NBTSTAT

Nbtstat is a program designed to help troubleshoot NetBIOS name resolution problems. It is a command line tool and is included in all windows NT versions. When a network is functioning normally, NetBIOS over TCP/IP (NetBT) resolves NetBIOS names to IP addresses. It does this through several options for NetBIOS name resolution, including local cache lookup, WINS server query, broadcast, LMHOSTS lookup, Hosts lookup, and DNS server query.

The nbtstat command removes and corrects preloaded entries using a number of case-sensitive switches. The nbtstat - a command performs a NetBIOS adapter status command on the computer name specified by < name> . The adapter status command returns the local NetBIOS name table for that computer as well as the MAC address of the adapter card. The nbtstat -A < IP address > command performs the same function using a target IP address rather than a name.

The nbtstat - c option shows the contents of the NetBIOS name cache, which contains NetBIOS name-to-IP address mappings.

nbtstat -n displays the names that have been registered locally on the system by NetBIOS applications such as the server and redirector.

The nbtstat -r command displays the count of all NetBIOS names resolved by broadcast and by querying a WINS server. The nbtstat -R command purges the name cache and reloads all #PRE entries from the LMHOSTS file. #PRE entries are the LMHOSTS name entries that are preloaded into the cache. For more information about the LMHOSTS file, see the appendix "LMHOSTS Files" in this book.

Nbtstat -RR sends name release packets to the WINS server and starts a refresh, thus re-registering all names with the name server without having to reboot. This is a new option in Windows NT 4.0 with Service Pack 4 as well as in Windows 2000.

You can use nbtstat -S to list the current NetBIOS sessions and their status, including statistics. Sample output looks like this:

C:>nbtstat -S

Local Area Connection:

Node IpAddress: [172.16.0.142] Scope Id: []

NetBIOS Connection Table

Local Name State In/Out Remote Host Input Output

----

TESTPC1 <00> Connected Out 172.16.210.25 6MB 5MB

TESTPC1 <00> Connected Out 172.16.3.1 108KB 116KB

TESTPC1 <00> Connected Out 172.16.3.20 299KB 19KB

TESTPC1 <00> Connected Out 172.16.3.4 324KB 19KB

TESTPC1 <03> Listening

Finally, nbtstat -s provides a similar set of session listings, but provides the remote computer names, rather than their IP addresses.

Note

The options for the Nbtstat command are case sensitive.

The Nbtstat switches are listed in Table 3.4.

Table 3.4 Nbtstat Switches

Nbtstat command-line parameters are case-sensitive.•

The following describes the column headings that are generated by nbtstat.

Input The number of bytes received.

Output The number of bytes sent.

In/Out Whether the connection is from the computer (outbound) or from another computer to the local computer (inbound).

Life The remaining time that a name table cache entry will live before it is purged.

Local Name The local NetBIOS name associated with the connection."'Remote Host"' The name or IP address associated with the remote computer.

The last byte of a NetBIOS name converted to hexadecimal. Each NetBIOS name is 16 characters long. This last byte often has special significance because the same name might be present several times on a computer, differing only in the last byte. For example, <20> is a space in ASCII text.

Type The type of name. A name can either be a unique name or a group name.

Status Whether the NetBIOS service on the remote computer is running (Registered) or a duplicate computer name has registered the same service (Conflict).

State The state of NetBIOS connections.

The following describes the possible NetBIOS connection states.

Connected A session has been established.

Associated A connection endpoint has been created and associated with an IP address.

Listening This endpoint is available for an inbound connection.

Idle This endpoint has been opened but cannot receive connections.

Connecting A session is in the connecting phase and the name-to-IP address mapping of the destination is being resolved.

Accepting An inbound session is currently being accepted and will be connected shortly.

Reconnecting A session is trying to reconnect (it failed to connect on the first attempt).

Outbound A session is in the connecting phase and the TCP connection is currently being created.

Inbound An inbound session is in the connecting phase.

Disconnecting A session is in the process of disconnecting.

Disconnected The local computer has issued a disconnect and it is waiting for confirmation from the remote system.•

This command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections

Examples

To display the NetBIOS name table of the remote computer with the NetBIOS computer name of CORP07, type:

nbtstat -a CORP07

To display the NetBIOS name table of the remote computer assigned the IP address of 10.0.0.99, type:

nbtstat -A 10.0.0.99

To display the NetBIOS name table of the local computer, type:

nbtstat -n

To display the contents of the local computer NetBIOS name cache, type:

nbtstat -c

To purge the NetBIOS name cache and reload the #PRE-tagged entries in the local Lmhosts file, type:

nbtstat -R

To release the NetBIOS names registered with the WINS server and re-register them, type:

nbtstat -RR

To display NetBIOS session statistics by IP address every five seconds, type:

"'nbtstat -S 5

"'NBTSTAT.exe

Display protocol statistics and current TCP/IP connections using NBT (NetBIOS over TCP/IP).

Syntax By Name NBTSTAT -a Remote_host_Name [options] [interval]

By IP address NBTSTAT -A IP_address [options] [interval] Key -a (adapter status) List the remote machine's name table given its name -A (Adapter status) List the remote machine's name table given its IP address -c (cache) List NBT's cache of remote [machine] names and their IP addresses -n (names) List local NetBIOS names. -r (resolved) List names resolved by broadcast and via WINS -R (Reload) Purge and reloads the remote cache name table -S (Sessions) List sessions table with the destination IP addresses -s (sessions) List sessions table converting destination IP addresses to computer NETBIOS names. -RR (ReleaseRefresh) Send Name Release packets to WINS and then, starts Refresh

interval Redisplay selected statistics, pausing interval seconds between each display. Press Ctrl+C to stop redisplaying statistics