Heimdall Listener

00000000 c7 56 e4 8b 39 27 08 49 j?[}.*NB 00000010 33 ee 3b f2 d6 66 bb c2 Y.#Fie.. 00000020 4d 13 23 82 c4 95 1d c2 .<.pVH.x 00000030 52 b7 67 5f 9e c8 c4 20 1q.dB}v\ 00000040 b2 3d 5f 09 48 b2 5d 21 p.ME..)r 00000050 80 e7 fb 98 4c b7 a4 55 .`z...zi 00000060 e3 2b a7 0b f1 f9 1b 6e ..a..t.. 00000070 5c 5a c5 0a 22 66 3c c3 ..O50?q6 00000080 ed c9 c0 62 dd 9e 00 97 ..tx.?.j 00000090 fb ae 95 cb 92 cb 57 79 :Uvb5U.6 000000a0 f9 1d 2c df cd 7d 3b 4e `.!u-.L. 000000b0 1b 7e 68 53 f3 bf cd 70 .s.....r 000000c0 7e 10 c7 d2 1e 18 12 e4 -%....6i 000000d0 61 9f 15 47 9c f4 48 25 j.On..]g 000000e0 63 28 f8 3d 73 96 94 0e .s|E.\.. 000000f0 09 de bd ff fb 9b d7 11 `Zh.7mBN 00000100 0f a4 68 4a f0 74 5e 99 w..K5^). 00000110 af 47 b2 60 28 14 b3 45 #.gE...N 00000120 2e 49 b0 b2 1d 90 62 f8 '.ns 000001a0 b2 18 9c ca a5 ed bc d2 5M..KIk. 000001b0 9a 35 95 80 ea ff 94 bb (>;.P*.K 000001c0 17 3e 89 fb 7c a5 20 71 v.rg_._} 000001d0 e1 c2 d1 d6 f7 f1 66 19 RN`XU@.C 000001e0 f9 46 4d ca 2f 95 ed c6 ..5_+8d/ 000001f0 7f 47 de 14 8c 55 d7 e7 w=xSZ3su 00000200 8d 61 c3 c3 3f a6 4d cd eu.sc.2. 00000210 6a 19 5a 0c 13 63 7a 43 _..{..:n 00000220 f6 dd c6 7f 9b cc 0a 56 [4.w,!B+ 00000230 19 04 14 9e b6 99 fd e1 Z*-....- 00000240 7a 45 e3 12 75 4e b2 a2 b.pJ.a.. 00000250 2e 9a 1f 04 72 26 c5 1d .m.[&.I. 00000260 06 61 1b 91 b1 a5 cb 48 -.?#!.: 00000410 ce 1c 32 98 5a 0c 1e 9a ..?.{S[. 00000420 7f b9 7c fc 22 f4 ba e4 Ymm.Y..P 00000430 d1 8f 6f 14 75 ae 16 60 ...+k.b. 00000440 02 45 55 24 8c a3 a6 06 ..Z}Hu{. 00000450 58 2e ca a4 7e 5b 51 72 !.#.!8.. 00000460 fa 1b b9 a2 3b 8a b1 ef ...OAb.. 00000470 7e 7b 41 0f 05 f6 cb da @t-dA..? 00000480 e9 66 91 db fe 75 60 b9 >A@2=.8. 00000490 2d 35 2f fd 22 ba 78 52 .w..Dv.. 000004a0 d2 35 03 5e 09 ce 61 ed )L,@G+Sa 000004b0 eb fd f8 06 dc ef 6e 98 wl..-c.- 000004c0 a6 10 33 be 09 f7 61 b9 _ph...9\ 000004d0 52 f9 2d b5 cd 43 5e 69 p2{.-EQ. 000004e0 ee aa b1 67 66 8f 2f b8 .oy.Hv&m 000004f0 de b0 db 65 97 11 d6 b1 &._.m9-. 00000500 a1 81 4b 07 0f 08 61 81 tH|...L. 00000510 be 51 c0 6a 00 80 26 d2 ...,6..2 00000520 72 ca 02 bb df cd 73 26 ...cn.Kf 00000530 2d 01 30 67 61 8b a6 e6 ..!:n,w6 00000540 76 38 8c 4e ce a8 c1 25 `z.W.].< 00000550 d0 a1 d0 a2 e5 e3 06 b3 ..".hOH. 00000560 09 c0 7c 78 d2 de 08 3a 8*u..MfN 00000570 0b 25 3d 50 4e 55 f8 01 -g.}Y... 00000580 be da c0 ba 9e fd 91 f9 <.^>c-7. 00000590 67 e0 5c bc c0 f2 d7 25 `G.+u3..

