DetailPage-MSS-KB

Microsoft small business knowledge base

Article ID: 830578 - Last Review: October 30, 2006 - Revision: 2.5

On This Page

SUMMARY

NBLookup is a command line diagnostic tool that uses the User Datagram Protocol (UDP) to send NetBIOS name queries to Microsoft Windows Internet Naming Service (WINS) servers. NBLookup requires TCP/IP version 4 to run. WINS servers accept name resolution requests on UDP port 137.

NBLookup runs on the following operating systems:
  • Microsoft Windows NT 4.0
  • Microsoft Windows 2000
  • Microsoft Windows XP
  • Microsoft Windows Server 2003
You can obtain NBLookup from the Microsoft Download Center.

The following file is available for download from the Microsoft Download Center:
Collapse this imageExpand this image
Download
Download the NBLookupV1.exe package now. (http://download.microsoft.com/download/f/3/a/f3adc5b4-2716-4ef3-bbb8-f4cd4446d415/nblookupv1.exe)

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591  (http://support.microsoft.com/kb/119591/ ) How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

NBLookup can be run in command-line mode, in interactive mode, and in query list mode. The following table contains the correct syntax for each mode.
Collapse this tableExpand this table
ModeSyntax
Command-Linenblookup [-options] NetBIOS_Name_to_Query
Interactivenblookup [-options]
Query Listnblookup -ql input_file [-qr report_file]

Command-Line Mode

You can use Command Line mode to send a single NetBIOS name query to a single WINS server. After the response appears, the program ends. The following table contains the possible return values for this query.
Collapse this tableExpand this table
Return valueDescriptionDetails
0positive query responseIf the name is resolved (if NBLookup returns an Internet Protocol (IP) address for the name), NBLookup returns a value of 0 and the exits.
1negative name responseThe name does not exist and cannot be resolved.
99errorNBLookup experienced an error.

These return values can be useful in scripts.

To exit NBLookup before it has completed in command-line mode, press CTRL+C.

Command-Line Mode Options

Command line mode uses the following syntax:
nblookup [-options] NetBIOS_Name_to_Query
NetBIOS_Name_to_Query must be a valid NetBIOS name that has a maximum of 15 alphanumeric characters. This NetBIOS name cannot contain period (.) characters (dots) or any special characters such as ampersands (&) or percent signs (%).

The following table contains descriptions of the options that you can use with NBLookup in command-line mode.
Collapse this tableExpand this table
OptionDescriptionDetails
/s- Used to specify the WINS server to query- Can be an IP address or a NetBIOS name
- Default value is the local system's WINS server
/x- Used to specify the NetBIOS suffix to query- Must be a valid NetBIOS suffix
- Must be in hexadecimal format
- Default value is 20 (File Server service)
- Examples: 00, 20, 1B, 1C
/suffix_help- Used to display a list of common NetBIOS suffixes- Cannot be used with any other option
/t- Used to specify the timeout period for the query- Valid range: 1 to 20 seconds
- Example: /t 5
/r- Used to specify the number of queries (the number of retries that you want)- Causes the query to retry if there is no response
- Valid range: 1 to 20
- Example: /r 8
/nr- Used to specify no recursion for the query- Turns off recursion
- By default, queries use recursion
/i- Used to specify the NetBIOS scope ID- ID is appended to the NetBIOS name for the query
- ID is case sensitive
- Can be used only on networks that use scope IDs
- Example: /i MyScopeId

Command-Line Mode Examples

The following example queries WINS server 169.254.1.10 for the File Server service that computer1 has registered:
nblookup /s 169.254.1.10 computer1
The following example queries the WINS server that is named WINS1 for the domain controllers that are registered in the domain that is named DOMAIN1:
nblookup /s WINS1 /x 1C DOMAIN1

Interactive Mode

This mode is similar to the interactive mode of the NSLookup tool.

NBLookup starts a command shell that accepts a limited number of commands and parameter settings. You can use this mode to troubleshoot issues that require you to send the same queries repeatedly, although each repetition may use different parameter settings.

To exit NBLookup before it has completed in interactive mode, type quit or exit, and then press ENTER. The program exits the command shell and the program ends.

