Results 1 to 7 of 7

Thread: Resolving NetBIOS name from IP

  1. #1
    Junior Member
    Join Date
    May 2005
    Posts
    15

    Resolving NetBIOS name from IP

    Is there a command line function (or any other way) that i can get a NetBIOS name if i know the IP address?

  2. #2
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    That would rely _entirely_ upon the configuration of the remote client. Done properly, without rights to the remote, you will get nothing....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  3. #3
    Junior Member
    Join Date
    May 2005
    Posts
    15
    assuming i have rights as an admin to the remote computer?

  4. #4
    AO Ancient: Team Leader
    Join Date
    Oct 2002
    Posts
    5,197
    Assuming... you have rights... it would still depend on the OS and the rights granted on that machine to remote users... including administrators...

    If you would care to illuminate us on the precise situation then we could give much more accurate answers....
    Don\'t SYN us.... We\'ll SYN you.....
    \"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides

  5. #5
    Senior Member geepod's Avatar
    Join Date
    Jun 2002
    Posts
    211
    As tigershark states, it is highly dependant on the setup.

    For a MS based network you could try pinging the ip address then using nbtstat to look at netbios resolution table

    You can type nbtstat at a command prompt to get the switches needed.

    It really depdns on the set up and type of network you are in.
    Our destiny is to endure all hardships that we encounter along the path to what we perceive to be true and worthwhile !

    The Head foundation
    Please give generously

  6. #6
    AO Veteran NeuTron's Avatar
    Join Date
    Apr 2003
    Posts
    550
    If its a windows network and you have rights...the command would be "ping -a <IP address>"

  7. #7
    Member aciscorouter's Avatar
    Join Date
    Mar 2002
    Location
    Brampton, ON, Canada
    Posts
    35

    Cool Here's the command syntax for resolving netbios names:

    CMD> nbtstat -a xxx.xxx.xxx.xxx <-- X being the IP address

    If you are using Linux there is a cool Linux NBTSTAT client created by BindView who was just aquired by Symantec (but the tool is still free) found here .

    The cool thing with the linux client is that you can use CRON to schedule NBTSTATs of a particular IP if the user isn't online when you attempt to resolve there NBT name. I do this with investigations, when an internal IP is detected by Snort I run a script the to check for any new instances of an IP and then run a real-time NBTSTAT so I know the machine name and who was logged at the moment Snort detected the alert.

    Hope that helps...
    aCISCOrouter

    "I used up all my sick days, so I’m calling in dead."
    http://www.facebook.com/profile.php?id=554370423

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •