How can I issue a nmap command that shows me all the alive machines' IP addresses and corresponding hostname s in the LAN that I am connected? (if this can be done in another way/tool you surely are welcome to answer)
nmap versions lower than 5.30BETA1:
nmap -sP 192.168.1.*
newer nmap versions:
nmap -sn 192.168.1.*
This gives me hostnames along with IP adresses, and only pings the hosts to discover them. This will only give you the hostnames if you run it as
EDIT: As of Nmap 5.30BETA1 [2010-03-29]
-sP has been replaced with
-sn as the preferred way to do ping scans, while skipping port scanning, just like the comments indicate:
Previously the -PN and -sP options were recommended. This establishes a more regular syntax for some options that disable phases of a scan:
- -n no reverse DNS
- -Pn no host discovery
- -sn no port scan
nmap -sP 192.168.1.0/24
Note that name resolution is only as good as the reverse-dns population is. Also note that this won't get you systems which are firewalled against ping (which practically every windows workstation is by default).
If you are local to the systems (ie on the same subnet) you can do something like
for i in `seq 1 254` ; do arping -c 1 192.168.1.$i | grep reply ; done
...but weird things happen to me sometimes when I wrap arping up in a loop. Also you have to do the lookup yourself, with something like
dig +short -x $IP
nmap -sP 192.168.0.0/24 will output something like :
> nmap -sP 192.168.0.0/24 Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2010-06-22 22:27 CEST Host 192.168.0.0 appears to be up. Host 192.168.0.1 appears to be up. Host abcd.domain.tld (192.168.0.2) appears to be up. Host def.domain.tld (192.168.0.3) appears to be up. Host fdsf.domain.tld (192.168.0.4) appears to be up. Host reht.domain.tld (192.168.0.5) appears to be up. Host vcxbfd.domain.tld (192.168.0.6) appears to be up. Host ezqs.domain.tld (192.168.0.7) appears to be up. Host 192.168.0.8 appears to be up. Host ilolio.domain.tld (192.168.0.9) appears to be up. Host ipbd.domain.tld (192.168.0.10) appears to be up. Host cdekf.domain.tld (192.168.0.11) appears to be up. Host 192.168.0.12 appears to be up. Host 192.168.0.13 appears to be up. Host 192.168.0.14 appears to be up. Host 192.168.0.15 appears to be up. Host ainv.domain.tld (192.168.0.16) appears to be up. Host 192.168.0.17 appears to be up. Host 192.168.0.18 appears to be up. Host wzdkz.domain.tld (192.168.0.19) appears to be up. […] Nmap finished: 256 IP addresses (256 hosts up) scanned in 7.491 seconds
Since there is no given IP for the LAN we could assume it is 192.168 but that's not always the case, so the first thing is to discover our IP address and our subnet mask.
use ifconfig for this and use regexp to clean the results
Now assuming your Ip is 192.168.0.100 and your mask is 255.255.255.0 then you can scan 1-254 like so
nmap -sn 192.168.0.1-254 or nmap -sn 192.168.0.0/24
to see hostnames and MAC addresses also, then run this as root otherwise all the scans will run as a non-privileged user and all scans will have to do a TCP Connect (complete 3-way handshake) to get something. As root, you run Syn and don't have to finish the 3-way handshake.
This is basically what you need to answer your question and get what you wanted. There is a wealth of parameters but each serves a special purpose.
I've just noticed hostname. You can use a service discovery scan since it will execute several scripts(one of which is nbstat.nse) and will return hostnames. Don't expect to get the hostnames of all the machines that you scan.
nmap -sV target
or you can just run the specific nbstat.nse script and gain time and effort.
nmap -sU -p137 --script nbstat.nse target
nbstat.nse uses UDP port 137. In some cases you might also get the hostname from SNMP using the snmp-interfaces script but that will require UDP port 161 to be open.
nmap -sU -p161 --script snmp-interfaces.nse target