Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

how can i issue a nmap command that shows me all the alive machines' IP s and corresponding hostname s in the LAN that i am connected? (if this can be done in another way/tool you're welcomed to answer surely)

share|improve this question
add comment

migrated from stackoverflow.com Jun 22 '10 at 20:22

This question came from our site for professional and enthusiast programmers.

8 Answers

nmap -sP 192.168.1.*

This gives me hostnames along with IP adresses, and only pings the hosts to discover them. This will only give you the hostnames if you run it as root.

share|improve this answer
2  
+1 with the caveat that this only returns machines which respond to ICMP. Any machine specifically blocking ICMP will not show up –  Matt Simmons Jun 22 '10 at 20:59
1  
@MattSimmons If nmap is run as root and the IPs are from local network (the server is member of the subnet), then ARP requests are sent. So it will detect any alive machines because nobody really blocks ARP packets. Oh, and with new nmap versions it's -sn (although -sP will work too). –  Hubert Kario May 19 '12 at 22:24
    
I'm not getting any hostnames with this command. Suggestions? –  daviesgeek Aug 15 '12 at 5:53
    
@daviesgeek Tried running it as root? –  Cheesebaron Aug 15 '12 at 7:38
    
@Cheesebaron Ah. That's it. I would suggest adding that, as without it, it won't show the hostnames. –  daviesgeek Aug 15 '12 at 17:19
add comment

You can scan an entire subnet, can use wildcards also.

nmap 192.168.8.*

or

nmap 192.168.8.1/24
share|improve this answer
add comment

NMAP will return the 'reverse-lookup' of the IP address in question, it can't return the forward lookup address. Or addresses in the case of Web Servers doing name-based virtual hosting. Nmap isn't the tool for this.

share|improve this answer
    
which tool shall i use then? –  Infestor Jun 22 '10 at 20:41
    
I don't know of anything that does this. –  sysadmin1138 Jun 22 '10 at 20:45
add comment

You can use the following command :

nmap -v -A $IP
share|improve this answer
add comment

nmap -sP 192.168.0.0/24 will output something like :

> nmap -sP 192.168.0.0/24

Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2010-06-22 22:27 CEST
Host 192.168.0.0 appears to be up.
Host 192.168.0.1 appears to be up.
Host abcd.domain.tld (192.168.0.2) appears to be up.
Host def.domain.tld (192.168.0.3) appears to be up.
Host fdsf.domain.tld (192.168.0.4) appears to be up.
Host reht.domain.tld (192.168.0.5) appears to be up.
Host vcxbfd.domain.tld (192.168.0.6) appears to be up.
Host ezqs.domain.tld (192.168.0.7) appears to be up.
Host 192.168.0.8 appears to be up.
Host ilolio.domain.tld (192.168.0.9) appears to be up.
Host ipbd.domain.tld (192.168.0.10) appears to be up.
Host cdekf.domain.tld (192.168.0.11) appears to be up.
Host 192.168.0.12 appears to be up.
Host 192.168.0.13 appears to be up.
Host 192.168.0.14 appears to be up.
Host 192.168.0.15 appears to be up.
Host ainv.domain.tld (192.168.0.16) appears to be up.
Host 192.168.0.17 appears to be up.
Host 192.168.0.18 appears to be up.
Host wzdkz.domain.tld (192.168.0.19) appears to be up.
[…]
Nmap finished: 256 IP addresses (256 hosts up) scanned in 7.491 seconds
share|improve this answer
    
how can i learn the machine name? i get the hostnames as following: dhcp-186-241.abc.dk dhcp-186-250.abc.dk .... for example when i issue hostname on ubuntu terminal i get: infestor-pc but nmap shows my hostname as dhcp-186-250.abc.dk. is there a way to see the 'friendly' hostname? –  Infestor Jun 22 '10 at 20:37
    
No the only way would be to register computers name into the DNS –  radius Jun 22 '10 at 21:02
add comment
nmap -sP 192.168.1.0/24

Note that name resolution is only as good as the reverse-dns population is. Also note that this won't get you systems which are firewalled against ping (which practically every windows workstation is by default).

If you are local to the systems (ie on the same subnet) you can do something like

for i in `seq 1 254` ; do arping -c 1 192.168.1.$i | grep reply ; done

...but weird things happen to me sometimes when I wrap arping up in a loop. Also you have to do the lookup yourself, with something like

dig +short -x $IP
share|improve this answer
add comment

Best and Fastest way to ping all Ips in Local Net is by disabling DNS reverse Resolution

Use :
NMAP -sn 192.168.1.1-255

this will scan all 255 hosts in IP range 192.168.1.1 - 192.168.1.255

If you want a easily parse-able file

Use :
NMAP -sn -oG Name.txt 192.168.1.1-255

share|improve this answer
add comment

I think you should run this:

sudo nmap -sU --script nbstat.nse -p137 10.10.10.*
share|improve this answer
    
This doesn't add anything over the existing answers, and moreover will only find Windows hosts with sharing enabled. Certainly more specific than the OP wanted. –  Scott Pack Oct 24 '12 at 14:40
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.