Hostname and Operating System - what is the best way to do the scan?

Question

Is it possible to run an Nmap scan that give the output for Operating system and the hostname? If so what are the flags that needs to be used?

Answer 1

You could try

sudo nmap -O 192.168.1.14 | grep Running

This is described in the nmap manual you get with man nmap:

OS DETECTION:
-O: Enable OS detection
    --osscan-limit: Limit OS detection to promising targets
    --osscan-guess: Guess OS more aggressively

But you can't rely on getting a response, so you could get a guess (by fingerprinting), e.g.

Running (JUST GUESSING): Linux 2.6.X|3.X (91%), Crestron 2-Series (85%), Netgear embedded (85%), Western Digital embedded (85%)

or even no answer at all:

No exact OS matches for host

Although nmap also shows the host name, you can directly ask for it using

dig +short -x 192.168.1.14

which will give you only the host name, no need to grep it from the nmap output and much faster.