Solved

nbtstat -r to show resolved name by Netbios broadcast

Posted on 2013-06-06
14
1,732 Views
Last Modified: 2013-06-07
I'm trying to understand how Netbios broadcast resolves hostname to IP, then where it saves in cache and how to see the cache table.

I used nbtstat -r to see the cache table of already resolved hostname by a local machine.

First, it doesn't list IP address of the resolved hostnames.

Second, after I just simply pinged hostname 'xxxx', then ran nbtstat -r to see if the local machine put the resolved name-ip pair in its cache, but it's not there.

Is Netbios something we just assume it works and don't have to know about it? Or is there any way to see the cache table with resolved hostname-IP pair and if it really updates
0
Comment
Question by:crcsupport
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 4
  • 2
  • +1
14 Comments
 
LVL 30

Assisted Solution

by:Rich Weissler
Rich Weissler earned 370 total points
ID: 39228780
Usually to see the cache table, I'd use nbtstat -c, rather than nbtstat -r.  But it's been a while since I've relied on Netbios.  I believe the recommendation has been to move towards DNS.

But to get a better look into the addresses, I'd be tempted to look at a tool like the NetBIOS Browsing Console.
0
 
LVL 17

Assisted Solution

by:surbabu140977
surbabu140977 earned 75 total points
ID: 39228797
Try nbtstat -c and not -r.

Here is the proper syntax of nbtstat. You have to use proper syntax to see the right results.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/nbtstat.mspx?mfr=true

Best,
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39228841
I used all 'display switch', but none of them shows the name-ip pair in cache. I again pinged hostname and checked, still empty table.



C:\Users\user1>nbtstat -c

VirtualBox Host-Only Network:
Node IpAddress: [192.168.56.1] Scope Id: []

    No names in cache

Local Area Connection 2:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache

Local Area Connection:
Node IpAddress: [192.168.1.120] Scope Id: []

    No names in cache

Bluetooth Network Connection:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache

C:\Users\user1>ping pdc_Serv

Pinging xxxserv.CRCCORP.LOCAL [192.168.1.11] with 32 bytes of data:
Reply from 192.168.1.11: bytes=32 time<1ms TTL=128
Reply from 192.168.1.11: bytes=32 time<1ms TTL=128
Reply from 192.168.1.11: bytes=32 time<1ms TTL=128
Reply from 192.168.1.11: bytes=32 time<1ms TTL=128

Ping statistics for 192.168.1.11:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 0ms, Average = 0ms

C:\Users\user1>nbtstat -c

VirtualBox Host-Only Network:
Node IpAddress: [192.168.56.1] Scope Id: []

    No names in cache

Local Area Connection 2:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache

Local Area Connection:
Node IpAddress: [192.168.1.120] Scope Id: []

    No names in cache

Bluetooth Network Connection:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache

C:\Users\user1>
0
Instantly Create Instructional Tutorials

Contextual Guidance at the moment of need helps your employees adopt to new software or processes instantly. Boost knowledge retention and employee engagement step-by-step with one easy solution.

 
LVL 17

Assisted Solution

by:surbabu140977
surbabu140977 earned 75 total points
ID: 39228898
Will you try uninstalling tcp/ip, netbios, NIC card driver, client for microsoft networks and then try installing back to see if the problem is solved? This is at per my windows admin who claims might solve the issue. : )
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229051
I don't have problem now. I had switch problem two days ago. I was using nbtstat to see what the problem is but, it didn't help much. So I was wondering why nbtstat doesn't give any information I expected.
I started reading at the browstat.exe to see if it can show me more about the netbios status.
0
 
LVL 30

Assisted Solution

by:Rich Weissler
Rich Weissler earned 370 total points
ID: 39229107
I apologize if I missed it, but are you certain your ping's are causing a dns name resolution rather than net bios?  (does 'ipconfig /displaydns' show you the server in cache?)
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229251
Razmus, you're right. I didnt' pay attention to the ping result. Actually it converts my ping to hostname to hostname.domain-name.com. I checked ipconfig /displaydns, it shows the updated cache with the result.

