Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 3897
  • Last Modified:


do the following commands need to be run remotely or locally (at the console of the computer we are troubleshooting)?


  • 4
  • 2
  • 2
  • +2
4 Solutions
www.SystemInternals.com has some programs for free download that will allow you to run things like this remotely.  

psexec.exe is one of them.
NBTSTAT normally will be used on the machine locally
NBTSTAT -a (remotename) will allow you to use it for another machine on your network/domain (local/remote)

NETSTAT is meant for the machine you are testing it on (local)

ARP is meant for the machine you are testing it on (local since the tables you're looking up show cached IP addresses for the local machine)
Rob WilliamsCommented:
You can run locally or make queries of a remote machine depending on the options/switches you choose. You can get a description of each by running at a command line the command and "?" such as  netstat ? Make note though that the switches are case sensitive in some cases.
eg.  nbtstat  -A
which would list the remote machines NetBIOS name table.
Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

normally i run these commands ni the command line while logged in with a remote viewing software like UltraVNC.
Here is what each of these do.

NBTSTAT will tell you the NETbios information of a PC.
It can be used with IP address of local machine or remote machine.

NETSTAT will tell you IP information of local PC.
When you run it from command prompt, it will tell you all the ports and their states they are in. e.g Listening, Established.

ARP will tell you the MAC address of all the machines you have contacted.
When you setup a session to a remote machine or if someone setup a session to your machine, he needs to know your MAC address if he is in same subnet as you are. (ARP works on layer 2)

But if he is reaching you thru a router then arp will not show the mac of remote machine. Then you can use NETSTAT to see the IP of remote machine who is connected to you. Similarly if remote machine is using NETBIOS and not TCP/IP then you can user NBTSTAT to see who is connected to you or vice versa.

jskfanAuthor Commented:
when I run:

NBTSTAT  -a computername

it gives me some info such as  

what does that mean?

Rob WilliamsCommented:
The number actually tells you more, in conjunction with the name.

<1c> A domain group name which is registered by the domain controller containing a list of computers which have registered this name
<1d> Master browser name used by client to access the master browser (possibly a local master browser)
<1e> Normal group name used in the election of browse masters
<20> Internet group used to identify a group of machine for administrative purposes
MSBROWSE   Appended to the domain name and broadcast to announce to domain to other master browsers

<00> Commonly referred to as the NetBIOS name, this byte refers to the Workstation service name
<03> Messenger service name used for sending and receiving messages
<06> RAS server service
<1b> Domain master browser name used by a machine to contact a domain's Primary Domain Controller
<1f> NetDDE service
<20> Server service name to provide file sharing access points
<21> RAS client
<be> Network Monitor Agent
<bf>  Network Monitor utility

from: http://freebooks.by.ru/view/SambaIn24h/ch02.htm
See that site "Listing 2.1 for a more detailed explanation
jskfanAuthor Commented:
Sorry that's still confusing. when I run it I get :

COMPUTER1                        <00>  UNIQUE    REGISTRED
COMPUTER1                         <20> UNIQUE   RESGISTRED
INet~Services                       <1C> GROUP   RESGISTRED
IS~COMPUTER1....................<00> UNIQUE  RESGISTRED

what all that means?

Rob WilliamsCommented:
All refer to the computer referenced in the command;

COMPUTER1                        <00>  UNIQUE   NetBIOS name of the computer
DOMAINNETBIOSNAME          <00> GROUP    NetBIOS domain name  (mydomain instead of DNS mydomain.abc)
COMPUTER1                         <20> UNIQUE   Computer offers file sharing services
INet~Services                       <1C> GROUP    NetBIOS computer name registered in DNS
IS~COMPUTER1....................<00> UNIQUE   another NetBIOS name registered for the same computer
DOMAINNETBIOSNAME           <1E> GROUP   NetBIOS computer name used by the master browser
MAC ADDRESS = XX-XX-XX-XX-XX-XX          MAC address of the computer

I know it is confusing and it appears there is a lot of duplication. Most often it is just used to confirm NetBIOS computer and domain names, MAC address, and whether it is the master browser or not. This system is not the master browser. It would show; "   ..__MSBROWSE__.<01>  GROUP       Registered " if it was
>COMPUTER1                        <00>  UNIQUE    REGISTRED

This tells your computers NETBIOS name and is unique.


This tells your domains NETBIOS name and is a group.

>COMPUTER1                         <20> UNIQUE   RESGISTRED

This is the name which other computers uses to access shared files on your computer.

What you need to understand that unlike TCP/IP which uses ports to provide services. NETBIOS uses pipes.

Rob WilliamsCommented:
Thanks jskfan,

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 4
  • 2
  • 2
  • +2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now