Example of NBTSTAT switches

If you type NBTSTAT with no parameters, you'll get a list of the switches and what they do. Here are the ones I use most often.

The -a switch shows the names that have been registered for an interface. You can query either the local interface or a remote computer, and you can query by flat name or IP address (with the -A switch). Here's an example:

C: >nbtstat -a s1 Local Area Connection: Node IpAddress: [10.1.1.1] Scope Id: []
       NetBIOS Remote Machine Name Table    
Name    Type     Status ---------------------------------------------
    S1     <00> UNIQUE   Registered
    COMPANY    <00> GROUP    Registered
    COMPANY    <1C> GROUP    Registered
    S1     <20> UNIQUE   Registered
    COMPANY    <1B> UNIQUE   Registered
    COMPANY    <1E> GROUP    Registered
    S1     <03> UNIQUE   Registered
    COMPANY    <1D> UNIQUE   Registered
   ..__MSBROWSE__.    <01> GROUP    Registered
    ADMINISTRATOR    <03> UNIQUE   Registered
    MAC Address = 00-B0-D0-76-BE-B3

The -c switch lists the contents of the name resolution cache. This is especially helpful if you
are trying to figure out why one machine doesn't see another by its name even though you can ping
the IP address. Here's an example listing:

C: >nbtstat -c

Local Area Connection: Node IpAddress: [10.1.1.1] Scope Id: []       
NetBIOS Remote Cache Name Table     Name    Type   
Host Address    Life [sec]
------------------------------------------------------------    
S2    <20>    UNIQUE   
10.1.1.22    587     S3   
<20>    UNIQUE    10.1.1.21    600 

The -r switch is especially helpful when you are trying to troubleshoot WINS problems. It tells
you how each flat name was resolved, WINS or broadcast:

C: >nbtstat -r     NetBIOS Names Resolution and Registration Statistics
----------------------------------------------------     Resolved By Broadcast = 21
    Resolved By Name Server = 0     Registered By Broadcast = 10
    Registered By Name Server = 0     NetBIOS Names Resolved By
Broadcast ---------------------------------------------     S3     S2
    S3     S3    <00>    
S2    <00>     S3    
SUBSIDIARY    <1B> 

The -s and -S switches give you the current SMB sessions on the computer.

The -R switch allows you to flush the name cache and restock it with entries from your LMHOSTS
file.

The -RR switch allows you to release and refresh the name registration at the WINS server. This
is helpful when you are troubleshooting WINS and you have flushed a tombstone and want to add back
the correct resource record.