Why does ping to netbios name is converted to dns name?
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229260
that's because there's setting at NIC 'Append parent suffix of the primary DNS suffix' ?
0
 
LVL 30

Accepted Solution

by:
Rich Weissler earned 370 total points
ID: 39229312
Yes, exactly that.. .  Windows will attempt DNS before falling back to netbios name resolution.  (And it'll use local host tables before either.)  It'll try your primary dns suffix, as well as any other suffixes configured in your search list.
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229444
I played around it. Instead our domain suffix, I forced to append to 'dummy.com'.  Then I pinged 'xxx_Serv'. This is what happened below. it appended 'dummy.com' to the host name, then it returned successful response with some unknown ip address.

But I didn't have any problem browsing to the shared folder of the server, then I guessed maybe the pc used pure Netbios to contact the server, so I used 'nbtstat -c' to see what shows in cache, there it goes, it shows now the server-ip pair of the server. And 'ipconfig /displaydns'  shows empty.

Looks like Windows PC wants to use DNS instead of NetBios, then NetBios is the backup to communicate.

==========================
C:\Users\user1>ipconfig /flushdns

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\user1>ipconfig /displaydns

Windows IP Configuration

Could not display the DNS Resolver Cache.

C:\Users\user1>ping xxxx_Serv

Pinging xxxx_Serv.dummy.com [198.202.143.20] with 32 bytes of data:
Reply from 198.202.143.20: bytes=32 time=77ms TTL=53
Reply from 198.202.143.20: bytes=32 time=77ms TTL=53
Reply from 198.202.143.20: bytes=32 time=77ms TTL=53
Reply from 198.202.143.20: bytes=32 time=77ms TTL=53

Ping statistics for 198.202.143.20:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 77ms, Maximum = 77ms, Average = 77ms

C:\Users\user1>ipconfig /displaydns

Windows IP Configuration


C:\Users\user1>



C:\Users\user1>nbtstat -c

VirtualBox Host-Only Network:
Node IpAddress: [192.168.56.1] Scope Id: []

    No names in cache

Local Area Connection 2:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache

Local Area Connection:
Node IpAddress: [192.168.1.120] Scope Id: []

                  NetBIOS Remote Cache Name Table

        Name              Type       Host Address    Life [sec]
    ------------------------------------------------------------
    XXXXXX <20>  UNIQUE          192.168.1.12        507
    XXXX_SERV    <20>  UNIQUE          192.168.1.14        505
    XXXXXX <20>  UNIQUE          192.168.1.28        355

Bluetooth Network Connection:
Node IpAddress: [0.0.0.0] Scope Id: []

    No names in cache
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229448
weird thing, 198.202.143.20 shows as an outside unknown host 'landings.lax.trafficz.com'.

I don't know why it pings this address when DNS fully qualified name is invalid. lol???
0
 
LVL 30

Assisted Solution

by:Rich Weissler
Rich Weissler earned 370 total points
ID: 39229468
I suspect landings.lax.trafficz.com is either a destination for an advertisement you hit, or some other software on your machine that's 'calling home.'
0
 
LVL 42

Assisted Solution

by:kevinhsieh
kevinhsieh earned 55 total points
ID: 39229477
When you ping, that is an IP operation, and it   doesn't touch the netbios stack. If you want to activate netbios, you need to run a netbios command such as net view \\machine
0
 
LVL 1

Author Comment

by:crcsupport
ID: 39229495
Kevin, I also noticed that too during the test. I initiated netbios connection by UNC path browsing to shared folder.

Thank you guys all, now I feel I am more equipped to troubleshoot next time.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Meet the world's only “Transparent Cloud™” from Superb Internet Corporation. Now, you can experience firsthand a cloud platform that consistently outperforms Amazon Web Services (AWS), IBM’s Softlayer, and Microsoft’s Azure when it comes to CPU and …
When you try to share a printer , you may receive one of the following error messages. Error message when you use the Add Printer Wizard to share a printer: Windows could not share your printer. Operation could not be completed (Error 0x000006…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question