Skip to content
HackIndex logo

HackIndex

NetBIOS name table enumeration

3 min read May 15, 2026

NetBIOS name table enumeration queries port 137/UDP to retrieve the names a Windows host has registered — its short hostname, domain or workgroup membership, and active service roles. This gives you the hostname for SMB targeting, the domain name for AD enumeration scope, and service role hints from the name suffixes. NetBIOS is legacy but still active on most Windows networks because SMB over TCP/139 depends on it. Always pivot from name table results directly into SMB Null Session Enumeration.

nmap nbstat Script

The fastest single-host query. Requires UDP so root or sudo is needed:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 137 --script nbstat $TARGET_IP -Pn 
| nbstat: NetBIOS name: WS01, NetBIOS user: <unknown>, NetBIOS MAC: 00:11:22:33:44:55
|  Names:
|    WS01<00>             Flags: <unique><active>
|    WS01<20>             Flags: <unique><active>
|    COMPANY<00>          Flags: <group><active>
|    COMPANY<1c>          Flags: <group><active>
|_   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>

Reading the output: WS01 is the hostname. COMPANY<00> as a group entry is the domain or workgroup name. WS01<20> confirms the File and Printer Sharing service is running — a direct pivot signal into SMB share enumeration. The MAC address identifies the network interface vendor.

nmblookup by IP

Lightweight alternative when nmap is not preferred. The -A flag performs lookup by IP address:

┌──(kali㉿kali)-[~]
└─$ nmblookup -A $TARGET_IP 
Looking up status of 10.10.10.50
	WS01            <00> -         B <ACTIVE>
	COMPANY         <00> - <GROUP> B <ACTIVE>
	WS01            <20> -         B <ACTIVE>
	COMPANY         <1e> - <GROUP> B <ACTIVE>
	MAC Address = 00-11-22-33-44-55

Subnet Sweep with nbtscan

Sweep an entire subnet to identify all Windows hosts and their domain membership in one pass:

┌──(kali㉿kali)-[~]
└─$ nbtscan 10.10.10.0/24 
Doing NBT name scan for addresses from 10.10.10.0/24

IP address       NetBIOS Name     Server    User             MAC address
10.10.10.10      DC01             <server>  <unknown>        00:50:56:01:23:45
10.10.10.50      WS01             <server>  JSMITH           00:11:22:33:44:55
10.10.10.51      WS02             <server>  <unknown>        00:11:22:33:44:66
┌──(kali㉿kali)-[~]
└─$ nbtscan -r 10.10.10.0/24

The User field shows who is logged into the machine when a session is active — immediately useful for targeting. <server> in the Server column means the File and Printer Sharing service is running, same as the <20> suffix.

Name Suffix Reference

The suffix byte after the hostname encodes the service or role registered under that name:

Suffix

Type

Meaning

<00> unique

Host

Workstation service — basic host registration

<20> unique

Host

File and Printer Sharing active — pivot to SMB

<03> unique

Host

Messenger service — username of logged-in user

<00> group

Domain

Domain or workgroup name

<1c> group

Domain

Domain controllers — host is DC or DC is reachable

<1b> unique

Domain

Domain Master Browser — this host maintains the browse list

<1e> group

Domain

Browser Service Elections — browsing is active on segment

Failure Modes

NetBIOS operates over UDP 137 which is commonly filtered. When queries return nothing:

┌──(kali㉿kali)-[~]
└─$ sudo nmap -sU -p 137 $TARGET_IP -Pn --open 
137/udp open|filtered netbios-ns

open|filtered on UDP 137 means the port is likely filtered. Pivot to SMB over TCP 445 directly — it does not require NetBIOS and gives equivalent or better information through SMB Null Session Enumeration. Also check NetBIOS session enumeration on port 139.

The hostname and domain from the name table allow you to immediately scope SAMR/LSA Enumeration with rpcclient for user and group data, and MSRPC Endpoint Enumeration for bound RPC interfaces.

References