Finding named hosts on a network

If you have just gained access to a network, one of the first things you can do is to get an idea of what hosts are on the network. You can scan all IP addresses on a subnet and then do a DNS lookup to see if you can find any named hosts. Hostnames can have descriptive or informative names that give clues as to what a server may be running.

The pure Go resolver is default and can only block a goroutine instead of a system thread, making it a little more efficient. You can explicitly set the DNS resolver with an environment variable:

export GODEBUG=netdns=go    # Use pure Go resolver (default)
export GODEBUG=netdns=cgo   # Use cgo resolver

This example looks for every possible host on a subnet and tries to resolve a hostname for each IP:

package main

import (
   "strconv"
   "log"
   "net"
   "strings"
)

var subnetToScan...