nbtscan

A small command-line NetBIOS name-service scanner by Steve Friedl (Unixwiz.net). nbtscan sends NetBIOS status queries (UDP 137) across a network range and reports which hosts answer — a fast first step in finding Windows machines and open SMB shares before heavier enumeration.

Basic usage

nbtscan -r $NETWORK_IP/$CIDR_NETMASK

This won’t give you detailed user and share information, but it will at least let you know what machines to target.

Key options:

Flag	Purpose
-r	Scan the given range in CIDR notation (also accepts 192.168.0.64-97 last-octet ranges)
-f	Show full NBT resource-record responses — the per-name service flags (recommended)
-v	Verbose debugging output
-n	Skip inverse name lookups of responding IPs
-m	Include MAC addresses (implied by -f)
-T	Timeout for non-responses (default 2s)

Example with -f against a single host:

192.168.0.38    WORKGROUP\DOOKOSSEL             SHARING
  DOOKOSSEL      <00> UNIQUE Workstation Service
  DOOKOSSEL      <20> UNIQUE File Server Service
  WORKGROUP      <00> GROUP  Domain Name

The <20> File Server Service flag is the signal that SMB is listening; the WORKGROUP\HOSTNAME line gives you the NetBIOS name and workgroup/domain membership.

Where it fits

• Very fast and very old: the classic release (1.0.35, 2008) still ships in Kali as nbtscan-unixwiz; it is UDP/137-only, so it works even where TCP 445 is filtered but NetBIOS name service is exposed.
• Recon only: nbtscan tells you which hosts speak NetBIOS — feeding its output into smbclient (-L), smbmap, or enum4linux is the natural next step for share and user enumeration.
• Superseded at scale: for large sweeps, nmap’s nbstat.nse script (nmap -sU -p 137 --script nbstat) covers the same ground with better output handling.

Sources

• nbtscan — Unixwiz.net tools page (authoritative)
• nbtscan-unixwiz — Kali Linux tools documentation

Related: smbclient, smbmap, enum4linux, nmap, default-cifs-shares