The command

  nmblookup -A IP_address

returns, according to the man page, a node status query on this address. A typical output is:

  Looking up status of
    HPB4B52F0559C2  <00> -         B <ACTIVE> <PERMANENT> 
    MSHOME          <00> - <GROUP> B <ACTIVE> <PERMANENT> 
    HPB4B52F0559C2  <20> -         B <ACTIVE> <PERMANENT> 
    HP0559C2        <00> -         B <ACTIVE> <PERMANENT> 
    HP0559C2        <20> -         B <ACTIVE> <PERMANENT> 

I have been unable to understand the meaning of this output in detail. For instance, what do the different lines correspond to? The numbers within <>? The B code (could also be M or H)? The keywords ACTIVE and PERMANENT?

1 Answer 1


Each line corresponds to a name that the node has claimed using NetBIOS.

  • The first field is the name itself.

  • The second field is the suffix, or the 16th byte of the name, in hexadecimal. It shows the type of this name – 0x00 is "Workstation" (a regular NetBIOS node), 0x20 is "Server" (a node running a SMB file server), 0x01 is "Browser" (a node that keeps track of all NetBIOS names on the network), 0x03 is "Messenger" (a node or a user that can receive popup notifications), and so on, and so on.

  • The third field is unknown to me yet...

  • The fourth field marks this line as a "group" name – one that multiple node (AFAIK up to 16) may claim at once. In this case, a group name of type 0x00 (Workstation) denotes the workgroup that the node is in (which again has to do with network browsing).

  • The fifth field is the node type (though I don't know why it is a property of each name – AFAIK, it is a setting of the node itself…) – B-nodes use NetBIOS datagrams which are broadcast in the LAN; P-nodes (point-to-point) use a central WINS server; M-nodes (mixed) first try broadcast then WINS when resolving names; H-nodes (hybrid), a later improvement over M-node, first try WINS then broadcast (this is a little faster).

  • I am not sure of the last two fields. It's likely that <ACTIVE> means that the node successfully registered this name; if it ended up a duplicate, it would still be listed in response to a status query, but it would have a different marker. Similarly, <PERMANENT> is likely to mean that the name doesn't expire, or something.

Further reading:

  • The chapter "Browse Service" from "Implementing CIFS" describes network browsing and name types in detail.

Edits welcome.

  • 1
    Very good answer indeed, thank you for taking the time. Feb 2, 2014 at 13:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.