Nbtstat Command Guide - NetBIOS over TCP/IP Statistics in Windows

The nbtstat command is a Windows Command Prompt utility that displays NetBIOS over TCP/IP (NetBT) protocol statistics, NetBIOS name tables, and the NetBIOS name cache. Use nbtstat -n to view local NetBIOS names, nbtstat -c to display the name cache, and nbtstat -r to show resolution statistics—essential for troubleshooting Windows naming, legacy applications, and WINS in mixed or older environments.

Whether you're diagnosing "computer not found" errors, verifying NetBIOS name registration, auditing the name cache for stale entries, or supporting legacy systems that rely on NetBIOS, the nbtstat command provides visibility into the NetBIOS layer that DNS and modern name resolution don't cover. IT professionals use nbtstat in Active Directory environments, file share troubleshooting, and when supporting older Windows applications.

This comprehensive guide covers nbtstat syntax, all major switches (-n, -c, -r, -R, -a, -A), practical examples, troubleshooting tips, related commands, and frequently asked questions. By the end, you'll confidently use nbtstat for NetBIOS diagnostics.

What Is the Nbtstat Command?

The nbtstat (NetBIOS over TCP/IP Statistics) command has been part of Windows networking since Windows NT. NetBIOS (Network Basic Input/Output System) is a legacy session-layer protocol that provides name resolution and service discovery for Windows networks. Although modern Windows relies heavily on DNS, NetBIOS over TCP/IP (NetBT) remains enabled by default for backward compatibility with file shares, print services, and legacy applications.

Nbtstat displays the NetBIOS names registered by your computer, the cache of names resolved from other computers, and statistics about how names were resolved (broadcast vs. WINS). It helps troubleshoot "cannot find computer" errors, verify that names are registered correctly, and diagnose WINS or LMHOSTS issues.

The command runs in Command Prompt (CMD), PowerShell, and Windows Terminal on Windows 10, Windows 11, and Windows Server. No special privileges are required for most operations.

Nbtstat Command Syntax

nbtstat [-a RemoteName] [-A IP address] [-c] [-n] [-r] [-R] [-s] [-S] [interval]

Parameters and Switches

Parameter	Description
-a RemoteName	List NetBIOS name table for remote computer by NetBIOS name
-A IP address	List NetBIOS name table for remote computer by IP address
-c	Display NetBIOS name cache (names resolved from other computers)
-n	Display local NetBIOS names (registered by this computer)
-r	Display NetBIOS name resolution statistics
-R	Purge and reload the NetBIOS name cache (from LMHOSTS)
-s	Display NetBIOS sessions table (sessions by name)
-S	Display NetBIOS sessions table (sessions by IP)
interval	Redisplay selected statistics every N seconds (with -c, -n, -r, -s, -S)

Parameters and Options Explained

Display Local NetBIOS Names (-n)

The -n switch displays the NetBIOS names registered by your computer. Each name has a type (e.g., <00> for workstation, <20> for file server) and status (Registered). This shows what other computers can resolve when they look up your machine.

Example:

nbtstat -n

Output includes:

• Computer name (e.g., DESKTOP-PC <00>)
• Workgroup/domain name <00> GROUP
• Server service name <20>

Display NetBIOS Name Cache (-c)

The -c switch displays the NetBIOS name cache—names of remote computers that your computer has resolved. Each entry shows the name, type, IP address, and life (seconds until expiration). Useful for verifying that name resolution is working and for finding stale entries.

Example:

nbtstat -c

Display Resolution Statistics (-r)

The -r switch displays statistics about how NetBIOS names were resolved: how many by broadcast, how many by WINS (or other name server), and how many were registered. Helps diagnose whether WINS is being used or if everything is broadcast-based.

Example:

nbtstat -r

Output includes:

• Resolved By Broadcast
• Resolved By Name Server (WINS)
• Registered By Broadcast
• Registered By Name Server

Purge and Reload Cache (-R)

The -R switch purges the NetBIOS name cache and reloads it from the LMHOSTS file (if configured). Use when you've updated LMHOSTS and need the new entries loaded, or when the cache has stale entries. Requires administrator privileges.

