Enumerating NetBIOS Names with nbtstat Command
A security analyst wants to enumerate NetBIOS names on a Windows network. Which built-in Windows command-line tool should they use?
Quick Answer
The answer is nbtstat, the built-in Windows command-line tool for enumerating NetBIOS names on a network. This is correct because nbtstat directly queries the NetBIOS over TCP/IP (NetBT) protocol, as defined in RFC 1001/1002, and can display the remote machine’s NetBIOS name table using the -a or -A switches, revealing service types such as file sharing, messaging, and workstation services. On the Certified Ethical Hacker CEH exam, this question tests your ability to distinguish between native Windows reconnaissance tools—a common trap is confusing nbtstat with net view or ping, but only nbtstat provides detailed NetBIOS name table enumeration. A helpful memory tip: think of “nbt” as “NetBIOS Table,” and remember that the -a switch uses the computer name while -A uses the IP address to pull the full name list.
⚠ Common exam trap
It's easy for candidates to confuse 'net view' (which shows network shares) with NetBIOS name enumeration, but nbtstat is the specific tool for querying the NetBIOS name table and cache directly.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
nbtstat
The nbtstat command is the correct built-in Windows tool for enumerating NetBIOS names because it directly queries and displays NetBIOS over TCP/IP (NetBT) statistics, name tables, and caches. NetBIOS name enumeration relies on the NBT protocol (RFC 1001/1002), and nbtstat -a or -A retrieves the remote machine's NetBIOS name table, which includes service types like file sharing, messaging, and workstation services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
nslookup
Why it's wrong here
nslookup resolves DNS records, not NetBIOS names, so it cannot read the NetBIOS name table this scenario requires. It is tempting because it is the standard Windows name-resolution utility, but it queries DNS servers, whereas nbtstat interrogates NetBIOS over TCP/IP directly.
- ✗
netstat
Why it's wrong here
netstat displays active TCP/IP connections, listening ports and routing tables, not NetBIOS name registrations. It is tempting because it inspects network state from the command line, but it reports socket and protocol statistics, whereas nbtstat -n enumerates the local NetBIOS name table.
- ✓
nbtstat
Why this is correct
`nbtstat` queries the NetBIOS name table and datagram services directly, returning local and remote NetBIOS names, their suffixes and cached entries. Its `-a`, `-A` and `-n` switches satisfy the stem's requirement to enumerate NetBIOS names on a Windows network, unlike tools that resolve DNS or inspect SMB sessions.
- ✗
net view
Why it's wrong here
net view lists shared resources on a domain or workgroup, not NetBIOS name tables. It is tempting because it enumerates Windows network hosts, but it queries the Computer Browser service for shares, whereas nbtstat -n reads the local NetBIOS name cache directly.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CEH question from scratch — 913 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CEH
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security analyst runs 'nbtstat -A 192.168.1.10' and receives a table showing the machine name and a list of names registered. Which service is being enumerated?
easy- A.SNMP
- B.LDAP
- C.SMTP
- ✓ D.NetBIOS
Why D: The 'nbtstat -A' command performs a NetBIOS name table lookup against a remote IP address using the NetBIOS over TCP/IP (NBT) protocol. It queries the target's NetBIOS name service (UDP port 137) and returns the registered names, including the machine name, workgroup/domain, and logged-in users. This directly enumerates the NetBIOS service, making D the correct answer.
Variation 2. A security analyst runs `nbtstat -A 192.168.1.10` and receives output showing a table with names like COMPUTER<00>, COMPUTER<20>, and DOMAIN<1B>. What type of information has the analyst gathered?
easy- ✓ A.NetBIOS names and their associated service types
- B.SMB share lists and open sessions
- C.DNS records for the host and domain
- D.ARP cache entries for the subnet
Why A: The `nbtstat -A` command performs a NetBIOS name table lookup against the target IP address using the NetBIOS over TCP/IP (NBT) protocol. The output displays NetBIOS names (e.g., COMPUTER<00>, COMPUTER<20>, DOMAIN<1B>) along with their associated service type suffixes (hex bytes), which identify the services running on the host, such as Workstation Service (<00>), Server Service (<20>), and Domain Master Browser (<1B>). This allows the analyst to enumerate the host's NetBIOS names and their corresponding service types.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.