How to do it...

Open your terminal and enter the following command:

# nmap -sS -PS -F -R XX.XXX.XXX.220-230

This command will force DNS resolution for offline hosts in the range XX.XXX.XXX.220-230.

Consider using a list scan, which will also perform DNS resolution, respectively –sL.

Yes, a list scan will do that. What I'm trying to convey here is that you can include DNS information of hosts that are down during a port scan or when running an NSE script.

How it works...

The arguments -sS -PS -F -R tell Nmap to perform a TCP SYN Stealth (-sS), SYN ping (-PS), fast port scan (-F), and always perform DNS resolution (-R).

Let's say we want to scan the two IPs surrounding the domain 0xdeadbeefcafe.com with IP XX.XXX.XXX.223, the following command can be used:

# nmap -sS -PS -F -R XX.XXX.XXX.222-224
Nmap scan report for liXX-XXX.members.linode.com (XX.XXX.XXX.222) 
Host is up (0.11s latency). 
All 100 scanned ports on liXX-XXX.members.linode.com (XX.XXX.XXX.222) are filtered 

Nmap scan report for 0xdeadbeefcafe.com (XX.XXX.XXX.223) 
Host is up (0.11s latency). 
Not shown: 96 closed ports 
PORT STATE SERVICE 
22/tcp open ssh 
25/tcp open smtp 

Nmap scan report for mail.0xdeadbeefcafe.com (XX.XXX.XXX.224) 
Host is up (0.11s latency). 
Not shown: 96 closed ports 
PORT STATE SERVICE 
25/tcp filtered smtp

In this case, a quick scan has told us that this is probably a VPS hosted by Linode and is the location of their mail server as well.

There's more...

You can also disable DNS resolution completely with the argument -n. This speeds up scans and is very recommended if you don't need to DNS resolve a host.

# nmap -sS -PS -F -n scanme.nmap.org

# nmap -sS -PS -R --dns-servers 8.8.8.8,8.8.4.4 <target>

See also