Notice: This website is an unofficial Microsoft Knowledge Base (hereinafter KB) archive and is intended to provide a reliable access to deleted content from Microsoft KB. All KB articles are owned by Microsoft Corporation. Read full disclaimer for more details.
NBLookup.exe command-line tool
NBLookup is a command line diagnostic tool that uses the User Datagram Protocol (UDP) to send NetBIOS name queries to Microsoft Windows Internet Naming Service (WINS) servers. NBLookup requires TCP/IP version 4 to run. WINS servers accept name resolution requests on UDP port 137.
NBLookup runs on the following operating systems:
The following file is available for download from the Microsoft Download Center:
Download the NBLookupV1.exe package now.
For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
NBLookup can be run in command-line mode, in interactive mode, and in query list mode. The following table contains the correct syntax for each mode.
back to the top
These return values can be useful in scripts.
To exit NBLookup before it has completed in command-line mode, press CTRL+C.
back to the top
The following table contains descriptions of the options that you can use with NBLookup in command-line mode.
back to the top
NBLookup starts a command shell that accepts a limited number of commands and parameter settings. You can use this mode to troubleshoot issues that require you to send the same queries repeatedly, although each repetition may use different parameter settings.
To exit NBLookup before it has completed in interactive mode, type quit or
exit, and then press ENTER. The program exits the command shell and the program ends.
back to the top
You can use the set OPTION=value option to set specified option values for NBLookup. The following table describes the option values that you can set by using the set option.
To view a list of query types that you can use with the set suffix=x option, type nblookup /suffix_help at a command prompt, and then press ENTER, or type shelp from within NBLookup.
back to the top
The greater-than (>) sign appears in the NBLookup interface as a prompt. To run any of the following commands, type the command at the > prompt, and then press ENTER:
back to the top
back to the top
DNSLint is a tool for DNS troubleshooting. DNSLint also has a /ql (Query List) option. You can use NBLookup and DNSLint to quickly collect information about WINS and DNS records that are important in your environment.
NBLookup verifies the specified input file before using its contents to send WINS queries. NBLookup verifies the specified IP addresses to make sure that they are valid. NBLookup also verifies the validity of each field on each line. Comments that start with a semicolon (;) are ignored. Comments that start with a plus sign (+) are printed in the report. Typically, these comments are small (less than 500 characters).
After NBLookup has verified the input file, it starts to send the WINS queries that are listed in the input file to the WINS servers that are specified in the input file. If a destination WINS server does not respond to a query, NBLookup retries the query. If the WINS server does not respond again, NBLookup bypasses any other queries that are specified in the input file for that WINS server. This behavior avoids the delay that occurs if many WINS queries are sent to a server that is not responding. For example, if two queries to a WINS server time out two times, NBLookup does not send any other queries that are listed in the input file to that WINS server.
back to the topThe following table describes the elements of this input file.
back to the top
The second field follows the comma that appears immediately after the NetBIOS name to query. The second field is the type of record or the NetBIOS suffix (the 16th character) to query for. (For more information about common valid types, see the "Common Valid Record Types" table that appears later in this section.)
If the suffix that is specified is the asterisk character (*), NBLookup queries for the specified name by using the 00, the 20, and the 03 records in one command.
A comma always follows the type of record. No spaces are permitted on either side of the comma.
You may use an optional third field to turn recursion on or off. This field immediately follows the comma that appears after the second field. By default, recursion is on. To turn off recursion, append ,nr after the query type.
Nothing follows the third field. The first two fields are required and no spaces are permitted in the query line.
Note You can view the list of common valid record types by running one of the following commands:
The sample input file In-nblookup.txt is generated in the local directory. If the file already exists, NBLookup prompts you for permission to overwrite it.
To process the input file, run the following command at a command prompt:
For example, if clients are experiencing problems when they try to log on to the domain, verify that the 1C records that the clients use to find domain controllers are available and are accurate. This information can help you determine if WINS is a cause of the problem.
