Scan local network for hostnames

arp-scan

sudo arp-scan -l -I wlan0
Interface: wlan0, datalink type: EN10MB (Ethernet)
Starting arp-scan 1.8.1 with 128 hosts (http://www.nta-monitor.com/tools/arp-scan/)
10.0.99.1       c0:cc:60:29:aa:b1       (Unknown)
10.0.99.2       c0:cc:af:2b:aa:b2       (Unknown)
10.0.99.4       c0:cc:af:2b:aa:b3       (Unknown)
10.0.99.3       c0:cc:af:2b:aa:b4       (Unknown)
10.0.99.11      d4:cc:6d:a1:aa:b5       (Unknown)
10.0.99.23      d4:cc:6d:a2:aa:b6       (Unknown)
10.0.99.100     f8:cc:ea:f9:aa:b7       (Unknown)

8 packets received by filter, 0 packets dropped by kernel Ending arp-scan 1.8.1: 128 hosts scanned in 1.315 seconds (97.34 hosts/sec). 7 responded

nbtscan

sudo apt-get install nbtscan        #installation
sudo nbtscan -v 192.168.1.0/24      #verbose scann, difficult to read output
sudo nbtscan 192.168.1.0/24

Doing NBT name scan for addresses from 192.168.1.0/24

IP address       NetBIOS Name     Server    User             MAC address      
------------------------------------------------------------------------------
192.168.1.0	Sendto failed: Permission denied
192.168.1.89    PIOTR-X220       <server>  PIOTR-X220       00:00:00:00:00:00
192.168.1.64    QUASIMODO        <server>  <unknown>        5c:ff:dd:aa:bb:d0
192.168.1.255	Sendto failed: Permission denied

Researching

• Using SMB sniffing to determine target’s host name, domain, OS version, system time and time zone
• Cisco FAQ - blog
• Scanning NetBIOS