Nmap unable to resolve hostnames

Question

I have tried running several nmap commands and I can't get the results to return host names. My results look like this:

Nmap scan report for 10.2.16.253
Host is up (0.0025s latency).
All 1000 scanned ports on 10.2.16.253 are in ignored states.
Not shown: 1000 filtered tcp ports (no-response)
MAC Address: D8:D0:90:2F:6C:34 (Dell)

Nmap commands I've tried:

sudo nmap 10.2.16.0/24 -Pn
sudo nmap 10.2.16.0/24 -sn
sudo nmap 10.2.16.0/24 -R
sudo nmap 10.2.16.0/24 -A
sudo nmap 10.2.16.0/24 --system-dns  
sudo nmap 10.2.16.73 --dns-servers 10.30.1.4

I looked at my resolv.conf file and didn't see anything wrong:

    ┌──(kali㉿kali)-[~]
└─$ cat /etc/resolv.conf                  
# Generated by NetworkManager
search company.com
nameserver 10.2.0.4
nameserver 10.30.1.15
nameserver 10.30.1.60
# NOTE: the libc resolver may not support more than 3 nameservers.
# The nameservers listed below may not be recognized.
nameserver 10.30.1.4

Is it just possible that the way our network is set up that we can't resolve host names? If so that is OK I just need a way to explain it to my boss instead of just saying "it won't work".

Appreciate the help.

What does `host 10.2.16.253` or `host 10.2.16.253 10.2.0.4` or some other DNS tool show? — thrig, Aug 16 '22 at 22:59
host 10.2.0.4 shows Using domain server: Name: 10.2.0.4 Address: 10.2.0.4#53 Alias: — UbuntuNoob, Aug 16 '22 at 23:25
Do you really have 3 DNS servers in same network? 10.30.1.15,60,4 — Romeo Ninov, Aug 17 '22 at 05:28

score 1 · Accepted Answer · answered Aug 17 '22 at 06:46

nmap uses reverse DNS records to resolve IP addresses into hostnames. If your DNS servers don't have reverse DNS records set up, nmap cannot show the host names.

An alternative way to find host names is to use mDNS for host name resolution. https://nmap.org/nsedoc/scripts/dns-service-discovery.html is an NMAP script that sends mDNS query to the host and shows the information.

Drawback is that all the hosts need to support mDNS for this to work.

Another alternative is to send uPNP query to the host and read the resulting XML file: https://nmap.org/nsedoc/scripts/upnp-info

If the computers are part of a managed domain (Active Directory or so), the hostnames can be seen from the management facilities.

Nmap unable to resolve hostnames

1 Answers1