nmblookup Output Explained: Names, Suffixes and Their Limits

Reviewed October 21, 2026. Commands are examples for an authorized, isolated lab; no target results are asserted here.

nmblookup answers questions about NetBIOS names. It does not enumerate share permissions, authenticate a user, or identify a Samba package version. Read each returned row as a registered name with a suffix and flags, then decide which separate SMB operation you still need to test.

Query a known address before broad discovery

For one verified address inside your authorized lab, replace TARGET_IP and run:

nmblookup --help
nmblookup -A TARGET_IP

Here -A treats the argument as an IP address and requests node status. It does not mean “all enumeration,” as a similarly named flag might in a different tool. Save the command, destination, time and returned name table together.

If your actual question is whether a NetBIOS name resolves, nmblookup -S LABHOST performs name lookup and then requests node status for the returned address. The name is illustrative. Name lookup can use broadcasts according to the interfaces and configuration, so do not substitute it blindly for a single-address query on a shared network. NetBIOS lookup is distinct from DNS lookup.

Read the name, suffix and group flag together

These are conventional registrations, not an inventory of everything running on the host. Use the returned group/unique flag; do not decide the type from a familiar-looking name. A group registration can be shared by multiple machines. More suffixes exist, and an unfamiliar entry should remain unresolved until you check its definition.

Four conclusions the output cannot support

• “This must be Windows.” Samba and other implementations can register NetBIOS names.
• “The host is an AD domain controller.” A workgroup/domain label or browser registration alone does not establish that role.
• “SMB is absent because the query timed out.” NetBIOS name service can be disabled or filtered while direct SMB remains available.
• “The share is readable because <20> appears.” No share or file operation has been tested.

A reply is a useful observation about the responding address at that time. For a lab whose DHCP leases may change, match the address to your VM inventory separately. A displayed name or MAC field alone is not strong proof that you selected the intended VM.

A worked interpretation without invented lab findings

The following is a simplified illustration of name-table rows, not captured output from a Kioptrix machine:

LABHOST     <00>   unique
LABGROUP    <00>   group
LABHOST     <20>   unique

A defensible note is: “The queried address returned unique LABHOST registrations with suffixes 00 and 20 and a LABGROUP group registration with suffix 00.” It is too early to write “Windows server LABHOST in an AD domain with readable shares.” Those statements require different evidence.

Choose the next action from your question. For name-table interpretation, consult the suffix reference. For SMB reachability, use the port results from your existing scoped service discovery. For share names and permissions, move to the SMB enumeration checklist. For “hostname found, no shares,” see the nbtscan boundary guide.

What to retain in your notes

Keep destination, timestamp, exact query, relevant rows and a one-sentence interpretation. Separate “returned registration” from “verified machine identity.” If no reply arrived, record “No node-status response observed” rather than “No SMB.” This preserves a useful result even when the next protocol test gives a different answer.

Primary references: Samba nmblookup manual and Microsoft’s NetBIOS suffix definitions. Check the installed help for your version’s options.