# NetBIOS Name Enumeration

> Enumerate NetBIOS names, workgroup/domain info, and MAC addresses from SMB hosts using nbtscan, nmap, and nmblookup to map network targets.

- **URL:** https://hackindex.io/services/smb/enumeration/netbios-name-enumeration
- **Path:** SMB > Enumeration
- **Up:** [Enumeration](https://hackindex.io/services/smb/enumeration.md)
- **Published:** 2026-01-04
- **Updated:** 2026-08-11

NetBIOS over 137/UDP leaks hostnames, workgroups, and MACs on legacy networks.

## nbtscan Discovery

Single host:

```bash
nbtscan $TARGET_IP
```

Range sweep:

```bash
nbtscan $TARGET_SUBNET/24
```

Shows NetBIOS names and types.

## nmblookup Query

Name resolution:

```bash
nmblookup -A $TARGET_IP
```

Dumps full table including workgroup.

## Common NetBIOS Name Types

The suffix byte in each record identifies the service behind the name:

- `<00>` Workstation Service (hostname)
- `<03>` Messenger Service (logged-in user)
- `<20>` Server Service (file sharing active)
- `<1D>` Master Browser
- `<1B>` Domain Master Browser (PDC)