00000000 6b 1a 04 05 25 e6 cb b4 S.Z]O..f 00000010 a0 89 af 5d c8 e2 96 95 .:.laH.. 00000020 8b d7 de f6 38 b7 c9 df .\iS!!3. 00000030 58 d3 f7 be 62 9c e6 a3 6q.I\.FN 00000040 ab 0a da 2e 8c ed 0f b3 4Y.x...n 00000050 89 d3 b6 66 c4 47 02 db ....QY.S 00000060 0f eb 57 f2 b0 51 c7 96 G[.6E..) 00000070 5b 52 fb 6d 8f f5 cb 5f ..$$..)C 00000080 a2 33 0c 69 6c 2f 0d f6 j!.%.x.} 00000090 37 24 dc 33 8c be 9c d4 ...[.g.V 000000a0 67 67 39 ea 35 e3 19 b9 .BN+..". 000000b0 f9 9f f9 66 cd f9 96 40 u[.V".t. 000000c0 5a b7 af b7 a6 a8 49 44 ...*y.g. 000000d0 f1 5f df 78 c1 32 73 12 eF..Z5.6 000000e0 ed d7 66 05 62 51 96 4c ....w-.- 000000f0 b4 df aa 6d 7a 0a c5 91 {'nA"7'. 00000100 99 84 df b4 d3 be b7 b7 .q.wa.o" 00000110 a0 66 54 fb 48 70 8a 24 fv.q.._. 00000120 92 5a 71 2a a6 03 e7 61 /._yGHDZ 00000130 d3 82 2a 76 18 85 6b c7 .knV..V. 00000140 0c a7 98 92 4f e1 bc 3b (.DfDz`. 00000150 ea 98 55 39 ad e7 a6 9f *..b..6. 00000160 39 24 8d 34 9c b5 6d 2c iQJ.ST,. 00000170 e0 ee 5b ce 4f b1 d6 81 e.)IaXW] 00000180 73 15 18 b4 7d 81 57 a4 a:a.aA"P 00000190 f6 6a ac b0 19 4b e1 bb j.?My<*1 000001a0 e0 67 c0 04 e2 c2 09 45 H./[R-|N 000001b0 45 85 0b 37 aa 61 21 2d .Y;.Rn62 000001c0 83 e5 1a 8f c5 66 58 a0 _.9*L<.M 000001d0 e4 58 43 ae 72 de 44 6d 8y.U.o[. 000001e0 a9 cb 77 cb f9 17 33 5e s.u<.p:> 000001f0 f9 12 85 59 46 3d dc 40 @.)+"X.T 00000200 be da 13 e6 89 48 26 d3 ^0.a@%.` 00000210 83 b7 94 e4 0e 8c b7 a7 ].+.%j.2 00000220 21 33 88 82 2e b7 74 29 .6kWo*.. 00000230 ab c6 63 b6 14 7f fe 76 ...PeK.$ 00000240 3c 92 9d aa 8f 14 3d f4 .z..P0JX 00000250 49 f7 25 bd 55 2e 17 3a ."..[..* 00000260 43 12 1a b5 1c f2 5f 1d C'.,|... 00000270 65 61 31 5b 6c d1 26 b8 .u...5j} 00000280 90 02 34 5f 01 f2 6a a9 ..{-!.U= 00000290 60 8c 04 66 2c 80 dc 75 ;.hVww`W 000002a0 4d 9c ed 04 5c 7c 18 ab pw%..99U 000002b0 75 ff 10 43 ba 25 5e 44 0,Q..q9. 000002c0 ae 77 c0 49 02 a8 c2 9c .8r-9L\" 000002d0 c8 56 f5 df 2a bb d0 92 f]K..b[. 000002e0 f4 20 d0 e5 6f 5c 89 a2 `u.#.ke. 000002f0 cf 43 ab 6a b0 36 fb d8 .tIW.b!I 00000300 2c 42 e4 48 91 9f 85 1b .Wo8\Ti. 00000310 a5 0a c5 c1 83 83 c2 ba \HHX.... 00000320 bb 7b 1c 6b 17 44 20 85 ..1.I.9m 00000330 6f f5 73 99 20 fb 3a 83 .t.Vd.L. 00000340 e2 7b c2 82 79 30 c3 b7 ..N/.o.$ 00000350 f3 ed 72 24 32 2b 8a 55 ..xs4.]. 00000360 c8 30 65 f0 cd 31 01 65 A.5.i.J. 00000370 4c 24 60 7d 9a ed 7b b6 [..L5..= 00000380 bd cb be 09 5a 2f 0b 8f ..Bgcc/@ 00000390 49 c5 72 44 3f 60 05 b1 3C/(.PMs 000003a0 d4 29 c1 67 94 8a b4 e8 v(g42$RK 000003b0 f7 b5 7f 12 06 5c 9f 8c *..KB.pv 000003c0 b1 2d 84 29 93 1f 42 4b z$Jzx<.. 000003d0 69 6a e3 2e 36 94 5b 70 it.^S 00000420 15 f2 8b 82 21 aa 4b 26 ....BF.e 00000430 7d bf 12 88 df ad a2 d0 >B.EM.oG 00000440 12 81 9b 90 50 72 c5 7b .8..I"E9 00000450 37 24 8d 90 ad 03 85 3a .j!dr9.c 00000460 37 cb 80 9f cd 2d 93 b0 1K..^..} 00000470 94 0e 1a 48 a1 a1 da 0d *.Y..6#. 00000480 db 1f 44 80 11 72 53 52 ..#"+.-. 00000490 24 c4 9f 56 9c fb bf ad 1.qj...R 000004a0 73 b3 3f ae 98 0f 1c 47 .s...<@. 000004b0 9b 8a d6 2a 02 cd e6 8a j,'C..Q. 000004c0 ab c4 8a c2 aa 84 ef 19 ..NG.0hA 000004d0 ca 52 f6 c6 27 8c 73 1f =/|>.D.. 000004e0 f8 4d b0 96 a6 a7 1d 60 51.aS"$M 000004f0 29 47 2d d6 d2 c8 74 cf .pi.FX-. 00000500 69 37 24 ef 9a 47 52 4d .G}c{/s. 00000510 59 75 54 8b fa 0e 18 cf ...G.&FY 00000520 53 9d 8c 6b ee 2a 5b 9a ..np.1e[ 00000530 9c a3 ee 26 99 8e ba 9e ..Qg...> 00000540 64 ff 96 1a ae bc 50 46 i./K..E. 00000550 74 ee 9c 2b a1 9e e0 75 Zk.+..su 00000560 f7 2d 04 2c 04 0e 47 d2 M.)...). 00000570 02 c9 e9 bb 47 98 ec 8e ..|]'.du 00000580 08 e6 3f bc 37 77 cb 51 zXqH..ge 00000590 5f 24 4e 59 ac 96 62 fe ?B.C.j!.

