Netbios Suffix problem

Posted on 2004-10-27
Last Modified: 2008-03-17
I have a strange entry in nbtstat -n.

"insert-computer-name"    <2D>    UNIQUE     REGISTERED

My question is, what is the usage of the 2D suffix? Ive never seen this one before and it might shed some light on a problem we have been having lately.
Question by:xtremeadmin
    LVL 3

    Expert Comment

    Do you have any linux or unix hosts on your network? They give false suffixes sometimes with netbios. What is the issue you are having?
    LVL 9

    Expert Comment

    And this is 2D and not 20, right?

    Author Comment

    Yes, it is a "2D" and not a "20".

    The computer name this entry describes is the name of a windows workstation. Specifically, it WAS the name of a workstation before it was renamed a few days ago. We are kind of curious as to why this old name would still be appearing in the local name table after the machine had beeen renamed. I thought that finding out what the "2D" meant would shed some light on this.
    LVL 9

    Expert Comment

    OK, just making sure
    does this still show up if you do nbtstat -RR since the name has been changed?
    I'll see if I can find anything on <2D>

    Author Comment

    Yes we have purged the local workstation as well as deleted the old entries from WINS but the 2D entry still appears on the local machine with the old machine name.
    LVL 9

    Expert Comment

    I can't find anything.
    On the local machine, try locating any NON standard services running and stop them one at a time and running the -RR then -n. Maybe when one get's killed it will cease and you'll know what service. The usuals, as you know, like messenger etc, are not 2D, so there must be some service that is registering itself.

    Very interesting
    LVL 9

    Accepted Solution

    Here is a list of MS's common ones, so stopping any of these won't be needed.

    Name                  Number            Type            Usage
    [computername]      00            U            Workstation Service
    [computername]      01            U            Messenger Service
    [\\_MSBROWSE_]      01            G            Master Browser
    [computername]      03            U            Messenger Service
    [computername]      06            U            RAS Server Service
    [computername]      1F            U            NetDDE Service
    [computername]      20            U            File Server Service
    [computername]      21            U            RAS Client Service
    [computername]      22            U            Exchange Interchange
    [computername]      23            U            Exchange Store
    [computername]      24            U            Exchange Directory
    [computername]      30            U            Modem Sharing Server Service
    [computername]      31            U            Modem Sharing Client Service
    [computername]      43            U            SMS Client Remote Control
    [computername]      44            U            SMS Admin Remote Control Tool
    [computername]      45            U            SMS Client Remote Chat
    [computername]      46            U            SMS Client Remote Transfer
    [computername]      4C            U            DEC Pathworks TCPIP Service
    [computername]      52            U            DEC Pathworks TCPIP Service
    [computername]      87            U            Exchange MTA
    [computername]      6A            U            Exchange IMC
    [computername]      BE            U            Network Monitor Agent
    [computername]      BF            U            Network Monitor Apps
    [username]            03            U            Messenger Service
    [domain]            00            G            Domain Name
    [domain]            1B            U            Domain Master Browser
    [domain]            1C            G            Domain Controllers
    [domain]            1D            U             Master Browser
    [domain]            1E            G            Browser Service Elections
    [Net~Services]      1C            G            Internet Information Server
    [S~Computer_name]00            U            Internet Information Server
    [computername]      [2B]            U            Lotus Notes Server
    IRISMULTICAST      [2F]            G            Lotus Notes
    IRISNAMESERVER      [33]            G            Lotus Notes
    Forte_$ND800ZA      [20]            U            DCA Irmalan Gateway Service

    Author Comment

    If anyone was interested, it turned out to be the "Symantec Ghost Configuration Server." Thanks for the lead TannerMan.
    LVL 9

    Expert Comment

    Outstanding !!!
    Just glad it worked out buddy.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    What is IRC? IRC (Internet Relay Chat) is a form of communication between multiple users. It is available freely to anyone with inernet access. IRC is a great way to communicate with others e.g. There is an IRC channel for Ubuntu Linux, which is fo…
    If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
    Here's a very brief overview of the methods PRTG Network Monitor ( offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
    This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor ( If you're looking for how to monitor bandwidth using netflow or packet s…

    737 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now