Example:

nbtstat -R

Remote Name Table (-a, -A)

The -a switch queries a remote computer by its NetBIOS name; -A queries by IP address. Both display the remote computer's NetBIOS name table—what names it has registered. Useful for verifying that a remote host is advertising the expected names.

Example:

nbtstat -a SERVER01
nbtstat -A 192.168.1.50

Sessions Table (-s, -S)

The -s switch displays NetBIOS sessions sorted by name; -S displays them sorted by IP. Shows active NetBIOS connections (e.g., file shares, print queues). Useful for seeing who is connected to your shares or what you're connected to.

Example:

nbtstat -s
nbtstat -S

Examples

Example 1: View Local NetBIOS Names

Scenario: You want to see what NetBIOS names your computer has registered.

Command:

nbtstat -n

Explanation: Displays your computer name, workgroup/domain, and server service names. Verifies that your machine is advertising correctly for file shares and other NetBIOS services.

Example 2: View NetBIOS Name Cache

Scenario: You want to see which remote computers your system has resolved and their IP addresses.

Command:

nbtstat -c

Explanation: Shows the cache of resolved NetBIOS names. Useful for verifying that a recently accessed server is in the cache, or for spotting stale entries with wrong IPs.

Example 3: Check Name Resolution Statistics

Scenario: You want to know if names are being resolved by broadcast or by WINS.

Command:

nbtstat -r

Explanation: Shows counts of names resolved by broadcast vs. name server (WINS). If "Resolved By Name Server" is 0 and you expect WINS, there may be a WINS configuration issue.

Example 4: Purge and Reload Name Cache

Scenario: You updated the LMHOSTS file and need to reload it.

Command:

nbtstat -R

Explanation: Clears the cache and reloads from LMHOSTS. Run as administrator. Use after editing LMHOSTS to pick up new entries.

Example 5: Query Remote Computer by Name

Scenario: You want to see what NetBIOS names a server (e.g., FILESERVER) has registered.

Command:

nbtstat -a FILESERVER

Explanation: Queries FILESERVER by name and displays its NetBIOS name table. Verifies the server is reachable and advertising expected names.

Example 6: Query Remote Computer by IP

Scenario: You have the IP address but not the name; you want to see the remote computer's NetBIOS names.

Command:

nbtstat -A 192.168.1.50

Explanation: Same as -a but uses IP instead of name. Use when name resolution fails but you can ping the IP.

Example 7: View NetBIOS Sessions

Scenario: You want to see active NetBIOS connections (file shares, etc.).

Command:

nbtstat -s

Explanation: Lists sessions by remote name. Shows local and remote names, state, and type. Use -S for IP-sorted view.

Example 8: Refresh Statistics Periodically

Scenario: You want to watch name resolution statistics change over time.

Command:

nbtstat -r 5

Explanation: Redisplays -r statistics every 5 seconds. Press Ctrl+C to stop. Useful for observing resolution activity.

Example 9: Verify After LMHOSTS Change

Scenario: You added an entry to LMHOSTS for a server. Verify it's loaded.

Command:

nbtstat -R
nbtstat -c

Explanation: Reload cache, then display it. Look for your new LMHOSTS entry in the cache.

Example 10: Troubleshoot "Computer Not Found"

Scenario: User reports "cannot find computer X" when accessing a share.

Command:

nbtstat -a COMPUTERX
nbtstat -c

Explanation: First command checks if COMPUTERX responds and shows its names. Second shows if your machine has COMPUTERX in cache (possibly with wrong IP). Compare with expected IP.

Common Use Cases

• "Computer Not Found" Troubleshooting – Verify that the target computer is advertising NetBIOS names and that your cache has the correct IP. Use -a/-A for remote, -c for local cache.

• WINS Verification – Use -r to see if names are resolved by WINS (Resolved By Name Server) or only by broadcast. Helps diagnose WINS client configuration.

• LMHOSTS Validation – After editing LMHOSTS, run -R to reload, then -c to verify entries appear in the cache.

• File Share Connectivity – NetBIOS is used for traditional SMB file shares. Use nbtstat to verify names and sessions when shares fail.

• Legacy Application Support – Older applications rely on NetBIOS. Use nbtstat to verify the NetBIOS layer is functioning.

• Security Audits – Review -s/-S to see active NetBIOS sessions and identify unexpected connections.

