Script lltd-discovery

Script types: prerule
Categories: broadcast, discovery, safe

Script Summary

Uses the Microsoft LLTD protocol to discover hosts on a local network.

For more information on the LLTD protocol please refer to

Script Arguments


string specifying which interface to do lltd discovery on. If not specified, all ethernet interfaces are tried.


timespec specifying how long to listen for replies (default 30s)

max-newtargets, newtargets

See the documentation for the target library.

Example Usage

nmap -e <interface> --script lltd-discovery

Script Output

| lltd-discovery:
|     Hostname: acer-PC
|     Mac: 18:f4:6a:4f:de:a2 (Hon Hai Precision Ind. Co.)
|     IPv6: fe80:0000:0000:0000:0000:0000:c0a8:0134
|     Hostname: winxp-2b2955502
|     Mac: 08:00:27:79:fd:d2 (Cadmus Computer Systems)
|     Hostname: core
|     Mac: 08:00:27:57:30:7f (Cadmus Computer Systems)
|_  Use the newtargets script-arg to add the results as targets



  • Gorjan Petrovski
  • Hani Benhabiles

License: Same as Nmap--See