Interactive Mode Options

Interactive mode uses the following syntax:
nblookup [-options]
The following table lists the options that are available in interactive mode.
Collapse this tableExpand this table
OptionDescription
help or ? - Used to display information about common commands
shelp or ?s - Used to display common NetBIOS suffixes (the 16th character)
NAME - Used to query the default WINS server for the specified NetBIOS name
server NAME - Used to set the default WINS server to the specified NetBIOS name or IP address
ipconfig - Used to display the IP configuration of the local system; runs from inside the command shell
set OPTION=value- Used to set specified option values

You can use the set OPTION=value option to set specified option values for NBLookup. The following table describes the option values that you can set by using the set option.
Collapse this tableExpand this table
Option and valueDescriptionDetails
set all - Used to display the current option values
set suffix=x - Used to set the query type- Examples: 00,20,03,1B,1C
set suffix=* - Used to set query types 00, 20, and 03 in one command
set type=x- Used to set the query type - Same as suffix=x
- Examples: 00,20,03,1B,1C
set type=* - Used to set query types 00, 20, and 03 in one command- Same as suffix=*
set timeout=n- Used to set the query timeout period in seconds- Valid range: 1 to 20
set retry=n - Used to set the number of query retries- Valid range: 1 to 20
set norecurse - Used to turn off recursion- By default, recursion is on
set recurse- Used to turn on recursion- By default, recursion is on
set id=x - Used to set the NetBIOS scope ID for the query - Can use any alphanumeric scope ID
- Required only if scope IDs are used in the environment
- Can be used to reset the scope ID by running set id=

To view a list of query types that you can use with the set suffix=x option, type nblookup /suffix_help at a command prompt, and then press ENTER, or type shelp from within NBLookup.

Interactive Mode Examples

To use NBLookup in interactive mode, type the following command at a command prompt, and then press ENTER:
path\NBLookup.exe
Note In this example, path is the path of the NBLookup.exe file on your computer.

The greater-than (>) sign appears in the NBLookup interface as a prompt. To run any of the following commands, type the command at the > prompt, and then press ENTER:
  • The following command lists the IP address of the default WINS server:
    SERVER
  • The following command sets the query type to 1B (Master Browser):
    set type=1B
  • The following command queries the default WINS server for master browsers in the domain. In this example, the domain is named TESTDOMAIN.
    testdomain
    When you run this command, NBLookup displays output that is similar to the following:
    Recursion is on
    
    Querying WINS Server: 157.55.253.218
    NetBIOS Name: testdomain
    Suffix: 1B
    
    Name returned: TESTDOMAIN
    Record type: Unique
    IP Address: 157.54.5.150
    
    Note In this example, 157.54.5.150 is the IP address of the master browser in the TESTDOMAIN domain.
  • The following command sets the query type to Workstation Service (00), to Messenger Service (03), and to File Server Service (20):
    set type=*
  • The following command displays the current option values:
    set all
  • The following command queries the default WINS server for the Workstation Service, for the Messenger Service, and for the File Server Service that are registered with the computer that is named MYSERVER:
    MYSERVER

Query List Mode

Query list mode uses the following syntax:
nblookup -ql input_file [-qr report_file]
Query List Mode uses an input file to specify the parameters of WINS queries.

Query List Mode Options

The following table lists the options that are available in query list mode.
Collapse this tableExpand this table
OptionDescriptionDetails
/ql- Used to run NBLookup in query list mode- Sends WINS queries that are specified in a text input file
- Must specify the path and the name of the input file
- Cannot be used with command-line mode options
/qr- Used to specify the name of the report file to create when you use /ql - Used only with the /ql option
- Cannot be used with command-line mode options
- Must specify the path and the name of the report file
- Automatically appends the .htm extension to the specified file name
- By default, the report file name is Nblookup.htm
/ql- Used to create a sample input file that is named In-nblookup.txt- Cannot be used with any other options
- The autocreate command
/y- Used to overwrite the existing report file without prompting- Cannot be used with command-line mode options
- Useful in scripts

Query List Mode Examples

The following command builds a sample input file that is named In-nblookup.txt:
nblookup /ql
The following command runs queries that are specified in the input file that is named In-nblookup.txt. The command then creates a report that is named Myreport.htm:
nblookup /ql in-nblookup.txt /qr myreport

Input File

After you have identified all the WINS servers and all the WINS records that are important in your environment, you can write your own customized NBLookup input files. You can then use these customized files with NBLookup and DNSLint to help you with administration, ongoing maintenance, and troubleshooting.

DNSLint is a tool for DNS troubleshooting. DNSLint also has a /ql (Query List) option. You can use NBLookup and DNSLint to quickly collect information about WINS and DNS records that are important in your environment.

