Consider making a direct contribution to help keep is-it-true.org on the Net by clicking on my Amazon honor system contribution paybox.

FYI if you click on any of my Amazon book, movie, or music links and purchase anything from Amazon, is-it-true.org will get a small percentage. Consider coming back to my site and getting into Amazon from one of my Amazon links, if you are going to purchase an item. It will help keep my site on the Net.

NBT (NetBios over TCP/IP) STAT (Statistics) is a critical tool for problem solving and depends on the Microsoft's use of NetBIOS in Windows. The foundation for file and print sharing for Microsoft's windows networks is the Server Message Block (SMB) protocol (later renamed to CIFS, Common Internet File System). Every Windows computer is assigned a user friendly NetBIOS name to allow them to communicate with each other. Workgroup and domain names are also NetBIOS names. The NetBIOS protocol is not routeable. NetBIOS over TCP/IP is. Thus tools NetBIOS tools like Nbtstat are valuable for discovery and problem solving on Windows-based networks. It is a tool to view and manipulate the NetBIOS name table and the name cache.

It is possible to discover who is logged onto a networked PC using the Windows NT utility NBTSTAT since its in the logged on account is part of the naming info maintained locally by NBT. NBT runs on each Windows PC and functions as a local naming agent for TCP/IP. If a network address is not locally cached, NBT gets the info from WINS or LMHOSTs. Nbtstat can be used to capture logon ids. This Windows NT commandline utility is run as:

nbtstat -a wayneathome

--or--

nbtstat -A 208.188.57.62

You notice that you use -a when you know the machinename and -A when you know the ip address. The following is the result of nbtstat -a wayneathome run at the commandline while my home PC is attached to the Internet using a modem. nbtstat is a standard method to obtain NIC MAC addresses. Since I do not have a NIC but only a modem, the MAC address was 00-00-00-00-00-00.

       NetBIOS Remote Machine Name Table

   Name               Type         Status
---------------------------------------------
Registered Registered Registered Registered Registered 
MAC Address = 00-00-00-00-00-00
WAYNEATHOME    <03>  UNIQUE      
WMAPLES        <03>  UNIQUE      
WAYNEATHOME    <00>  UNIQUE      
WORKGROUP      <00>  GROUP       
WAYNEATHOME    <20>  UNIQUE      
 

The account will be a 03 record. One of the records will be the PC machine name and the other will be the account name. Since the machine name shows up in multiple records and most user accounts follow a company standard, its not hard to determine which is the user account. 03 is one of many codes, see NetBIOS Service codes in the NetBIOS suffix for a fairly complete list.

If you have a RAS server, you will probably see Event ID 4320 or Event ID 4319. The text of both state that a duplicate name has been detected on the network. The messages states to run the nbtstat -n command to find the computer sending the name release message (the PC detecting the conflict). The 4319 and 4320 events have the tcpip address of the PC which detected the conflict but in a bizarre form. View the data in hex. The last line of data will have 4 hex digits. The Microsoft kb examples list the data e7 1a 65 16. Convert to decimal, 231 26 101 22. Finally invert the digits, 22 101 26 231. The reporting ip address is 26.101.26.231. When I performed this task, it was the ip address of a WINS server. Use of nbtstat -n can be very useful but in many cases, the conflicts are normal events - logon to two workstations and this event will be generated.

I have created scripts which probe PCs in our network and return list of logged on user accounts. PERL is particularly useful for scripting such tasks.

Type nbtstat at the commandlin to get a listing of the available parameters:

NBTSTAT [ [-a RemoteName] [-A IP address] [-c] [-n]
        [-r] [-R] [-RR] [-s] [-S] [interval] ]

  -a   (adapter status) Lists the remote machine's name table given its name
  -A   (Adapter status) Lists the remote machine's name table given its
                           IP address.
  -c   (cache)          Lists NBT's cache of remote [machine] names and their IP
                           addresses
  -n   (names)          Lists local NetBIOS names.
  -r   (resolved)       Lists names resolved by broadcast and via WINS
  -R   (Reload)         Purges and reloads the remote cache name table
  -S   (Sessions)       Lists sessions table with the destination IP addresses
  -s   (sessions)       Lists sessions table converting destination IP
                        addresses to computer NETBIOS names.
  -RR  (ReleaseRefresh) Sends Name Release packets to WINS and then, starts 
                        Refresh

  RemoteName   Remote host machine name.
  IP address   Dotted decimal representation of the IP address.
  interval     Redisplays selected statistics, pausing interval seconds
               between each display. Press Ctrl+C to stop redisplaying
               statistics.

There is a non-microsoft version available with binary and source which you can use. It has slightly different parms. Run it on your favorite linux box as well as other flavors of unix.

The following table lists the NetBIOS suffixes that are used by Microsoft Windows NT. The suffixes are listed in hexadecimal format because many of them are unprintable otherwise.

Name                Number(h)  Type  Usage
--------------------------------------------------------------------------
<computername>         00       U    Workstation Service
<computername>         01       U    Messenger Service
<\\--__MSBROWSE__>     01       G    Master Browser
<computername>         03       U    Messenger Service
<computername>         06       U    RAS Server Service
<computername>         1F       U    NetDDE Service
<computername>         20       U    File Server Service
<computername>         21       U    RAS Client Service
<computername>         22       U    Microsoft Exchange Interchange(MSMail
                                                                Connector)
<computername>         23       U    Microsoft Exchange Store
<computername>         24       U    Microsoft Exchange Directory
<computername>         30       U    Modem Sharing Server Service
<computername>         31       U    Modem Sharing Client Service
<computername>         43       U    SMS Clients Remote Control
<computername>         44       U    SMS Administrators Remote Control
                                                               Tool
<computername>         45       U    SMS Clients Remote Chat
<computername>         46       U    SMS Clients Remote Transfer
<computername>         4C       U    DEC Pathworks TCPIP service on
                                                               Windows NT
<computername>         42       U    mccaffee anti-virus
<computername>         52       U    DEC Pathworks TCPIP service on
                                                               Windows NT
<computername>         87       U    Microsoft Exchange MTA
<computername>         6A       U    Microsoft Exchange IMC
<computername>         BE       U    Network Monitor Agent
<computername>         BF       U    Network Monitor Application
<username>             03       U    Messenger Service
<domain>               00       G    Domain Name
<domain>               1B       U    Domain Master Browser
<domain>               1C       G    Domain Controllers
<domain>               1D       U    Master Browser
<domain>               1E       G    Browser Service Elections
<INet~Services>        1C       G    IIS
<IS~computer name>     00       U    IIS
<computername>         2B       U    Lotus Notes Server Service
IRISMULTICAST          2F       G    Lotus Notes
IRISNAMESERVER         33       G    Lotus Notes
Forte_$ND800ZA         20       U    DCA IrmaLan Gateway Server Service