nbtscan is a lightweight command-line tool used to scan networks for NetBIOS name information. Written originally by Alla Bezroutchko, it sends NetBIOS status query requests (UDP/137) to every host in a specified IP range and parses the responses into a clean, easy-to-read table, similar in spirit to what nbtstat -A does for a single Windows host, but scaled across an entire subnet at once.
Because NetBIOS is a legacy Windows naming/service-discovery protocol still enabled by default on countless internal networks (for backward compatibility), nbtscan remains a very fast, low-noise first step for identifying Windows hosts, their computer names, domain/workgroup membership, and — critically — the currently logged-on username on each machine (visible via the <03> messenger service name), as well as whether a host is a Domain Controller (<1C>) or holds specific service roles.
nbtscan is extremely fast (it’s a simple UDP broadcast/unicast sweep) and produces minimal network noise compared to full TCP-based enumeration tools, making it an excellent first-pass reconnaissance tool before diving into heavier SMB/RPC enumeration.
Installation
# Kali Linux (preinstalled)
sudo apt update
sudo apt install nbtscan -y
# Verify
nbtscan -V
which nbtscan
Syntax
nbtscan [options] <ip address / range / CIDR / file>
Command-Line Options
| Option | Description |
|---|---|
-v | Verbose output (show all names, not just the main one) |
-d | Dump packets in human-readable form (very verbose, one line per name) |
-e | Format output in /etc/hosts format |
-l | Format output in lmhosts format |
-t timeout | Wait timeout milliseconds for response (default 1000) |
-b bandwidth | Output throttle: max bandwidth in bits/second |
-r | Use local port 137 for scanning (needed on some systems for correct replies) |
-q | Suppress banners and error messages (quiet) |
-s separator | Script-friendly output with a specified field separator |
-m retransmits | Number of retransmits for lost packets (default 0) |
-f filename | Read target list/ranges from a file |
-h | Display help |
Basic Usage
nbtscan 192.168.56.0/24
Expected output:
Doing NBT name scan for addresses from 192.168.56.0/24
IP address NetBIOS Name Server User MAC address
------------------------------------------------------------------------------
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
192.168.56.105 DESKTOP-WIN10 <server> jdoe 08:00:27:aa:bb:cc
Practical Examples
Example 1 — Basic subnet scan
nbtscan 192.168.56.0/24
IP address NetBIOS Name Server User MAC address
------------------------------------------------------------------------------
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
Example 2 — Single host scan
nbtscan 192.168.56.101
IP address NetBIOS Name Server User MAC address
------------------------------------------------------------------------------
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
Example 3 — Verbose mode showing all NetBIOS name records
nbtscan -v 192.168.56.101
NetBIOS Name Table for Host 192.168.56.101:
Incomplete packet, waiting for more data
Name Service Type
------------------------------------------------
METASPLOITABLE <00> UNIQUE Workstation Service
METASPLOITABLE <03> UNIQUE Messenger Service
METASPLOITABLE <20> UNIQUE File Server Service
WORKGROUP <00> GROUP Domain Name
WORKGROUP <1E> GROUP Browser Election
WORKGROUP <1D> UNIQUE Master Browser
Adapter address: 00:00:00:00:00:00
Example 4 — Dump format (one line per name record, script-friendly)
nbtscan -d 192.168.56.101
192.168.56.101:METASPLOITABLE:00:U:Workstation Service
192.168.56.101:METASPLOITABLE:03:U:Messenger Service
192.168.56.101:METASPLOITABLE:20:U:File Server Service
192.168.56.101:WORKGROUP:00:G:Domain Name
192.168.56.101:WORKGROUP:1D:U:Master Browser
Example 5 — Output in /etc/hosts format
nbtscan -e 192.168.56.0/24
192.168.56.101 METASPLOITABLE
192.168.56.105 DESKTOP-WIN10
Example 6 — Custom timeout for slow/high-latency networks
nbtscan -t 3000 192.168.56.0/24
