> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/netwrok-scanning-tools/nbtscan.md). # nbtscan `nbtscan` is a network scanning tool used to query **NetBIOS name service (NBNS)** over IP networks. It is useful for identifying Windows hosts and retrieving NetBIOS computer names, logged-in user name, and other related details. ### Syntax ```bash nbtscan [options] ``` ### Examples #### Basic Usage * **Scan a single IP for NetBIOS names** ```bash nbtscan 192.168.1.1 ``` * **Scan a full subnet (e.g., 192.168.1.0/24)** ```bash nbtscan 192.168.1.0/24 ``` * **Scan a custom IP range** ```bash nbtscan 192.168.1.25-192.168.1.137 ``` #### Output Formatting * **Verbose output (displays all NetBIOS names received)** ```bash nbtscan -v 192.168.1.0/24 ``` * **Output in `/etc/hosts` format** ```bash nbtscan -e 192.168.1.0/24 ``` * **Output in `lmhosts` format (cannot be used with `-v`)** ```bash nbtscan -l 192.168.1.0/24 ``` * **Script-friendly output using a custom separator (e.g., colon `:`)** ```bash nbtscan -v -s : 192.168.1.0/24 ``` #### Network Performance & Adjustments * **Set a custom timeout (default: 1000ms)** ```bash nbtscan -t 500 192.168.1.0/24 ``` * **Throttle output to a specific bandwidth (e.g., 1000 bps)** ```bash nbtscan -b 1000 192.168.1.0/24 ``` * **Use local port 137 for scanning (useful for Windows 95 hosts, requires root on Linux)** ```bash nbtscan -r 192.168.1.0/24 ``` * **Increase retransmissions for reliability (default: 0)** ```bash nbtscan -m 2 192.168.1.0/24 ``` #### Scanning from a File * **Read IP addresses from a file (`iplist.txt`)** ```bash nbtscan -f iplist.txt ``` * **Read IPs from standard input (`stdin`)** ```bash cat iplist.txt | nbtscan -f - ```