• Name Conflict Detection – If two computers have the same name, nbtstat -a may show unexpected results. Use -A with IP to verify which physical machine responds.

• Cache Stale Entry Cleanup – Use -R to purge cache when you suspect wrong IP mappings (e.g., after DHCP changes or VM cloning).

• Pre-Migration Checks – Before migrating from WINS to DNS-only, use -r to understand current resolution patterns.

• Multi-Subnet Environments – In networks spanning subnets, NetBIOS resolution may use WINS or LMHOSTS. Nbtstat helps verify configuration.

Tips and Best Practices

• NetBIOS Is Legacy – Modern Windows prefers DNS. NetBIOS is often used for backward compatibility. Consider disabling NetBIOS over TCP/IP if not needed (advanced configuration).

• Case Sensitivity – NetBIOS names are typically uppercase in output. When using -a, try the name as users would type it.

• -a vs -A – Use -a when you have the name; use -A when you have the IP (e.g., when name resolution fails).

• -R Requires Admin – Purging and reloading the cache requires administrator privileges. Run cmd as administrator.

• Cache Life – Cached entries expire (life in seconds). Stale entries can cause "wrong computer" issues. Use -R to clear when in doubt.

• WINS vs Broadcast – In small networks, broadcast resolution works. In larger or multi-subnet networks, WINS is typically used. -r shows which method is being used.

• Sessions vs Connections – -s and -S show NetBIOS sessions (SMB, etc.). For TCP connections, use netstat.

Troubleshooting Common Issues

"Host Not Found" with -a

Problem: nbtstat -a COMPUTERNAME fails with host not found.

Solution: Name resolution may be failing. Try nbtstat -A <ip> with the known IP. Verify the computer is on the network (ping). Check if NetBIOS over TCP/IP is enabled on the target. Ensure firewall allows NetBIOS (UDP 137, 138; TCP 139).

Prevention: Use -A with IP when name resolution is suspect.

-R Does Not Reload LMHOSTS

Problem: nbtstat -R runs but LMHOSTS entries don't appear in cache.

Solution: Run as administrator. Verify LMHOSTS file location (e.g., C:\Windows\System32\drivers\etc\lmhosts). Ensure file has correct format (IP <tab> name). Check for typos. Some entries may require #PRE and #DOM for preloading.

Prevention: Test LMHOSTS with a simple entry first; use nbtstat -c to verify.

All Resolution by Broadcast, None by WINS

Problem: nbtstat -r shows "Resolved By Name Server = 0" but you expect WINS.

Solution: Verify WINS server is configured in TCP/IP properties. Check that WINS server is reachable. Ensure NetBIOS over TCP/IP is enabled. In some configurations, "Enable NetBIOS over TCP/IP" must be set explicitly.

Prevention: Document WINS configuration; verify after network changes.

Stale Entry in Cache

Problem: nbtstat -c shows a computer with an old/wrong IP address.

Solution: Run nbtstat -R to purge cache (as admin). The next time you access that computer, a fresh resolution will occur. Alternatively, reboot to clear all caches.

Prevention: After DHCP reservations change or VMs are cloned, consider purging cache on clients.

No Output or Empty Tables

Problem: nbtstat -n or -c shows nothing or minimal output.

Solution: NetBIOS may be disabled. Check adapter properties: TCP/IPv4 → Advanced → WINS. Ensure "Enable NetBIOS over TCP/IP" is selected. Some configurations disable NetBIOS for security.

Prevention: Verify NetBIOS is required before disabling; some legacy apps need it.

Related Commands

ping – Test Connectivity

Ping verifies IP connectivity. Use ping before nbtstat -a/-A to ensure the host is reachable. If ping fails, nbtstat will likely fail too.

ipconfig – View Configuration

ipconfig shows your IP, DNS, WINS configuration. Use it to verify WINS servers are configured when troubleshooting -r statistics.

netstat – TCP/UDP Connections

Netstat shows TCP/UDP connections. Nbtstat -s/-S shows NetBIOS sessions. Use both for full connection visibility: netstat for IP layer, nbtstat for NetBIOS layer.

nslookup – DNS Resolution

Nslookup tests DNS. NetBIOS and DNS are separate. Use nslookup for DNS issues; use nbtstat for NetBIOS name resolution.

arp – ARP Cache

Arp shows IP-to-MAC mapping. Nbtstat shows NetBIOS names. Different layers: arp for Layer 2, nbtstat for NetBIOS naming.

