Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The command

  nmblookup -A IP_address

returns, according to the man page, a node status query on this address. A typical output is:

  Looking up status of
    HPB4B52F0559C2  <00> -         B <ACTIVE> <PERMANENT> 
    MSHOME          <00> - <GROUP> B <ACTIVE> <PERMANENT> 
    HPB4B52F0559C2  <20> -         B <ACTIVE> <PERMANENT> 
    HP0559C2        <00> -         B <ACTIVE> <PERMANENT> 
    HP0559C2        <20> -         B <ACTIVE> <PERMANENT> 

I have been unable to understand the meaning of this output in detail. For instance, what do the different lines correspond to? The numbers within <>? The B code (could also be M or H)? The keywords ACTIVE and PERMANENT?

share|improve this question
up vote 5 down vote accepted

Each line corresponds to a name that the node has claimed using NetBIOS.

  • The first field is the name itself.

  • The second field is the suffix, or the 16th byte of the name, in hexadecimal. It shows the type of this name – 0x00 is "Workstation" (a regular NetBIOS node), 0x20 is "Server" (a node running a SMB file server), 0x01 is "Browser" (a node that keeps track of all NetBIOS names on the network), 0x03 is "Messenger" (a node or a user that can receive popup notifications), and so on, and so on.

  • The third field is unknown to me yet...

  • The fourth field marks this line as a "group" name – one that multiple node (AFAIK up to 16) may claim at once. In this case, a group name of type 0x00 (Workstation) denotes the workgroup that the node is in (which again has to do with network browsing).

  • The fifth field is the node type (though I don't know why it is a property of each name – AFAIK, it is a setting of the node itself…) – B-nodes use NetBIOS datagrams which are broadcast in the LAN; P-nodes (point-to-point) use a central WINS server; M-nodes (mixed) first try broadcast then WINS when resolving names; H-nodes (hybrid), a later improvement over M-node, first try WINS then broadcast (this is a little faster).

  • I am not sure of the last two fields. It's likely that <ACTIVE> means that the node successfully registered this name; if it ended up a duplicate, it would still be listed in response to a status query, but it would have a different marker. Similarly, <PERMANENT> is likely to mean that the name doesn't expire, or something.

Further reading:

  • The chapter "Browse Service" from "Implementing CIFS" describes network browsing and name types in detail.

Edits welcome.

share|improve this answer
Very good answer indeed, thank you for taking the time. – MariusMatutiae Feb 2 '14 at 13:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.