How can I find out the hostnames of other computers in the same local network?

Question

In my local wifi, I can find out the IP and MAC of another computer which also runs Lubuntu, and whose hostname is known to me.

$ sudo arp-scan olive
[sudo] password for t: 
Interface: wlx801f02b5c389, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 1 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.1.198   aa:bb:cc:dd:ee:ff   Liteon Technology Corporation

1 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 1 hosts scanned in 1.449 seconds (0.69 hosts/sec). 1 responded

There are other computers in the same local wifi network, which most likely run Windows and whose hostnames I don't know.

Can I find out their hostnames from my computer? arp-scan -l doesn't show that information.

Thanks.

Answer 1

Install nmap for whatever flavour of Linux you are on.

Then perform:

nmap -sP xxx.xxx.xxx.xxx/nn

Where xxx.xxx.xxx.xxx/nn is your IP and subnet mask bits. For example, if you were on 192.168.1.0 network with a subnet mask of 255.255.255.0 you would do:

nmap -sP 192.168.1.0/24

Nmap will ping scan all IPs and try to resolve their hostnames for you.

For example, on my local LAN I see:

nmap -sP 192.168.169.0/24

Starting Nmap 7.60 ( https://nmap.org ) at 2019-02-23 20:23 CST
Nmap scan report for _gateway (192.168.169.1)
Host is up (0.00026s latency).
Nmap scan report for grid (192.168.169.6)
Host is up (0.00026s latency).
Nmap scan report for anode (192.168.169.8)
Host is up (0.000048s latency).
Nmap scan report for 192.168.169.100
Host is up (0.0027s latency).
Nmap scan report for 192.168.169.101
Host is up (0.049s latency).
Nmap scan report for 192.168.169.102
Host is up (0.092s latency).
Nmap scan report for 192.168.169.104
Host is up (0.012s latency).
Nmap scan report for 192.168.169.106
Host is up (0.055s latency).
Nmap scan report for 192.168.169.107
Host is up (0.12s latency).
Nmap scan report for 192.168.169.109
Host is up (0.00095s latency).
Nmap scan report for 192.168.169.250
Host is up (0.0024s latency).
Nmap done: 256 IP addresses (11 hosts up) scanned in 3.79 seconds

The hosts with no names are dhcp and do not get hostnames. The others are in DNS, and so they have hostnames.

Similarly, arp-scan should give you the mac address. Again, install arp-scan for your distribution, then do:

arp-scan 192.168.1.0/24

Assuming again you are on the same LAN as the example above. If you have a non-standard interface, you may specify it with the -I switch:

arp-scan -I enp4s2 192.168.1.0/24

Note that on most distros, you will need to be root for this, so (again, example on my local LAN):

sudo arp-scan 192.168.169.0/24

This discovered all of my nodes:

Interface: enp5s0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.9 with 256 hosts (http://www.nta-monitor.com/tools/arp-scan/)
192.168.169.6   74:d4:35:85:e0:44   GIGA-BYTE TECHNOLOGY CO.,LTD.
192.168.169.1   f4:f2:6d:70:16:c2   (Unknown)
192.168.169.100 6c:70:9f:d0:ff:1a   (Unknown)
192.168.169.101 10:9a:dd:80:f4:93   Apple, Inc.
192.168.169.104 08:02:8e:8e:a0:f6   (Unknown)
192.168.169.111 00:1c:c0:6e:f4:ec   Intel Corporate
192.168.169.106 fc:c2:de:4c:58:48   (Unknown)
192.168.169.102 b4:f6:1c:f2:f9:52   (Unknown)
192.168.169.103 dc:68:eb:5b:aa:c8   (Unknown)
192.168.169.250 00:01:e6:a2:3f:17   Hewlett-Packard Company
192.168.169.107 68:37:e9:d7:39:0b   (Unknown)
192.168.169.105 08:d4:6a:d1:df:5e   (Unknown)

13 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9: 256 hosts scanned in 2.438 seconds (105.00 hosts/sec). 13 responded

Answer 2

Reverse-lookup each live host on your router; you will discover their dhcp-hostnames (usually these are set to their hostnames) - first create live_hosts.txt:

sudo arp-scan 192.168.169.0/24 | grep ^192 | awk ‘{print $1} > live_hosts.txt

then:

for host in $(cat live_hosts.txt) ; do echo $host ; host $host $router_ip ; sleep 0.1 ; done

Note that your router will query its dhcp-leases file, and even nodes that have disconnected will resolve until their leases are purged. But all currently online nodes will be listed unless your routers name service (usually some tiny dnsmasq) is broken.

You may want all the information for posterity, such as hardware addresses and duration of connections; you can script this easily by scanning your network at intervals, appending output to a file.

You can discover more about linux boxes if they have running services (sshd seems popular nowadays), and all variants will usually have some bonjour/zeroconf hooey active (google mDNS), often something like avahi-daemon. (Call it bugaboo, jimjonesdiary, maga, puss-socket, it’s just mDNS. Who are these people that decided on rendezvous, bonjour, avahi. Make it funny at least, please... rarghh.)

While a simple arp MITM with e.g. scapy may be disruptive and rude, you can do what you like on your own network. Using tcpdump to see DNS lookups will tell you both OS and enable you to guess at who is using that machine.