# NetBIOS name table enumeration

- **URL:** https://hackindex.io/services/netbios/enumeration/netbios-name-table-enumeration
- **Path:** NetBIOS > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/netbios/enumeration.md)
- **Published:** 2026-01-26
- **Updated:** 2026-05-15

## NetBIOS Name Table

NetBIOS name table enumeration queries port 137/UDP to retrieve the names a Windows host has registered: its short hostname, domain or workgroup membership, and active service roles. This gives you the hostname for SMB targeting, the domain name for AD enumeration scope, and service role hints from the name suffixes. NetBIOS is legacy but still active on most Windows networks because SMB over TCP/139 depends on it. Always pivot from name table results directly into [SMB Null Session Enumeration](https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration).

- nmap nbstat Script
- nmblookup by IP
- Subnet Sweep with nbtscan
- Name Suffix Reference
- Failure Modes

## nmap nbstat Script

The fastest single-host query. Requires UDP so root or sudo is needed:

```bash
sudo nmap -sU -p 137 --script nbstat $TARGET_IP -Pn
# | nbstat: NetBIOS name: WS01, NetBIOS user: <unknown>, NetBIOS MAC: 00:11:22:33:44:55
# |  Names:
# |    WS01<00>             Flags: <unique><active>
# |    WS01<20>             Flags: <unique><active>
# |    COMPANY<00>          Flags: <group><active>
# |    COMPANY<1c>          Flags: <group><active>
# |_   \x01\x02__MSBROWSE__\x02<01>  Flags: <group><active>
```

Reading the output: `WS01` is the hostname. `COMPANY<00>` as a group entry is the domain or workgroup name. `WS01<20>` confirms the File and Printer Sharing service is running: a direct pivot signal into SMB share enumeration. The MAC address identifies the network interface vendor.

## nmblookup by IP

Lightweight alternative when nmap is not preferred. The `-A` flag performs lookup by IP address:

```bash
nmblookup -A $TARGET_IP
# Looking up status of 10.10.10.50
# 	WS01            <00> -         B <ACTIVE>
# 	COMPANY         <00> - <GROUP> B <ACTIVE>
# 	WS01            <20> -         B <ACTIVE>
# 	COMPANY         <1e> - <GROUP> B <ACTIVE>
# 	MAC Address = 00-11-22-33-44-55
```

## Subnet Sweep with nbtscan

Sweep an entire subnet to identify all Windows hosts and their domain membership in one pass:

```bash
nbtscan $TARGET_SUBNET/24
# Doing NBT name scan for addresses from 10.10.10.0/24
#
# IP address       NetBIOS Name     Server    User             MAC address
# 10.10.10.10      DC01             <server>  <unknown>        00:50:56:01:23:45
# 10.10.10.50      WS01             <server>  JSMITH           00:11:22:33:44:55
# 10.10.10.51      WS02             <server>  <unknown>        00:11:22:33:44:66
```

```bash
nbtscan -r $TARGET_SUBNET/24
```

The User field shows who is logged into the machine when a session is active: immediately useful for targeting. `<server>` in the Server column means the File and Printer Sharing service is running, same as the `<20>` suffix.

## Name Suffix Reference

The suffix byte after the hostname encodes the service or role registered under that name:

| Suffix | Type | Meaning |
| --- | --- | --- |
| <00> unique | Host | Workstation service: basic host registration |
| <20> unique | Host | File and Printer Sharing active: pivot to SMB |
| <03> unique | Host | Messenger service: username of logged-in user |
| <00> group | Domain | Domain or workgroup name |
| <1c> group | Domain | Domain controllers: host is DC or DC is reachable |
| <1b> unique | Domain | Domain Master Browser: this host maintains the browse list |
| <1e> group | Domain | Browser Service Elections: browsing is active on segment |

## Failure Modes

NetBIOS operates over UDP 137 which is commonly filtered. When queries return nothing:

```bash
sudo nmap -sU -p 137 $TARGET_IP -Pn --open
# 137/udp open|filtered netbios-ns
```

`open|filtered` on UDP 137 means the port is likely filtered. Pivot to SMB over TCP 445 directly: it does not require NetBIOS and gives equivalent or better information through [SMB Null Session Enumeration](https://hackindex.io/services/smb/enumeration/smb-null-session-enumeration). Also check [NetBIOS session enumeration](https://hackindex.io/services/netbios/enumeration/netbios-session-enumeration) on port 139.

The hostname and domain from the name table allow you to immediately scope [SAMR/LSA Enumeration with rpcclient](https://hackindex.io/services/msrpc/enumeration/samr-lsa-enumeration-with-rpcclient) for user and group data, and [MSRPC Endpoint Enumeration](https://hackindex.io/services/msrpc/enumeration/msrpc-endpoint-enumeration) for bound RPC interfaces.

## References

- [nmap: nbstat NSE](https://nmap.org/nsedoc/scripts/nbstat.html) - NetBIOS name table query and suffix output format
- [nbtscan](https://www.kali.org/tools/nbtscan/) - Subnet NetBIOS scanning with MAC and user output