Frequently Asked Questions

What does nbtstat -n do?

nbtstat -n displays the NetBIOS names registered by your local computer, including the computer name, workgroup/domain name, and server service name. It shows what other computers see when they resolve your machine.

What is the difference between nbtstat -a and nbtstat -A?

-a takes a NetBIOS name (e.g., SERVER01) and resolves it to query the remote computer. -A takes an IP address directly. Use -A when name resolution fails or when you already have the IP.

What does nbtstat -c show?

nbtstat -c displays the NetBIOS name cache—remote computer names that your system has resolved, along with their IP addresses and remaining life (seconds). It shows what your computer "remembers" about other machines.

How do I clear the NetBIOS name cache?

Use nbtstat -R (capital R). This purges the cache and reloads from LMHOSTS. Requires administrator privileges. The cache will repopulate as you access computers.

What does "Resolved By Name Server" mean in nbtstat -r?

It means names were resolved using a WINS server (or other NetBIOS name server) rather than by broadcast. In WINS-configured networks, you typically see non-zero values here.

Do I need administrator rights for nbtstat?

Most nbtstat operations (-n, -c, -r, -a, -A, -s, -S) work for standard users. The -R (purge and reload) option requires administrator privileges.

Is NetBIOS still used in Windows 10/11?

Yes. NetBIOS over TCP/IP is enabled by default for backward compatibility with file shares, legacy applications, and some domain functions. It can be disabled if not needed, but many environments still rely on it.

What are NetBIOS name types (e.g., <00>, <20>)?

<00> is often the workstation/service name; <20> is the server service (file sharing). Other types exist for domain, messenger, etc. The number indicates the NetBIOS service type.

Why does nbtstat -a fail with "Host not found"?

The name could not be resolved to an IP. Try nbtstat -A with the IP address instead. Verify the target is on the network (ping) and that NetBIOS is enabled. Check firewall for NetBIOS ports (UDP 137, 138; TCP 139).

How do I reload LMHOSTS?

Run nbtstat -R as administrator. This purges the NetBIOS name cache and reloads entries from the LMHOSTS file. Ensure LMHOSTS has correct path and format.

What is the LMHOSTS file?

LMHOSTS is a static file (similar to hosts for DNS) that maps NetBIOS names to IP addresses. Location: C:\Windows\System32\drivers\etc\lmhosts. Used when WINS is not available or for specific overrides.

Can I use nbtstat in PowerShell?

Yes. Run nbtstat -n or any nbtstat command directly in PowerShell. The nbtstat.exe utility works the same in CMD and PowerShell.

Quick Reference Card

Command	Purpose	Example
nbtstat -n	Display local NetBIOS names	Verify registration
nbtstat -c	Display name cache	View resolved names
nbtstat -r	Resolution statistics	Broadcast vs WINS
nbtstat -R	Purge and reload cache	After LMHOSTS edit
nbtstat -a NAME	Remote name table by name	Query SERVER01
nbtstat -A 192.168.1.50	Remote name table by IP	When name fails
nbtstat -s	Sessions by name	Active connections
nbtstat -S	Sessions by IP	Active connections

Try Nbtstat Yourself

Practice nbtstat in our interactive Windows Command Simulator to view NetBIOS names and cache safely. Explore our Commands Reference for ipconfig, ping, netstat, and other network tools. For related guides, see ipconfig, ping, and netstat.

Summary

The nbtstat command provides visibility into NetBIOS over TCP/IP—the legacy naming layer still used by Windows for file shares and many applications. Use nbtstat -n to view local names, nbtstat -c for the resolution cache, and nbtstat -r for resolution statistics. Use -a and -A to query remote computers, and -R to purge and reload the cache from LMHOSTS.

Key use cases include troubleshooting "computer not found" errors, verifying WINS resolution, validating LMHOSTS, and supporting legacy NetBIOS-dependent applications. Run -R as administrator when reloading the cache. The nbtstat command complements ping, ipconfig, and netstat for comprehensive Windows network diagnostics.