Scan local subnet for domain names

Question

What is the best way to scan (using OS X, GUI/Terminal app), for ip's on a local subnet that have a domain name?

Thanks!

Answer 1

If you don't want to actually check if the hosts exist, is to just loop through the IP addresses and do a reverse lookup. The following recipe works on Linux and FreeBSD; I don't know how the host program on Mac OS X behaves:

for x in $(seq 1 254); do
    host 10.0.0.$x || echo "no hostname for $x"
done

You can also use nmap to discover what hosts are up, do a reverse DNS lookup on the hosts that it finds, and then filter on that. nmap has a bunch of options to fine tune the output, but perhaps start with

nmap -sP -R '10.0.0.*' -oN outfile

Or use -oX for XML output that you can process more deterministically. Or combine it with a call to host.