Also, if you receive reports that users are having problems browsing the network by using NetBIOS browsing through Windows Explorer, this tool quickly verifies all the 1B records that are involved with NetBIOS browsing on the network on all the WINS servers that are supposed to have these records. Therefore, you can quickly determine if missing or incorrect WINS records may be related to the problem.
In another case, some users may be experiencing problems when they try to gain access to shares on servers by using the servers' names. However, the users can gain access to the shares by using the IP addresses. To determine whether name resolution is the problem, or to rule out name resolution as a possible cause, you must verify all the related WINS records on all the WINS servers that are used to resolve a server's name. The /ql (Query List) option that permits NBLookup to read instructions from the specified text file provides this functionality. After NBLookup has verified that the file is a valid NBLookup input file, it runs the queries that are specified in the file and then returns the results in an easy-to-read HTML report. Administrators can customize this input file to specify the WINS servers to query and to specify the WINS records to look for on each server.
back to the top
NBLookup runs on the following operating systems:
- Microsoft Windows NT 4.0
- Microsoft Windows 2000
- Microsoft Windows XP
- Microsoft Windows Server 2003
The following file is available for download from the Microsoft Download Center:
Download the NBLookupV1.exe package now.For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:
119591 How to Obtain Microsoft Support Files from Online Services
Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file. NBLookup can be run in command-line mode, in interactive mode, and in query list mode. The following table contains the correct syntax for each mode.
| Mode | Syntax |
| Command-Line | nblookup [-options] NetBIOS_Name_to_Query |
| Interactive | nblookup [-options] |
| Query List | nblookup -ql input_file [-qr report_file] |
back to the top
Command-Line Mode
You can use Command Line mode to send a single NetBIOS name query to a single WINS server. After the response appears, the program ends. The following table contains the possible return values for this query.| Return value | Description | Details |
| 0 | positive query response | If the name is resolved (if NBLookup returns an Internet Protocol (IP) address for the name), NBLookup returns a value of 0 and the exits. |
| 1 | negative name response | The name does not exist and cannot be resolved. |
| 99 | error | NBLookup experienced an error. |
These return values can be useful in scripts.
To exit NBLookup before it has completed in command-line mode, press CTRL+C.
back to the top
Command-Line Mode Options
Command line mode uses the following syntax:nblookup [-options]
NetBIOS_Name_to_Query
NetBIOS_Name_to_Query must be a valid NetBIOS name that has a maximum of 15 alphanumeric characters. This NetBIOS name cannot contain period (.) characters (dots) or any special characters such as ampersands (&) or percent signs (%).NetBIOS_Name_to_Query
The following table contains descriptions of the options that you can use with NBLookup in command-line mode.
| Option | Description | Details |
| /s | - Used to specify the WINS server to query | - Can be an IP address or a NetBIOS name - Default value is the local system's WINS server |
| /x | - Used to specify the NetBIOS suffix to query | - Must be a valid NetBIOS suffix - Must be in hexadecimal format - Default value is 20 (File Server service) - Examples: 00, 20, 1B, 1C |
| /suffix_help | - Used to display a list of common NetBIOS suffixes | - Cannot be used with any other option |
| /t | - Used to specify the timeout period for the query | - Valid range: 1 to 20 seconds - Example: /t 5 |
| /r | - Used to specify the number of queries (the number of retries that you want) | - Causes the query to retry if there is no response - Valid range: 1 to 20 - Example: /r 8 |
| /nr | - Used to specify no recursion for the query | - Turns off recursion - By default, queries use recursion |
| /i | - Used to specify the NetBIOS scope ID | - ID is appended to the NetBIOS name for the query - ID is case sensitive - Can be used only on networks that use scope IDs - Example: /i MyScopeId |
back to the top
Command-Line Mode Examples
The following example queries WINS server 169.254.1.10 for the File Server service that computer1 has registered:nblookup /s 169.254.1.10 computer1
The following example queries the WINS server that is named WINS1 for the domain controllers that are registered in the domain that is named DOMAIN1:nblookup /s WINS1 /x 1C DOMAIN1
back to the topInteractive Mode
This mode is similar to the interactive mode of the NSLookup tool.NBLookup starts a command shell that accepts a limited number of commands and parameter settings. You can use this mode to troubleshoot issues that require you to send the same queries repeatedly, although each repetition may use different parameter settings.
