nbtscan: Scans for NetBIOS name information

nbtscan is a lightweight command-line tool used to scan networks for NetBIOS name information. Written originally by Alla Bezroutchko, it sends NetBIOS status query requests (UDP/137) to every host in a specified IP range and parses the responses into a clean, easy-to-read table, similar in spirit to what nbtstat -A does for a single Windows host, but scaled across an entire subnet at once.

Because NetBIOS is a legacy Windows naming/service-discovery protocol still enabled by default on countless internal networks (for backward compatibility), nbtscan remains a very fast, low-noise first step for identifying Windows hosts, their computer names, domain/workgroup membership, and — critically — the currently logged-on username on each machine (visible via the <03> messenger service name), as well as whether a host is a Domain Controller (<1C>) or holds specific service roles.

nbtscan is extremely fast (it’s a simple UDP broadcast/unicast sweep) and produces minimal network noise compared to full TCP-based enumeration tools, making it an excellent first-pass reconnaissance tool before diving into heavier SMB/RPC enumeration.

Installation

# Kali Linux (preinstalled)
sudo apt update
sudo apt install nbtscan -y

# Verify
nbtscan -V
which nbtscan

Syntax

nbtscan [options] <ip address / range / CIDR / file>

Command-Line Options

Basic Usage

nbtscan 192.168.56.0/24

Expected output:

Doing NBT name scan for addresses from 192.168.56.0/24

IP address       NetBIOS Name     Server    User             MAC address      
------------------------------------------------------------------------------
192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00
192.168.56.105   DESKTOP-WIN10    <server>  jdoe             08:00:27:aa:bb:cc

Practical Examples

Example 1 — Basic subnet scan

nbtscan 192.168.56.0/24

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00

Example 2 — Single host scan

nbtscan 192.168.56.101

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00

Example 3 — Verbose mode showing all NetBIOS name records

nbtscan -v 192.168.56.101

NetBIOS Name Table for Host 192.168.56.101:

Incomplete packet, waiting for more data
Name             Service          Type
------------------------------------------------
METASPLOITABLE   <00>             UNIQUE     Workstation Service
METASPLOITABLE   <03>             UNIQUE     Messenger Service
METASPLOITABLE   <20>             UNIQUE     File Server Service
WORKGROUP        <00>             GROUP      Domain Name
WORKGROUP        <1E>             GROUP      Browser Election
WORKGROUP        <1D>             UNIQUE     Master Browser

Adapter address: 00:00:00:00:00:00

Example 4 — Dump format (one line per name record, script-friendly)

nbtscan -d 192.168.56.101

192.168.56.101:METASPLOITABLE:00:U:Workstation Service
192.168.56.101:METASPLOITABLE:03:U:Messenger Service
192.168.56.101:METASPLOITABLE:20:U:File Server Service
192.168.56.101:WORKGROUP:00:G:Domain Name
192.168.56.101:WORKGROUP:1D:U:Master Browser

Example 5 — Output in /etc/hosts format

nbtscan -e 192.168.56.0/24

192.168.56.101	METASPLOITABLE
192.168.56.105	DESKTOP-WIN10

Example 6 — Custom timeout for slow/high-latency networks

nbtscan -t 3000 192.168.56.0/24

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00

Example 7 — Reading targets from a file

cat targets.txt
# 192.168.56.101
# 192.168.56.105
# 192.168.56.110

nbtscan -f targets.txt

IP address       NetBIOS Name     Server    User             MAC address
------------------------------------------------------------------------------
192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00
192.168.56.105   DESKTOP-WIN10    <server>  jdoe             08:00:27:aa:bb:cc

Example 8 — Quiet mode for clean scripted output

nbtscan -q 192.168.56.0/24

192.168.56.101   METASPLOITABLE   <server>  METASPLOITABLE   00:00:00:00:00:00

Example 9 — Script-separated output for parsing

nbtscan -s , 192.168.56.0/24

192.168.56.101,METASPLOITABLE,<server>,METASPLOITABLE,00:00:00:00:00:00

Example 10 — Scanning a large /16 with bandwidth throttling

nbtscan -b 500000 172.16.0.0/16

Doing NBT name scan for addresses from 172.16.0.0/16
[throttled scan output streaming over several minutes]
172.16.4.22      FILESERVER01     <server>  svc_backup       00:1a:2b:3c:4d:5e

Common Use Cases

• Very fast first-pass identification of live Windows/Samba hosts on an internal subnet before deeper enumeration
• Discovering which user is currently logged into each workstation (useful for targeted phishing/social engineering scoping during authorized red team engagements, or for identifying admin sessions during internal pentests)
• Mapping computer names to IP addresses for asset inventory during an assessment
• Identifying Domain Controllers via the <1C> Domain Controllers group name in verbose mode
• Quick sanity check of DHCP/NetBIOS scope before launching heavier tools like enum4linux-ng against each host

Automation with Bash

#!/bin/bash
# nbtscan_to_targets.sh - Scan a subnet and produce a clean IP list of Windows/Samba hosts for further enumeration
SUBNET="192.168.56.0/24"
OUT="nbt_live_hosts.txt"

nbtscan -q "$SUBNET" | awk '{print $1}' | sort -u > "$OUT"
echo "[+] Discovered $(wc -l < "$OUT") NetBIOS-responsive hosts, saved to $OUT"

echo "[*] Feeding hosts into enum4linux-ng..."
while read -r ip; do
    enum4linux-ng -A "$ip" > "enum_${ip}.txt" 2>&1
done < "$OUT"

Tips and Best Practices

• Run nbtscan before any heavier SMB tooling — it is fast, low-bandwidth, and immediately tells you which hosts are worth further investigation.
• Use -v when you specifically need to confirm whether a host is a Domain Controller (look for the <1C> name).
• The “User” column is extremely valuable during internal engagements for identifying interactively logged-on accounts, especially privileged ones.
• Increase -t (timeout) on high-latency or VPN-tunneled networks to reduce false negatives from dropped UDP responses.
• Since nbtscan relies on UDP/137, it will silently miss any host with NetBIOS disabled (increasingly common on modern, hardened Windows) — don’t treat empty results as “host is down.”

Troubleshooting

References

• Kali Linux tool page: https://www.kali.org/tools/nbtscan/
• Source code (SourceForge legacy mirror): https://sourceforge.net/projects/nbtscan/
• Microsoft NetBIOS over TCP/IP documentation: https://learn.microsoft.com/en-us/windows/win32/nettcpip/netbios-over-tcp-ip