I am trying to scan my local network and return a list of all connected devices with there IP, MAC Address & device name.

By device name, I mean my iPhone should say 'Jamies-iPhone' as it would when I check my routers admin application for connected devices.

At the moment I have got as far as getting the IP and MAC using:

sudo nmap -sP > file1.txt

It gives me the below output into the file 'file1.txt'

Starting Nmap 6.47 ( http://nmap.org ) at 2016-09-01 18:37 UTC
Nmap scan report for
Host is up (0.00027s latency).
MAC Address: 8C:34:FD:E2:E6:48 (Unknown)
Nmap scan report for
Host is up (0.0038s latency).
MAC Address: 70:56:82:C6:BE:EE (Apple)
Nmap scan report for
Host is up (0.18s latency).
Nmap done: 256 IP addresses (2 hosts up) scanned in 6.42 seconds

I can not find any information about how to get the device name to show up, it just says 'Apple'. I specifically want to see the name of my apple TV's as I have a few and would like to be able to differentiate between them.

  • 1
    This is more of a dns setting, rather than nmap. nmap does what it is supposed to. So if for example you'd map these IP addresses to hostnames in e.g /etc/hosts nmap would show those friendly names followed by the IP addresses. – Valentin Bajrami Sep 2 '16 at 8:30
  • sudo nmap -sn IP_BASE/24 shows manufacturer name – Phineas Dec 30 '20 at 20:05

While nmap can be used to discover networked devices, the current output you have given only shows the MAC address. nmap has a table of MAC prefixes with their vendor and that is the reason why Apple shows up. You need to perform fingerprint tests (-sV) to see more details, if any or use other tools like mdns-scan or mzclient to detect the Apple TVs.

  • 2
    or avahi-browse -a if you have that command. – meuh Sep 2 '16 at 15:13

You need to use smb-os-discovery script:

Attempts to determine the operating system, computer name, domain, workgroup, and current time over the SMB protocol (ports 445 or 139). This is done by starting a session with the anonymous account (or with a proper user account, if one is given; it likely doesn't make a difference); in response to a session starting, the server will send back all this information.

The following fields may be included in the output, depending on the circumstances (e.g. the workgroup name is mutually exclusive with domain and forest names) and the information available:

  • OS
    • Computer name
    • Domain name
    • Forest name
    • FQDN
    • NetBIOS computer name
    • NetBIOS domain name
    • Workgroup
    • System time

Example Usage

wget http://nmap.org/svn/scripts/smb-os-discovery.nse

nmap --script smb-os-discovery.nse -p445
sudo nmap -sU -sS --script smb-os-discovery.nse -p U:137,T:139

Alternative methode: Using the Address Resolution Protocol arp

The command arp -a will display all hostnames in your LAN Network

  • Hi, unfortunately this seems to only return the information I need for the script host, not the other devices connected to the LAN. I ran sudo nmap -sU -sS --script smb-os-discovery.nse -p U:137,T:139 192.168.1.* which returned computer name for the linux machine I ran it from but not for the other results – Jamie Deakin Sep 2 '16 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.