independent of the netdiscover tool. Nonetheless, it is important to understand this feature and its potential usefulness in a broadcast network such as a hub or wireless network. The netdiscover tool identifies the MAC vendor by evaluating the first half (first three octets /24 bits) of the returned MAC address. This portion of the address identifies the manufacturer of the network interface and is often a good indication of the hardware manufacturer for the rest of the device.