0

I want to get a list of the "friendly" device names on my network.

Everything I'm reading says, I should absolutely be able to do this via nmap. However, it doesn't work for me:

Starting Nmap 7.80 ( https://nmap.org ) at 2020-08-01 15:14 PDT
Nmap scan report for 192.168.11.2
Host is up (0.0057s latency).
Not shown: 993 closed ports
PORT      STATE SERVICE
5000/tcp  open  upnp
7000/tcp  open  afs3-fileserver
7100/tcp  open  font-service
49152/tcp open  unknown
49153/tcp open  unknown
49154/tcp open  unknown
62078/tcp open  iphone-sync

If this was working properly, it would say something like "Nmap scan report for Levi's iPhone". But, as you can see, it just states the IP address. My first thought is that this must be some kind of permissions thing or a configuration issue with the device in question. However, when I run a simple network scanning app an another mobile device, it clearly lists the IP, MAC address, and name of all the devices on the same network. So, clearly this data is available.

What am I missing? How is the app able to find this information but the terminal commands not?

Levi Hackwith
  • 1,013

2 Answers2

2

The most basic method, "reverse DNS", asks your router for the name it has received in the device's DHCP lease request. But not all devices actually send a hostname in there, and of course devices configured with a static IP address do not send any DHCP lease request in the first place.

Though, nmap is very much overkill for this. Reverse DNS can be queried with much simpler tools, such as 'host'. And indeed when you're running 'arp' it doesn't do anything else than attempt to show reversw-DNS for the addresses it lists. Being able to list the names via 'arp' is a side effect – there is actually no concept of names within the ARP protocol itself.

A related method is querying the device via mDNS (multicast DNS). On some operating systems this is included as part of "nmap -R" and always results in a *.local name. But actually very few devices answer to mDNS at all – mainly macOS systems, some NAS hardware, etc. Linux computers can have mDNS installed but more often don't.

Where Nmap becomes more useful is through its "script" method, which queries the device though all sorts of protocols (NBT, HTTP, etc.) – but there is no guarantee that the target device will support any of those protocols.

But in your case, it doesn't seem like you've actually enabled the script mode, so you're not getting any results from it. If you ran it with the -A option, it would probably report similar results as your mobile app does.

Overall, though, it is not a requirement for a device to actually have a hostname or be willing to reveal it. It's all opt-in.

grawity
  • 501,077
1

Your link says that the name is found via reverse DNS lookup. And it's pretty irrelevant if you use nmap (which is made for portscanning) or some other tool to do the reverse DNS lookup.

Also, if you don't have a DNS server in your network that supports reverse lookup, and has the device names configured, then you won't get an answer.

Some devices broadcast their name via mDNS, and you can look for this information.

Or in different words: There's no guarantee that your network is setup in such a way that you easily can get a list of "friendly" device names on your network.

You need components on your network that make this possible. If you don't have those components, then you won't get this information (or only partially).

dirkt
  • 17,461