{
	"id": "a6871eaf-ce0d-401d-b08a-77b38f544127",
	"created_at": "2026-04-06T00:07:09.769105Z",
	"updated_at": "2026-04-10T13:12:43.967572Z",
	"deleted_at": null,
	"sha1_hash": "d9f54400209dd3f51a9a583657527e6edb089286",
	"title": "Nbtstat",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 55027,
	"plain_text": "Nbtstat\r\nBy Archiveddocs\r\nArchived: 2026-04-05 15:36:06 UTC\r\nNbtstat is designed to help troubleshoot NetBIOS name resolution problems. When a network is functioning\r\nnormally, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses. It does this through several\r\noptions for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, LMHOSTS\r\nlookup, Hosts lookup, and DNS server query.\r\nThe nbtstat command removes and corrects preloaded entries using a number of case-sensitive switches. The\r\nnbtstat - a \u003cname\u003e** command performs a NetBIOS adapter status command on the computer name specified by\r\n\u003c name\u003e . The adapter status command returns the local NetBIOS name table for that computer as well as the\r\nMAC address of the adapter card. The nbtstat -A \u003c IP address \u003e command performs the same function using a\r\ntarget IP address rather than a name.\r\nThe nbtstat - c option shows the contents of the NetBIOS name cache, which contains NetBIOS name-to-IP\r\naddress mappings.\r\nnbtstat -n displays the names that have been registered locally on the system by NetBIOS applications such as the\r\nserver and redirector.\r\nThe nbtstat -r command displays the count of all NetBIOS names resolved by broadcast and by querying a WINS\r\nserver. The nbtstat -R command purges the name cache and reloads all #PRE entries from the LMHOSTS file.\r\n#PRE entries are the LMHOSTS name entries that are preloaded into the cache. For more information about the\r\nLMHOSTS file, see the appendix \"LMHOSTS Files\" in this book.\r\nNbtstat -RR sends name release packets to the WINS server and starts a refresh, thus re-registering all names\r\nwith the name server without having to reboot. This is a new option in Windows NT 4.0 with Service Pack 4 as\r\nwell as in Windows 2000.\r\nYou can use nbtstat -S to list the current NetBIOS sessions and their status, including statistics. Sample output\r\nlooks like this:\r\nC:\\\u003enbtstat -S\r\nLocal Area Connection:\r\nNode IpAddress: [172.16.0.142] Scope Id: []\r\nNetBIOS Connection Table\r\nhttps://technet.microsoft.com/en-us/library/cc940106.aspx\r\nPage 1 of 3\n\nLocal Name State In/Out Remote Host Input Output\r\n------------------------------------------------------------------\r\nTESTPC1 \u003c00\u003e Connected Out 172.16.210.25 6MB 5MB\r\nTESTPC1 \u003c00\u003e Connected Out 172.16.3.1 108KB 116KB\r\nTESTPC1 \u003c00\u003e Connected Out 172.16.3.20 299KB 19KB\r\nTESTPC1 \u003c00\u003e Connected Out 172.16.3.4 324KB 19KB\r\nTESTPC1 \u003c03\u003e Listening\r\nFinally, nbtstat -s provides a similar set of session listings, but provides the remote computer names, rather than\r\ntheir IP addresses.\r\nnote-iconNote\r\nThe options for the Nbtstat command are case sensitive.\r\nThe Nbtstat switches are listed in Table 3.4.\r\nTable 3.4 Nbtstat Switches\r\nSwitch Name Function\r\n-a \u003c name \u003e adapter status\r\nReturns the NetBIOS name table and MAC address of the address card for\r\nthe computer name specified.\r\n-A \u003c IP\r\naddress \u003e\r\nAdapter status Lists the same information as -a when given the target's IP address.\r\n-c cache Lists the contents of the NetBIOS name cache.\r\n[ Number ] Interval\r\nTyping a numerical value tells Nbtstat to redisplay selected statistics each\r\ninterval seconds, pausing between each display. Press Ctrl+C to stop\r\nredisplaying statistics.\r\n-n names\r\nDisplays the names registered locally by NetBIOS applications such as the\r\nserver and redirector.\r\nhttps://technet.microsoft.com/en-us/library/cc940106.aspx\r\nPage 2 of 3\n\nSwitch Name Function\r\n-r resolved Displays a count of all names resolved by broadcast or WINS server.\r\n-R Reload Purges the name cache and reloads all #PRE entries from LMHOSTS.\r\n-RR ReleaseRefresh Releases and reregisters all names with the name server.\r\n-s sessions\r\nLists the NetBIOS sessions table converting destination IP addresses to\r\ncomputer NetBIOS names.\r\n-S Sessions Lists the current NetBIOS sessions and their status, with the IP address.\r\n/? Help Displays this list.\r\nSource: https://technet.microsoft.com/en-us/library/cc940106.aspx\r\nhttps://technet.microsoft.com/en-us/library/cc940106.aspx\r\nPage 3 of 3",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://technet.microsoft.com/en-us/library/cc940106.aspx"
	],
	"report_names": [
		"cc940106.aspx"
	],
	"threat_actors": [],
	"ts_created_at": 1775434029,
	"ts_updated_at": 1775826763,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d9f54400209dd3f51a9a583657527e6edb089286.pdf",
		"text": "https://archive.orkl.eu/d9f54400209dd3f51a9a583657527e6edb089286.txt",
		"img": "https://archive.orkl.eu/d9f54400209dd3f51a9a583657527e6edb089286.jpg"
	}
}