-
February 19th, 2006, 11:24 PM
#1
Junior Member
Resolving NetBIOS name from IP
Is there a command line function (or any other way) that i can get a NetBIOS name if i know the IP address?
-
February 19th, 2006, 11:30 PM
#2
That would rely _entirely_ upon the configuration of the remote client. Done properly, without rights to the remote, you will get nothing....
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
February 19th, 2006, 11:44 PM
#3
Junior Member
assuming i have rights as an admin to the remote computer?
-
February 19th, 2006, 11:49 PM
#4
Assuming... you have rights... it would still depend on the OS and the rights granted on that machine to remote users... including administrators...
If you would care to illuminate us on the precise situation then we could give much more accurate answers....
Don\'t SYN us.... We\'ll SYN you.....
\"A nation that draws too broad a difference between its scholars and its warriors will have its thinking done by cowards, and its fighting done by fools.\" - Thucydides
-
February 20th, 2006, 11:48 PM
#5
As tigershark states, it is highly dependant on the setup.
For a MS based network you could try pinging the ip address then using nbtstat to look at netbios resolution table
You can type nbtstat at a command prompt to get the switches needed.
It really depdns on the set up and type of network you are in.
Our destiny is to endure all hardships that we encounter along the path to what we perceive to be true and worthwhile !
The Head foundation
Please give generously
-
February 21st, 2006, 12:36 AM
#6
If its a windows network and you have rights...the command would be "ping -a <IP address>"
-
February 21st, 2006, 01:07 AM
#7
Here's the command syntax for resolving netbios names:
CMD> nbtstat -a xxx.xxx.xxx.xxx <-- X being the IP address
If you are using Linux there is a cool Linux NBTSTAT client created by BindView who was just aquired by Symantec (but the tool is still free) found here .
The cool thing with the linux client is that you can use CRON to schedule NBTSTATs of a particular IP if the user isn't online when you attempt to resolve there NBT name. I do this with investigations, when an internal IP is detected by Snort I run a script the to check for any new instances of an IP and then run a real-time NBTSTAT so I know the machine name and who was logged at the moment Snort detected the alert.
Hope that helps...
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
|