NBLookup verifies the specified input file before using its contents to send WINS queries. NBLookup verifies the specified IP addresses to make sure that they are valid. NBLookup also verifies the validity of each field on each line. Comments that start with a semicolon (;) are ignored. Comments that start with a plus sign (+) are printed in the report. Typically, these comments are small (less than 500 characters).

After NBLookup has verified the input file, it starts to send the WINS queries that are listed in the input file to the WINS servers that are specified in the input file. If a destination WINS server does not respond to a query, NBLookup retries the query. If the WINS server does not respond again, NBLookup bypasses any other queries that are specified in the input file for that WINS server. This behavior avoids the delay that occurs if many WINS queries are sent to a server that is not responding. For example, if two queries to a WINS server time out two times, NBLookup does not send any other queries that are listed in the input file to that WINS server.

Input File Format

The input file has the following format:
NBLookup
[wins~server] 192.168.138.20
mydomain,1b 	
mydomain,1c 	
dc1,20,nr	
dc1,00 
host,*
The following table describes the elements of this input file.
Collapse this tableExpand this table
CodeDescriptionDetails
NBLookup- Used to specify that the file is an NBLookup input file- The first item that NBLookup tries to locate when it opens the input file
- Must appear at the top of the file
- If NBLookup is not the first word that the tool reads when it opens the file, NBLookup rejects the specified input file and generates an error
[wins~server] 192.168.138.20- Used to specify the IP address of a WINS server to send queries to- Must include [wins~server] and a valid IP address
- If either of these components is missing, NBLookup rejects the specified input file and generates an error
mydomain,1b and mydomain,1c- Used to specify the queries that NBLookup sends to the specified WINS server- Details appear in the "Query Format" section of this article

Query Format

The queries in the input file use the following syntax:
mydomain,1b
The first field in the line is the NetBIOS name to query. In this example, the name is mydomain. A comma must follow the NetBIOS name. No spaces are permitted on either side of the comma.

The second field follows the comma that appears immediately after the NetBIOS name to query. The second field is the type of record or the NetBIOS suffix (the 16th character) to query for. (For more information about common valid types, see the "Common Valid Record Types" table that appears later in this section.)

If the suffix that is specified is the asterisk character (*), NBLookup queries for the specified name by using the 00, the 20, and the 03 records in one command.

A comma always follows the type of record. No spaces are permitted on either side of the comma.

You may use an optional third field to turn recursion on or off. This field immediately follows the comma that appears after the second field. By default, recursion is on. To turn off recursion, append ,nr after the query type.

Nothing follows the third field. The first two fields are required and no spaces are permitted in the query line.

Note You can view the list of common valid record types by running one of the following commands:
  • In command-line mode: nblookup /suffix_help
  • In interactive mode: shelp or ?s

Common Valid Record Types

Collapse this tableExpand this table
NameNumber(h)TypeUsage
<computername>00UWorkstation service
<computername>01UMessenger service
<\--__MSBROWSE__>01GMaster Browser
<computername>03UMessenger service
<computername>06URemote Access Server service
<computername>1FUNetDDE service
<computername>20UFile Server service
<computername>21URemote Access Server client service
<computername>22UExchange Interchange (MSMail Connector)
<computername>23UExchange Store
<computername>24UExchange Directory
<computername>30UModem Sharing Server service
<computername>31UModem Sharing client service
<computername>43USMS Clients Remote Control
<computername>44USMS Administrators Remote Control Tool
<computername>45USMS Clients Remote Chat
<computername>46USMS Clients Remote Transfer
<computername>87UMicrosoft Exchange MTA
<computername>6AUMicrosoft Exchange IMC
<computername>BEUNetwork Monitor Agent
<computername>BFUNetwork Monitor Application
<username>03UMessenger service
<domain>00GDomain Name
<domain>1BUDomain Master Browser
<domain>1CGDomain Controllers
<domain>1DUMaster Browser
<domain>1EGBrowser Service Elections
<INet~Services>1CGIIS
<IS~computer name>00UIIS

NBLookup Comment Types

NBLookup supports two types of comments that use two different symbols:
  • The semicolon symbol (;) indicates a comment that NBLookup ignores. If you want to add a comment to the input file that is only visible when the input file is edited, add this type of comment.
  • The plus sign (+) indicates a comment that appears in the HTML report. If you want to add extra information to the report that makes the report easier to understand, use this type of comment.
The following sample input file contains both types of comments. This sample file is generated by running the nblookup /ql autocreate command.
NBLookup
;This is a sample NBLookup input file.
;This is the type of file that NBLookup reads when you specify the /ql option.
;This file must be in ANSI text format (use Notepad.exe).

