Skip to content


Switch branches/tags

Latest commit

…ed/disabled windows interface will now report it and move on to next interface instead of crashing (Fixes #5)

Git stats


Failed to load latest commit information.
Latest commit message
Commit time


/rɪˈspaʊnd dər/ noun

  • A tool that detects presence of a Responder in the network
  • Identifies compromised machines before hackers run away with the loot (hashes)

Respounder sends LLMNR name resolution requests for made-up hostnames that do not exist. In a normal non-adversarial network we do not expect such names to resolve. However, a responder, if present in the network, will resolve such queries and therefore will be forced to reveal itself.


Latest Releases

Respounder is available for 32/64 bit linux, OS X and Windows systems. Latest versions can be downloaded from the Release tab above.

Build from source

This is a golang project with no dependencies. Assuming you have golang compiler installed, the following will build the binary from scratch

$ git clone
$ cd respounder
$ go build -o respounder respounder.go


Running respounder is as simple as invoking it on the command line. Example invocation:

$ ./respounder

    / (           .----------------.
    [ ]░░░░░░░░░░░|// RESPOUNDER //|
    ) (           '----------------'

[wlan0]    Sending probe from   responder not detected
[vmnet1]   Sending probe from   responder not detected
[vmnet8]   Sending probe from    responder detected at


$ ./respounder [-json] [-debug] [-hostname testhostname | -rhostname]

        Prints a JSON to STDOUT if a responder is detected on
        the network. Other text is sent to STDERR
        Creates a debug.log file with a trace of the program
  -interface string
        Interface where responder will be searched (eg. eth0).
        Not specifying this flag will search on all interfaces.
  -hostname string
        Hostname to search for (default "aweirdcomputername")
        Searches for a hostname comprised of random string instead
        of the default hostname ("aweirdcomputername")

Typical usage scenario


Detect rogue hosts running responder on public Wi-Fi networks e.g. like airports, cafés and avoid joining such networks (especially if you are running windows OS)


Detect network compromises as soon as they happen by running respounder in a loop

For eg. the following crontab runs respounder every minute and logs a JSON file to syslog whenever a responder is detected.

* * * * * /path/to/respounder -json | /usr/bin/logger -t responder-detected

Example syslog entry:

code@express:~/$ sudo tail -f /var/log/syslog
Feb  9 03:44:07 responder-detected: [{"interface":"vmnet8","responderIP":"","sourceIP":""}]


Respounder in action

Coming Up Next: Android App

There are plans to port this tool to an android app so that adversarial Wi-Fi networks (eg. WiFi Pineapple or WiFi Pumpkin running responder) can be detected right from a mobile phone.