Impacket netview.py

Back to the Category Index / Back to the Command Index

Overview

Finds hosts in a domain, checks SMB sessions and logged-on users, and identifies where specified users have connections.

Item	Details
Implementation	examples/netview.py
Category	Active Directory / LDAP / Account Management
Size	496 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/netview.py -h for the current option definitions.

Argument	Description
identity	[domain/]username[:password]
-user	Filter output by this user.
-users	File listing users to include in the output.
-target	Target system to query. If omitted, run in domain mode.
-targets	File listing target systems to query, one per line. If omitted, run in domain mode.
-noloop	Stop after the first probe.
-delay	Delay in seconds between starting probe batches (default: 10).
-max-connections	Maximum number of open connections (default: 1000).
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller IP address. Defaults to the domain (FQDN) in target.

Detailed Processing Flow

The command builds a list of candidate machines from LDAP/RPC or an input target list, then uses worker threads and a queue to connect to each host. It collects sessions and users through WKST/SRVS/SAMR and displays matches for the filter. By default it repeats periodically; -noloop stops after one pass.

How It Works

The goal is not merely to check whether hosts are alive, but to find where specified users have sessions or logons across machines. It first obtains candidate machines from the domain or reads an explicit -target(s) list, then builds an identity filter from -user(s) separately.

Each worker connects to a target over SMB/RPC and retrieves Server Service session information and Workstation Service logged-on user information. These represent different states: the first covers network sessions; the second covers users recognized by the machine. The command combines the results to display matching hosts, users, and sources, even if permissions allow only one type of query.

The queue, connection limit, delay, and loop manage load and help avoid missed results in large domains. Worker exceptions must not leave queue items unfinished or start new connections after the stop event. -noloop stops after one pass, so distinguish a snapshot from continuous monitoring.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
USERENUM	111	__init__(), getDomainMachines(), getTargets(), filterUsers(), run(), getSessions(), getLoggedIn(), stop()
checkMachines()	76	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket.examples	logger
impacket.examples.utils	parse_identity
impacket	version
impacket.smbconnection	SessionError
impacket.dcerpc.v5	samr, srvs, transport, wkst
impacket.dcerpc.v5.ndr	NULL
impacket.dcerpc.v5.rpcrt	DCERPCException
impacket.nt_errors	STATUS_MORE_ENTRIES

Output, Side Effects, and Required Privileges

• Primarily queries and authentication attempts. Repeated runs can affect audit logs, account lockouts, and target load.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.
• stop() handles cleanup. Check that new early returns and exception paths still reach it.

When Changing the Implementation

This command depends on smbconnection, dcerpc.v5.wkst / srvs / samr, and threading/queue. USERENUM.stop(), the connection limit, and delay are important controls against excessive connections.

Verification

• Syntax: python -m py_compile examples/netview.py
• CLI: python examples/netview.py -h
• Related test: tests/SMB_RPC/test_ndr.py
• Related test: tests/SMB_RPC/test_rpcrt.py
• Related test: tests/misc/test_dcerpc_v5_ndr.py