Find computer names on a private network (with nmap?)
On a LAN, I want to find out the names of all the connected computers using a cross-platform program, preferably nmap. I know I can do
nmap -sn xxx.xxx.xxx.xxx/24
(where xxx.xxx.xxx.xxx is a local IP address) to find hosts which are up, but how do I find the computers' hostnames? Do they broadcast this in a way that I can find using nmap?
UPDATE: It looks like Angry IP Scanner can do this. How does it do this? Can I replicate it with nmap?
Solution 1:
From Angry IP Scanner's FAQ ("Hostnames not shown"):
Angry IP Scanners displays hostnames returned by your DNS (name) server, by doing a reverse lookup. The server is provided the IP address and returns the hostname if it knows it.
If some computer knows its own name, it doesn't mean that it has provided it the the network's DNS server. In other words, the name of the host as it knows it itself (the local name) and the name attached to the IP address (the global name) as it known by the DNS server may not always match.
Very often, DNS queries will return some generic names, e.g. dhcp-12-13.superisp.com, especially in ISP networks.
The names match in either of these cases:
- Your computer has sent the name to the DHCP server from which it obtained the IP address and DHCP server has provided it to the local DNS server
- You have a static IP address and your local hostname is configured according to the rules that match global naming convention in your network
- Your host's TCP stack returns the local name if the local IP address is queried, not asking the global name
From Nmap's documentation ("Host Discovery"):
By default, Nmap still does reverse-DNS resolution on the hosts to learn their names.
Additional reading/info here.
Solution 2:
It turns out I have to specify --system-dns to get the names of the machines on the network. I'm not sure why this works. Maybe there is something unexpected in the way DNS is configured?
UPDATE: Actually, it works on one VLAN but not on another, but Angry IP Scanner works on both.