Heimdall Listener active

Passive sensor for the LLMNR, NetBIOS, mDNS, WPAD and DHCPv6 chatter that Responder, Inveigh and mitm6 feed on, and for hosts that answer like a poisoner.

★ 3 · ⑂ 2 · Go · updated 2026-11-09 · latest v2.0.0 · GPL-3.0 · since 2024

GoFynelibpcapsystemddefensivenetworkblue-team

screenshot

heimdall-listener · uipng

Heimdall Listener window listing hosts seen broadcasting legacy name-resolution protocols

for practitioners

Shows which hosts are still broadcasting legacy name resolution, the raw material for Responder, mitm6 and ntlmrelayx.
Point-and-click GUI, so sysadmins and home users get the same view an attacker gets without learning tcpdump filters.
Windows, Linux and macOS binaries; needs root or Administrator because it listens on the wire.

about

Heimdall Listener sits on an interface and records every host that sends LLMNR, NetBIOS name service, mDNS or WPAD requests. Those broadcasts are what poisoning tools answer to capture and relay credentials, so the hosts in the list are the ones to fix with group policy or local settings.

It was built with the Fyne GUI toolkit so nobody has to remember capture switches, and it is released under GPL-3.0.

install

heimdall-listener · installsh

# Linux: apt install libpcap-dev   Windows: install Npcap
go install github.com/ZerkerEOD/heimdall-listener/cmd/heimdall-listener@latest
sudo heimdall-listener     # pick an interface, Start Listening