nmap find all alive hostnames and IPs in LAN

Question

how can i issue a nmap command that shows me all the alive machines' IP s and corresponding hostname s in the LAN that i am connected? (if this can be done in another way/tool you're welcomed to answer surely)

Answer 1

nmap -sP 192.168.1.*

This gives me hostnames along with IP adresses, and only pings the hosts to discover them

Answer 2

You can scan an entire subnet, can use wildcards also.

nmap 192.168.8.*

or

nmap 192.168.8.1/24

Answer 3

NMAP will return the 'reverse-lookup' of the IP address in question, it can't return the forward lookup address. Or addresses in the case of Web Servers doing name-based virtual hosting. Nmap isn't the tool for this.

Answer 4

nmap -sP 192.168.0.0/24 will output something like :

> nmap -sP 192.168.0.0/24

Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2010-06-22 22:27 CEST
Host 192.168.0.0 appears to be up.
Host 192.168.0.1 appears to be up.
Host abcd.domain.tld (192.168.0.2) appears to be up.
Host def.domain.tld (192.168.0.3) appears to be up.
Host fdsf.domain.tld (192.168.0.4) appears to be up.
Host reht.domain.tld (192.168.0.5) appears to be up.
Host vcxbfd.domain.tld (192.168.0.6) appears to be up.
Host ezqs.domain.tld (192.168.0.7) appears to be up.
Host 192.168.0.8 appears to be up.
Host ilolio.domain.tld (192.168.0.9) appears to be up.
Host ipbd.domain.tld (192.168.0.10) appears to be up.
Host cdekf.domain.tld (192.168.0.11) appears to be up.
Host 192.168.0.12 appears to be up.
Host 192.168.0.13 appears to be up.
Host 192.168.0.14 appears to be up.
Host 192.168.0.15 appears to be up.
Host ainv.domain.tld (192.168.0.16) appears to be up.
Host 192.168.0.17 appears to be up.
Host 192.168.0.18 appears to be up.
Host wzdkz.domain.tld (192.168.0.19) appears to be up.
[…]
Nmap finished: 256 IP addresses (256 hosts up) scanned in 7.491 seconds

Answer 5

nmap -sP 192.168.1.0/24

Note that name resolution is only as good as the reverse-dns population is. Also note that this won't get you systems which are firewalled against ping (which practically every windows workstation is by default).

If you are local to the systems (ie on the same subnet) you can do something like

for i in `seq 1 254` ; do arping -c 1 192.168.1.$i | grep reply ; done

...but weird things happen to me sometimes when I wrap arping up in a loop. Also you have to do the lookup yourself, with something like

dig +short -x $IP

Answer 6

You can use the following command :

nmap -v -A $IP

Answer 7

I think you should run this:

sudo nmap -sU --script nbstat.nse -p137 10.10.10.*