IP address NetBIOS Name Server User MAC address
------------------------------------------------------------------------------
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
Example 7 — Reading targets from a file
cat targets.txt
# 192.168.56.101
# 192.168.56.105
# 192.168.56.110
nbtscan -f targets.txt
IP address NetBIOS Name Server User MAC address
------------------------------------------------------------------------------
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
192.168.56.105 DESKTOP-WIN10 <server> jdoe 08:00:27:aa:bb:cc
Example 8 — Quiet mode for clean scripted output
nbtscan -q 192.168.56.0/24
192.168.56.101 METASPLOITABLE <server> METASPLOITABLE 00:00:00:00:00:00
Example 9 — Script-separated output for parsing
nbtscan -s , 192.168.56.0/24
192.168.56.101,METASPLOITABLE,<server>,METASPLOITABLE,00:00:00:00:00:00
Example 10 — Scanning a large /16 with bandwidth throttling
nbtscan -b 500000 172.16.0.0/16
Doing NBT name scan for addresses from 172.16.0.0/16
[throttled scan output streaming over several minutes]
172.16.4.22 FILESERVER01 <server> svc_backup 00:1a:2b:3c:4d:5eCommon Use Cases
- Very fast first-pass identification of live Windows/Samba hosts on an internal subnet before deeper enumeration
- Discovering which user is currently logged into each workstation (useful for targeted phishing/social engineering scoping during authorized red team engagements, or for identifying admin sessions during internal pentests)
- Mapping computer names to IP addresses for asset inventory during an assessment
- Identifying Domain Controllers via the
<1C>Domain Controllers group name in verbose mode - Quick sanity check of DHCP/NetBIOS scope before launching heavier tools like
enum4linux-ngagainst each host
Automation with Bash
#!/bin/bash
# nbtscan_to_targets.sh - Scan a subnet and produce a clean IP list of Windows/Samba hosts for further enumeration
SUBNET="192.168.56.0/24"
OUT="nbt_live_hosts.txt"
nbtscan -q "$SUBNET" | awk '{print $1}' | sort -u > "$OUT"
echo "[+] Discovered $(wc -l < "$OUT") NetBIOS-responsive hosts, saved to $OUT"
echo "[*] Feeding hosts into enum4linux-ng..."
while read -r ip; do
enum4linux-ng -A "$ip" > "enum_${ip}.txt" 2>&1
done < "$OUT"
Tips and Best Practices
- Run
nbtscanbefore any heavier SMB tooling — it is fast, low-bandwidth, and immediately tells you which hosts are worth further investigation. - Use
-vwhen you specifically need to confirm whether a host is a Domain Controller (look for the<1C>name). - The “User” column is extremely valuable during internal engagements for identifying interactively logged-on accounts, especially privileged ones.
- Increase
-t(timeout) on high-latency or VPN-tunneled networks to reduce false negatives from dropped UDP responses. - Since
nbtscanrelies on UDP/137, it will silently miss any host with NetBIOS disabled (increasingly common on modern, hardened Windows) — don’t treat empty results as “host is down.”
Troubleshooting
| Problem | Likely Cause | Solution |
|---|---|---|
| No results at all across the whole subnet | Local firewall blocking UDP/137 replies | Run nbtscan -r to force use of local port 137, or check iptables/ufw rules |
| Some hosts missing from results | NetBIOS over TCP/IP disabled on modern Windows | Expected behavior; fall back to nmap -sU -p137 or SMB-based enumeration |
sendto: Permission denied | Insufficient privileges to bind to raw/privileged UDP port | Run with sudo nbtscan ... |
| Scan extremely slow on large ranges | Default timeout too conservative for a big sweep | Lower -t cautiously or split the range into smaller chunks |
| Garbled/duplicate names in output | Packet loss without retransmission | Add -m 2 to retransmit lost query packets |
References
- Kali Linux tool page: https://www.kali.org/tools/nbtscan/
- Source code (SourceForge legacy mirror): https://sourceforge.net/projects/nbtscan/
- Microsoft NetBIOS over TCP/IP documentation: https://learn.microsoft.com/en-us/windows/win32/nettcpip/netbios-over-tcp-ip