I'm wanting to run nmap on a linux machine but all I know is the hostname. I'm on the same network but cannot figure out how to do this. All I want to obtain is the IP so I can run scans on it. How exactly can I achieve this. I running Kali Linux

I've looked up a few commands already but not having much luck. One commmand spit out some results but I didn't give me the IP address of that linux machine so I must of missed used it or it's not the command I want. Below you will find the commands and outputs I've tried already.

The hostname is Epiphyte-ix


Provided the host is in DNS...

host epiphyte-ix


ping -c3 epiphyte-ix

or simply

nmap -v epiphyte-ix

But if none of the above works the host is probably not in DNS and you'll have to figure out the IP address some other way. What do you know about the host? Does it have for example SSH open? How many hosts are there on the network? If only a handful you can run nmap across the subnet looking for SSH servers:

nmap -v -p22

(change to your subnet's address range).


More info based on the comments below.

Take it from the physical location, assuming you've got a admin access as you claimed...

  1. Visit the teacher's office and note the network wall socket's label (usually there is a sticker with some number).
  2. Go the comms cabinet (that's where patch panels are connected to network switches) an find out to which switch and port that wall socket is connected to.
  3. Login to that switch and get the MAC address(es) of computers connected to that port.
  4. Login to that subnet's gateway and from the ARP table find out the IP address corresponding to the above MAC addr.

Some more techniques...

  1. Use a Zeroconf browser (aka avahi, bonjour, etc - there are even some for iPhone and Android like Discovery) and see if the name is advertised through Zeroconf.
  2. If he emails you from the computer check the email headers and see what IP it came from.
  3. Check the DHCP leases on the DHCP server - perhaps it sent the name to obtain an IP address from DHCP.
  4. He may be using IPv6 - in that case most of the above still applies (apart perhaps from the DHCP bit), just the addresses are different.
  5. etc...

There are many ways to find and there is no such thing as "hiding IP address" - if he wants to have internet access he must talk at least to the gateway. He can block access to/from all other hosts on the network (but I doubt that) but if you have access to the gateway you can catch him there.

| improve this answer | |
  • I guess I should clarify the type of network i'm on and the host computer. My professor at school has challenged me try and find his computer on the schools network. He has a linux box setup in his office that serves as a server which has the hostname I mentioned above. All he gave me was his hostname Epiphyte-ix. – SCY Aug 14 '14 at 0:11
  • We have three networks at the school. The admin network then the wireless network, then another experimental network. I work in the IT department so I have admin rights which allows me to connect to the admin network for better speed and security. But I know my boss has mentioned not to be scanning the entire subnet of the admin network. That being said I'm not for sure what strategies i'm left with without raising any alarms on the admin side. – SCY Aug 14 '14 at 0:13
  • Saying that, i've notice that on my VMware side my ip address falls within a different naming convention like 192.168.etc.etc... However, on my Mac OSX side I get an ip address of 10.25.etc.etc... Are these two formats the same thing just delivered in a different format? For example if I want to run a nmap scan on a entire subnet will it be or Or is that performing the same thing? – SCY Aug 14 '14 at 0:14
  • I just found out that he is masking his IP address someway on the network. That being said I would still think I could find his machine through running nmap scan in some way or fashion – SCY Aug 14 '14 at 1:25

You should be able to read your IP from the output of ifconfig (can require superuser access). This command lists all your current interfaces and their configuration. If you are on a IPv4 network at home you will probably find you have a ip that looks like 192.168.x.x.

Usually you can set the last octet to zero and add the the netmask to adress a whole network. So lets say you have the adress Go a head an tell nmap it should run the scan against This will catch all the hosts. In the segment from up to .255. This assumes a pretty standard networlayout. If your network is more complex you should contatc who ever built it. If you are at work, consider that most networkadmin will not like it if someone scans around their networks without premission.

Btw. take alook at zenmap. It is a gui to nmap. Helps you to get an idea of relationships between nodes on your network.

I hope this was usefull


If you dont have root privileg you try to resolve your ip with the host or dig commande

| improve this answer | |

The direct way to determine an ip From a host name is:

dig hostname.com

Nslookup will also work.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.