;The first word in all NBLookup input files must be NBLookup,
;as you can see at the top of this sample file.

;A semicolon (;) indicates a comment that NBLookup ignores when it processes the file.

;A plus sign (+) indicates a comment that will appear in the HTML report
;and in the optional text report.
;Use this type of comment when you want to add additional information to the report
;to make it easier to understand

;This file is made up of three types of data:
;	1. WINS server (or servers) to query
;	2. WINS queries
;	3. Optional NetBIOS Scope ID

;[wins~server] 169.254.46.138
;This line specifies the IP address of a WINS server to send queries to
;[wins~server] must be specified, followed by a valid IP address.

;Later lines in the file indicate the queries to send to this server:
;server1,20
;host1,00,nr
;mydomain,1b
;mydomain,1c

;Format of queries:
;	first field = NetBIOS name to query
;	maximum of 15 valid characters

;	second field = type of record to query for
;	examples:  00, 20, 1B, 1C
;	run /suffix_help for a list of valid query types

;These two fields are required, they are delimited by using a comma.
; No spaces are permitted.
;	third field = disable recursion option
;	By default, NBLookup uses recursion.
;	You can send a query and request recursion.
;	example: nr

;This field is optional. If you use it, this field must follow the second field and a comma.

;[scopeid] 'my_scopeid'
;This line specifies the scope ID to use for all later queries.
;Replace my_scopeid with the scope ID that you want.
;Note: Scope IDs are case sensitive and must be between single quotation marks.
;[scopeid] ';reset'
;This line resets the scope ID for all later queries.
;Only use scope IDs in your queries if you use scope IDs in your environment.

[wins~server] 192.168.138.20

+This WINS server is named  wins1.cp.msft.net.

mydomain,1b 	;identifies PDC
mydomain,1c 	;identifies 20 PDCs

[scopeid] 'edmonton'	;set scope id to edmonton

dc1,20,nr	;file server service with no recursion
dc1,00  ;workstation service

[scopeid] ';reset' 	;Do not use a scope ID for the next query.
host,00  ;workstation service
The sample input file In-nblookup.txt is generated in the local directory. If the file already exists, NBLookup prompts you for permission to overwrite it.

To process the input file, run the following command at a command prompt:
nblookup /ql input.txt

NBLookup Usage Examples

If you verify a specified set of WINS records on multiple WINS servers, this information can help you to diagnose and to fix problems that missing or incorrect WINS records may have caused.

For example, if clients are experiencing problems when they try to log on to the domain, verify that the 1C records that the clients use to find domain controllers are available and are accurate. This information can help you determine if WINS is a cause of the problem.

Also, if you receive reports that users are having problems browsing the network by using NetBIOS browsing through Windows Explorer, this tool quickly verifies all the 1B records that are involved with NetBIOS browsing on the network on all the WINS servers that are supposed to have these records. Therefore, you can quickly determine if missing or incorrect WINS records may be related to the problem.

In another case, some users may be experiencing problems when they try to gain access to shares on servers by using the servers' names. However, the users can gain access to the shares by using the IP addresses. To determine whether name resolution is the problem, or to rule out name resolution as a possible cause, you must verify all the related WINS records on all the WINS servers that are used to resolve a server's name. The /ql (Query List) option that permits NBLookup to read instructions from the specified text file provides this functionality. After NBLookup has verified that the file is a valid NBLookup input file, it runs the queries that are specified in the file and then returns the results in an easy-to-read HTML report. Administrators can customize this input file to specify the WINS servers to query and to specify the WINS records to look for on each server.


REFERENCES

For additional information about the DNSLint tool, click the following article numbers to view the articles in the Microsoft Knowledge Base:
321045  (http://support.microsoft.com/kb/321045/ ) Description of the DNSLint Utility
330105  (http://support.microsoft.com/kb/330105/ ) How to verify large numbers of DNS records by using DNSLint

APPLIES TO
  • Microsoft Windows Server 2003, Standard Edition (32-bit x86)
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Datacenter Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows XP Professional
  • Microsoft Windows 2000 Server
  • Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
  • Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 4.0 Standard Edition
Keywords: 
kbdownload kbdownload kbwinservnetwork kbinfo KB830578
Share
Additional support options
Ask The Microsoft Small Business Support Community
Contact Microsoft Small Business Support
Find Microsoft Small Business Support Certified Partner
Find a Microsoft Store For In-Person Small Business Support