Is there a way to find and name all of the hosts registered as .local?

I tried various iterations of nmap but they only give the IP address of all local hosts and doesn't provide the .local names.

My router (ER-X) doesn't seem to provide this viewing function even though it obviously is handling this coordination. Nonetheless, I'd love a client based solution such as provided with IP addresses with nmap.


A "client-based solution", as you mentioned, would be dependent on the service providing the DHCP leases. In the case of it being your router, you'll need to query the device for the systems it has issued DHCP leases for.


If you're looking for basic host enumeration tools (i.e. things you would use on a pentest to do host discovery), you can use the following tools:

  • fping -a -g <ip-range> 2>/dev/null
  • dnsrecon -r <ip-range>1
  • various nmap scans
  • nbtscan <ip-range> (For Windows hosts broadcasting netbios names)

Using a variety of the techniques above, you should be able to get a pretty accurate depiction of the hosts on the LAN.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.