Querying NetBIOS Names

You can use this example to query for a NetBIOS name. If you specify a host, it will perform a unicast query; if you don't specify a host, it will perform a broadcast query. I've used the shorthand of specifying the name as <name>#<suffix> where the suffix should be in hex.

"namequery.pl spark#0"

"namequery.pl spark#20 192.168.0.10"

    use strict;
    use Net::NBName;
    my $nb = Net::NBName->new;
    my $param = shift;
    my $host = shift;
    if ($param =~ /^([\w-]+)\#(\w{1,2})$/) {
        my $name = $1;
        my $suffix = hex $2;
        my $nq;
        if (defined($host) && $host =~ /\d+\.\d+\.\d+\.\d+/) {
            printf "querying %s for %s<%02X>...\n", $host, $name, $suffix;
            $nq = $nb->name_query($host, $name, $suffix);
        } else {
            printf "broadcasting for %s<%02X>...\n", $name, $suffix;
            $nq = $nb->name_query(undef, $name, $suffix);
        }
        if ($nq) {
            print $nq->as_string;
        }
    } else {
        die "expected: <name>#<suffix> [<host>]\n";
    }

Querying Remote Name Table

This example emulates the windows nbtstat -A command. By specifying the ip address of the remote host, you can check its NetBIOS Name Table.

"nodestat.pl 192.168.0.10"

    use Net::NBName;
    my $nb = Net::NBName->new;
    my $host = shift;
    if (defined($host) && $host =~ /\d+\.\d+\.\d+\.\d+/) {
        my $ns = $nb->node_status($host);
        if ($ns) {
            print $ns->as_string;
        } else {
            print "no response\n";
        }
    } else {
        die "expected: <host>\n";
    }

Scanning for NetBIOS hosts

This example can be used to scan for NetBIOS hosts on a subnet. It uses Net::Netmask to parse the subnet parameter and enumerate the hosts in that subnet.

"nodescan.pl 192.168.0.0/24"

    use Net::NBName;
    use Net::Netmask;
    $mask = shift or die "expected: <subnet>\n";
    $nb = Net::NBName->new;
    $subnet = Net::Netmask->new2($mask);
    for $ip ($subnet->enumerate) {
        print "$ip ";
        $ns = $nb->node_status($ip);
        if ($ns) {
            for my $rr ($ns->names) {
                if ($rr->suffix == 0 && $rr->G eq "GROUP") {
                    $domain = $rr->name;
                }
                if ($rr->suffix == 3 && $rr->G eq "UNIQUE") {
                    $user = $rr->name;
                }
                if ($rr->suffix == 0 && $rr->G eq "UNIQUE") {
                    $machine = $rr->name unless $rr->name =~ /^IS~/;
                }
            }
            $mac_address = $ns->mac_address;
            print "$mac_address $domain\\$machine $user";
        }
        print "\n";
    }

Microsoft's WINS Server Implementation

When performing name queries, you should note that when Microsoft implemented their NBNS Name Server (Microsoft WINS Server) they mapped group names to the single IP address 255.255.255.255 (the limited broadcast address). In order to support real group names, Microsoft modified WINS to provide support for special groups. These groups appear differently in WINS. For example, the Domain Controllers (0x1C) group appears as "Domain Name" instead of "Group".

The complete set of WINS mapping types is:

    Unique
    Group
    Domain Name
    Internet group
    Multihomed

Unique and Group map to a single IP address. Domain Name, Internet group, and Multihomed are special groups that can include up to 25 IP addresses.

Hacking Name Query Flags

NetBIOS Name Service Requests have a number of flags associated with them. These are set to sensible defaults by the code when sending node status and name query requests.

However, it is possible to override these settings by calling the name_query method of a "Net::NBName" object with a fourth parameter:

    $nb->name_query( $host, $name, $suffix, $flags );

For a unicast name query, the flags default to 0x0100 which sets the RD (recursion desired) flag. For a broadcast name query, the flags default to 0x0010 which sets the B (broadcast) flag.

Experimentation gave the following results:

• If B is set, the remote name table will be used. There will be no response if the queried name is not present.
• If B is not set and the host is an NBNS server, the NBNS server will be used before the remote name table and you will get a negative response if the name is not present; if the host is not an NBNS server, you will get no response if the name is not present.