Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am trying to use nmap to ping a list of domains, i am using:

nmap -sP -iL /path/to/file/domains

The ping works fine but in the output for domains that ping was successful I get the domains ip like this:

Host is up (0.55s latency).

Is there a way to get the output as domains instead of ips?

share|improve this question
You can use the "--dns-servers" option to specify another dns server if your current system DNS (from resolv.conf) doesn't have the reverse-DNS PTR records that you need. – Cory J Aug 25 '10 at 23:25
Did the -oG flag actually provide the desired output? In my testing, it does not. – chuckx Aug 26 '10 at 22:53
up vote 0 down vote accepted

add the -oG ("greppable output") option.

share|improve this answer

Assuming you didn't scrub the output (i.e. is really one of the hosts you're probing), the problem is that there is no PTR record in DNS for the IP. That is, there is no reverse mapping from the IP -> FQDN that nmap can present in the output.

For example, here's what you get when a PTR record exists:

$ nmap -sP | grep ^Host
Warning: Hostname resolves to 2 IPs. Using
Host ( appears to be up.

I'd recommend a 2-step process such as this (although it is not as efficient since you're starting up a new nmap process for each probe, you do keep your information together):

$ cat domains

$ cat

for domain in `cat $1`
    echo Probing $domain
    nmap -sP $domain 2> /dev/null \
        | grep ^Host
done \
    | sed '$!N;s/\n/ /' \
    | sed 's/Probing //' \
    | sed 's/Host.*(\(.*\)) \(.*\)/(\1) \2/'

$ ./ domains ( appears to be up. ( appears to be up.

Before nmap runs you simply print out a note detailing what hostname you're probing. Then you can format the output to use the information you fed to nmap.

Note #1 - is a domain that Google owns. So even when a PTR record exists there's no guarantee that it's something you'd expect.)

Note #2 - I did the sed stuff at the end to clean up the output. It isn't necessary and the output is totally usable without it.

share|improve this answer

Using the -R will turn on reverse name resolution.

share|improve this answer
the final output is still ips not the domains – netrev Aug 23 '10 at 17:05

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.