nmblookup

Find hosts in the local network with SMB shares

$ nmblookup [[-S|--status]] '*'

$ nmblookup [[-S|--status]] __SAMBA__

nmblookup [options] NetBIOS name
nmblookup -A | --address IP address [options]

NetBIOS name
    The NetBIOS name to look up. Can be a hostname, service name, or workgroup name.

-A, --address IP address
    Performs a reverse lookup, resolving an IP address to its corresponding NetBIOS name.

-S, --status
    Queries the NetBIOS status of a host, returning a list of all registered NetBIOS names for that machine.

-R, --recursion
    Sets the recursion desired bit in the NetBIOS query. Used when querying WINS servers to request recursive resolution.

-U unicast address, --unicast unicast address
    Sends queries to a specific unicast address (e.g., a WINS server IP address) instead of broadcasting on the local subnet.

-B broadcast address, --broadcast broadcast address
    Uses a specific broadcast address for name queries, overriding the default subnet broadcast address.

-M name, --master-browser name
    Looks up the master browser for a specific workgroup or domain. The name is typically the workgroup/domain name.

-d debug level, --debuglevel debug level
    Sets the debug (logging) level. A higher number provides more verbose output.

-s smb config file, --configfile smb config file
    Specifies an alternative Samba configuration file to use instead of the default.

nmblookup is a client that queries NetBIOS names from hosts using NetBIOS over TCP/IP (NBT). It can perform various types of lookups, including broadcast queries for local subnet names, unicast queries to specific WINS servers, and reverse lookups from IP addresses to NetBIOS names.

It's an essential tool for troubleshooting Samba and Windows networking environments where NetBIOS name resolution is in use. It helps identify registered NetBIOS names and their corresponding IP addresses, or find a domain's master browser.

nmblookup relies on NetBIOS over TCP/IP (NBT), which is less prevalent in modern, pure DNS-centric networks. Its functionality depends on proper NetBIOS name resolution services (like WINS or local broadcasts) being active and accessible.

Firewall rules often block NetBIOS ports (UDP 137, 138, TCP 139, 445), which can hinder its operation.

NetBIOS names are 16-character names. The 16th character (known as the NetBIOS suffix or resource byte) denotes the type of service or resource registered by that name (e.g., `<00>` for Workstation Service, `<20>` for File Server Service, `<1B>` for Domain Master Browser). The -S (status) option often reveals these suffixes.

nmblookup primarily uses UDP ports 137 (NetBIOS Name Service) and 138 (NetBIOS Datagram Service) for broadcast queries and unicast queries to WINS servers. Ensure these ports are not blocked by firewalls if encountering issues.

nmblookup is a component of the Samba suite, an open-source project that re-implements the SMB/CIFS networking protocol. Samba's development began in the early 1990s to enable Linux/Unix systems to seamlessly interact with Microsoft Windows networks.

The command provides the NetBIOS name resolution client functionality, which was crucial for Windows network discovery and resource access in the era before DNS became the primary resolution method for all network services. While its direct usage has diminished in some modern environments, it remains a valuable tool for legacy systems and for troubleshooting NetBIOS-dependent network issues.

smbclient(1), smbget(1), net(8), samba(7), host(1)