Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

On a LAN, I want to find out the names of all the connected computers using a cross-platform program, preferably nmap. I know I can do

nmap -sn

(where is a local IP address) to find hosts which are up, but how do I find the computers' hostnames? Do they broadcast this in a way that I can find using nmap?

UPDATE: It looks like Angry IP Scanner can do this. How does it do this? Can I replicate it with nmap?

share|improve this question
which hostnames? DNS names? Ask your DNS server. – ragnq Nov 16 '11 at 17:17
@ragnq nslookup doesn't give me hostnames, but Angry Port Scanner does. I'm trying to figure out how to do this with nmap and/or command line tools. – bsamek Nov 16 '11 at 19:08
up vote 0 down vote accepted

I have used nmap and other IP scanners such as Angry IP scanner. My observation was that Nmap used Reverse DNS to resolve hostnames, so for that to work the DNS server should have reverse pointer records for the hosts. I found that other scanners follow up a PTR Query with a Netbios Query.

If you are sure that all hosts on the target network are Windows hosts and that they have NETBIOS enabled, you can use nbtscan tool to scan them.

share|improve this answer

From Angry IP Scanner's FAQ ("Hostnames not shown"):

Angry IP Scanners displays hostnames returned by your DNS (name) server, by doing a reverse lookup. The server is provided the IP address and returns the hostname if it knows it.

If some computer knows its own name, it doesn't mean that it has provided it the the network's DNS server. In other words, the name of the host as it knows it itself (the local name) and the name attached to the IP address (the global name) as it known by the DNS server may not always match.

Very often, DNS queries will return some generic names, e.g., especially in ISP networks.

The names match in either of these cases:

  • Your computer has sent the name to the DHCP server from which it obtained the IP address and DHCP server has provided it to the local DNS server
  • You have a static IP address and your local hostname is configured according to the rules that match global naming convention in your network
  • Your host's TCP stack returns the local name if the local IP address is queried, not asking the global name

From Nmap's documentation ("Host Discovery"):

By default, Nmap still does reverse-DNS resolution on the hosts to learn their names.

Additional reading/info here.

share|improve this answer
On the network I'm working on Angry IP Scanner shows me the hostnames, presumably by doing a reverse-DNS lookup. What you're saying is that nmap does a reverse-lookup too. But it's not displaying the hostnames. How can I get it to display the hostnames? Or is this the wrong tool for that job? – bsamek Nov 16 '11 at 19:07

It turns out I have to specify --system-dns to get the names of the machines on the network. I'm not sure why this works. Maybe there is something unexpected in the way DNS is configured?

UPDATE: Actually, it works on one VLAN but not on another, but Angry IP Scanner works on both.

share|improve this answer

You can also use nmap -A it should show the hostnames in the output. on my network i pipe it through grep to get just the info i want. ~ grep -e 'scan report' -e 'Computer name'

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .