Is there a way to scan for computers on the network through the command line and get their IP, MAC and DNS names without knowing anything about them?

3 Answers 3

nmap -v -sn | grep -v down

ps. of course you can change subnet settings as you need.
pps. depending on nmap version mac address is displayed or not. 5.21+ (debian testing+) displays. 5.0 (currently in debian stable) not.

  • On Debian Squeeze I had to replace -sn with -sP. (Nmap version 5.00)
    – rahmu
    Jan 15, 2013 at 16:39

arp -a will dump all that information without needing to install nmap. However, nmap does an active scan, so it will be more up to date.


If you really don't have a clue at all, you should first passively listen to the network. Local networks are quite chatty and mostly a packet is sent to all network devices. By decomposing the layers of the packets, you can learn a lot about the topology. Beware, sometimes this is not possible at all, it depends on the network.

For example:

Ethernet frames give you ethernet addresses.

ARP (Address resolution protocol) couples ethernet address to the network address and gives implicit hints about the relations between the network devices.

IP (Internet protocol) gives you a relation between two hosts with ip-addresses.

TCP (Transmission control protocol) gives you an idea about which services (ports) are active and which computers chat with each other.

UDP (User datagram protocol) gives the same information as TCP. You can actually learn more than just do a active scan.

You can use tcpdump or use the pcap library if you want to find specific information. I made a small example in perl. It dumps all hardware addresses, network addresses, tcp and udp ports.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .