PAGES
← all tools
◆ Reconnaissance & OSINT

nbtscan

1.5 open-source

NBTscan is a program for scanning IP networks for NetBIOS name information, sending status queries and listing IP address, computer name, user, and MAC addressMAC addressA hardware-address identifier used on a local network, such as Ethernet or Wi-Fi. It identifies a network interface for delivery on that link, rather than routing across the internet..

source ↗ rss ↗ What is a cyber toolchain?

Summary

nbtscan is an open-source command-line tool that scans IP networks for NetBIOS name information, sending status queries to each address in a range and listing, for hosts that respond, the IP address, NetBIOS computer name, logged-in user name, and MAC address. It runs from the shell against a supplied IP range or list, which suits network administrators and reconnaissance-focused pentesters doing early host and Windows/SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. discovery on a network rather than deep service enumeration. It sits in the same space as other NetBIOS and network-scanning utilities used for that footprinting step, rather than offering anything broader. The project is a revival of Alla Bezroutchko's original tool, now maintained by the resurrecting-open-source-projects group with only 3 contributors, and while packaged for Debian, it has seen no commits in the past year, so treat it as stable but essentially dormant.

NBTscan is a program for scanning IP networks for NetBIOS name information, sending status queries and listing IP address, computer name, user, and MAC address.

How nbtscan helps

Which hosts on this subnet are actually Windows machines I can investigate further?

sends a NetBIOS status query to every address in the given range and lists the IP, computer name, logged-in user, and MAC address for each host that answers, leaving silent addresses as either down or non-NetBIOS

Who is logged into a given machine on my network right now?

reads the logged-in user name back from the NetBIOS status reply for each responding host, giving a point-in-time answer rather than a login history

Which physical device sits behind a given IP address?

pulls the MAC address out of the NetBIOS status reply, letting the IP be tied to a specific network interface

Can I tell which hosts belong to which machine when several IPs map to one computer name?

lists computer name alongside IP for every responder, so repeated names across different addresses stand out as the same host with multiple interfaces or DHCP leases

Is this list of addresses actually reachable as hosts before I run anything heavier against them?

walks a supplied IP range or list and reports back only the addresses that returned a NetBIOS status response, giving a quick first-pass host census ahead of deeper scanning

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities · 1 backed by code, an API document or a real run

Built from nbtscan's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

  • nbtscan covers 1 of the 13 network discovery and scanning capabilities we track.

What nbtscan offers you

  • Command-line interface2
All capabilities 8 capabilities
IP address file ingestion and NetBIOS scanning verified Reads a file of IP addresses and performs NetBIOS scans against them, rejecting lines that are not valid IP addresses. 5 releases · 1 other source · first seen Mar 2000

Shared capability: Attack surface inventory

Also counts toward: Command-line interface

release

we ran it

  • Every line in the file was rejected as a bad IP address, since the file contains Python package pinning entries (e.g. PyYAML==5.1, requests==2.19.1) rather than IP addresses. Aug 2026 · the full run
Precise timeout control shipped suggested Configures scan timing with millisecond precision via the timeout option. 2 releases · 1 other source · first seen May 2002

Suggested capability: Network host discovery. This is our guess, not confirmed.

release

example

  • Run nbtscan on Darwin with fine-grained timing in milliseconds. nbtscan -t 120 192.168.1.0/24 1.5 · May 2002 · source
NetBIOS information enumeration shipped Scans IP networks for NetBIOS name information, listing IP address, computer name, logged-in user, and MAC address. 3 other sources · first seen Mar 2000

Shared capability: Attack surface inventory

docs

  • # NBTscan NBTscan - scan networks for NetBIOS name information ## Help this project NBTscan needs your help. If you are a programmer and if you want to help a NBTscan was imported from some tarballs, the [original homepage][1] and [ChangeLog file](ChangeLog) (version 1.6 and later releases). seen Sep 2026 · source
  • Scans IP networks for NetBIOS name information, listing IP address, computer name, logged-in user, and MAC address.

example

  • Run nbtscan in a script and parse the structured output programmatically. nbtscan -s <target> 1.0.2 · Mar 2000 · source
Script-friendly output format shipped Provides structured output suitable for programmatic parsing by scripts. 2 releases · first seen Mar 2000

release

Packet and response debugging shipped Captures full packet data and NetBIOS responses for protocol interaction analysis. 1 release · 1 other source · first seen Mar 2000

Also counts toward: Command-line interface

release

example

  • Capture full NetBIOS responses for debugging protocol interactions on a specific target. nbtscan -d <target> 1.0.2 · Mar 2000 · source
Platform support shipped Runs on the Darwin operating system. 1 release · first seen May 2002

release

Standard input target listing shipped Accepts a list of targets directly from standard input without requiring an intermediate file. 1 other source · first seen May 2002

example

  • Pipe a list of targets directly into nbtscan without creating a temporary file. echo '192.168.1.1-255' | nbtscan -t 500 1.5 · May 2002 · source
Human-readable service names shipped Displays NetBIOS service names in a human-readable format instead of raw codes. 1 release · first seen Mar 2000

release

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for nbtscan, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail nbtscan puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

3 entries

  1. May 20021
  3. February 20021
  5. March 20001
    Show

    3 entries

    1. 1.5 May 5, 2002 · release notes

      nbtscan 1.5 adds stdin input, Darwin support, millisecond timeouts

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.5 https://github.com/resurrecting-open-source-projects/nbtscan.git
# already have the repo? check out this version:
$ git checkout 1.5
      └──▷ USE IT
      Pipe a list of targets directly into nbtscan without creating a temporary file.
      shell 
      echo '192.168.1.1-255' | nbtscan -t 500
      Run nbtscan on Darwin with fine-grained timing in milliseconds.
      shell 
      nbtscan -t 120 192.168.1.0/24
      • Host list can now be read from stdin instead of only a file.
      • timeout option -t accepts milliseconds instead of seconds.
      • Darwin platform is now supported.

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The -t timeout unit changed from seconds to milliseconds.
    2. 1.0.3 Feb 3, 2002 · release notes

      NBTscan 1.0.3 adds lmhosts output format and IP list file scanning

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.0.3 https://github.com/resurrecting-open-source-projects/nbtscan.git
# already have the repo? check out this version:
$ git checkout 1.0.3
      • Adds /etc/hosts and lmhosts format output options for NBT results.
      • Enables scanning a target list from a file instead of only command-line arguments.

      2 details in Everything

    3. 1.0.2 Mar 30, 2000 · release notes

      nbtscan 1.0.2 adds -m, -b, -s, -h, -q, and -d flags for control, parsing, and output.

      └──▷ GET THIS VERSION 
      $ git clone --branch 1.0.2 https://github.com/resurrecting-open-source-projects/nbtscan.git
# already have the repo? check out this version:
$ git checkout 1.0.2
      └──▷ TRY IT
      Run nbtscan in a script and parse the structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. programmatically.
      $ nbtscan -s <target>
      Capture full NetBIOS responses for debugging protocol interactions on a specific target.
      $ nbtscan -d <target>
      • -m flag added to configure retransmits.
      • -b flag added to throttle output bandwidth.
      • -s option adds script-friendly output format.
      • -h flag prints human-readable NetBIOS service names.
      • -q flag suppresses banners and error messages.
      +1 more show less
      • -d flag enables printing of whole packets.

      6 details in Everything

    Project health

    Issue, contributor and maintainer activity in resurrecting-open-source-projects/nbtscan, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 0 ±0 vs prior 12 months
    2. Maintainers 0 +0 joined · −0 left, last 12 months
    3. Bus factor 0 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 0 of 2 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 0
    4. Commits / month 0
    5. Stars 52
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Articles

    2 articles · updated Nov 4, 2026

    Where nbtscan turns up in what others publish: how-tos, attack reports that name it, and incident write-ups. A row says why it is here and quotes where the article names it; the link goes to the publisher.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback