NBTScan For Linux

NBTScan is a NetBIOS Name Network Scanner.

NBTscan is a program for scanning IP networks for NetBIOS name information. It sends NetBIOS status query to each address in supplied range and lists received information in human readable form. For each responded host it lists IP address, NetBIOS computer name, logged-in user name and MAC address.

NBTscan compiles and runs on Unix and Windows. I have tested it on Windows NT 4.0, Windows 2000, FreeBSD 4.3, OpenBSD 2.8 and RedHat Linux 7.1 and 7.3. It should also compile and run on Solaris and other Linuxes as well.

Steve Coleman (Steve (dot) Coleman (at) jhuapl (dot) edu) ported previous versions of NBTscan to Solaris, HP-UX and OSF/1 and fixed several bugs. He reports that NBTscan also runs on IRIX/SGI with minor problems. I was also told that NBTscan runs on AIX (Antonio Dell'elce) and SunOS 4.1.3_U1 (Joe Cline). Mohammad A. Haque (mhaque (at) haque (dot) net) ported nbtscan to Darwin.

This program is a successor of a perl script with the same name and does essentially the same thing, being much faster though. NBTscan produces a report like that:

IP address NetBIOS Name Server User MAC address ------------------------------------------------------------------------------ 192.168.1.2 MYCOMPUTER JDOE 00-a0-c9-12-34-56 192.168.1.5 WIN98COMP RROE 00-a0-c9-78-90-00 192.168.1.123 DPTSERVER ADMINISTRATOR 08-00-09-12-34-56

First column lists IP address of responded host. Second column is computer name. Third column indicates if this computer shares or is able to share files or printers. For NT machine it means that Server Service is running on this computer.

Most often it means that this computer shares files. Third column shows user name. If no one is logged on from this computer it is same as computer name. Last column shows adapter MAC address.

If run with -v switch NBTscan lists whole NetBIOS name table for each responded address. The output looks like that:

NetBIOS Name Table for Host 192.168.1.123:

Name Service Type ---------------------------------------- DPTSERVER < 00 > UNIQUE DPTSERVER < 20 > UNIQUE DEPARTMENT < 00 > GROUP DEPARTMENT < 1c > GROUP DEPARTMENT < 1b > UNIQUE DEPARTMENT < 1e > GROUP DPTSERVER < 03 > UNIQUE DEPARTMENT < 1d > UNIQUE ??__MSBROWSE__? < 01 > GROUP INet~Services < 1c > GROUP IS~DPTSERVER < 00 > UNIQUE DPTSERVER < 01 > UNIQUE

Adapter address: 00-a0-c9-12-34-56

� Ungzip and untar sources � Run ./configure script � Run make and make install � That's all.

What's New in This Release:

� Fixed segmentation fault when using -f option (noticed by Brian Lovrin) � Fixed printing ugliness (noticed by Darren Critchley) � Changed version number :) (1.5 said that it is 1.0.3 - now it proudly says 1.5.1)