To exit NBLookup before it has completed in interactive mode, type quit or
exit, and then press ENTER. The program exits the command shell and the program ends.
back to the top
Interactive Mode Options
Interactive mode uses the following syntax:nblookup [-options]
The following table lists the options that are available in interactive mode.| Option | Description |
| help or ? | - Used to display information about common commands |
| shelp or ?s | - Used to display common NetBIOS suffixes (the 16th character) |
| NAME | - Used to query the default WINS server for the specified NetBIOS name |
| server NAME | - Used to set the default WINS server to the specified NetBIOS name or IP address |
| ipconfig | - Used to display the IP configuration of the local system; runs from inside the command shell |
| set OPTION=value | - Used to set specified option values |
You can use the set OPTION=value option to set specified option values for NBLookup. The following table describes the option values that you can set by using the set option.
| Option and value | Description | Details |
| set all | - Used to display the current option values | |
| set suffix=x | - Used to set the query type | - Examples: 00,20,03,1B,1C |
| set suffix=* | - Used to set query types 00, 20, and 03 in one command | |
| set type=x | - Used to set the query type | - Same as suffix=x - Examples: 00,20,03,1B,1C |
| set type=* | - Used to set query types 00, 20, and 03 in one command | - Same as suffix=* |
| set timeout=n | - Used to set the query timeout period in seconds | - Valid range: 1 to 20 |
| set retry=n | - Used to set the number of query retries | - Valid range: 1 to 20 |
| set norecurse | - Used to turn off recursion | - By default, recursion is on |
| set recurse | - Used to turn on recursion | - By default, recursion is on |
| set id=x | - Used to set the NetBIOS scope ID for the query | - Can use any alphanumeric scope ID - Required only if scope IDs are used in the environment - Can be used to reset the scope ID by running set id= |
To view a list of query types that you can use with the set suffix=x option, type nblookup /suffix_help at a command prompt, and then press ENTER, or type shelp from within NBLookup.
back to the top
Interactive Mode Examples
To use NBLookup in interactive mode, type the following command at a command prompt, and then press ENTER:path\NBLookup.exe
Note In this example, path is the path of the NBLookup.exe file on your computer.The greater-than (>) sign appears in the NBLookup interface as a prompt. To run any of the following commands, type the command at the > prompt, and then press ENTER:
- The following command lists the IP address of the default WINS server:SERVER
- The following command sets the query type to 1B (Master Browser):set type=1B
- The following command queries the default WINS server for master browsers in the domain. In this example, the domain is named TESTDOMAIN. testdomainWhen you run this command, NBLookup displays output that is similar to the following:
Note In this example, 157.54.5.150 is the IP address of the master browser in the TESTDOMAIN domain.
Recursion is on
Querying WINS Server: 157.55.253.218
NetBIOS Name: testdomain
Suffix: 1B
Name returned: TESTDOMAIN
Record type: Unique
IP Address: 157.54.5.150
- The following command sets the query type to Workstation Service (00), to Messenger Service (03), and to File Server Service (20):set type=*
- The following command displays the current option values:set all
- The following command queries the default WINS server for the Workstation Service, for the Messenger Service, and for the File Server Service that are registered with the computer that is named MYSERVER:MYSERVER
Query List Mode
Query list mode uses the following syntax:nblookup -ql input_file [-qr report_file]
Query List Mode uses an input file to specify the parameters of WINS queries. back to the top
Query List Mode Options
The following table lists the options that are available in query list mode.| Option | Description | Details |
| /ql | - Used to run NBLookup in query list mode | - Sends WINS queries that are specified in a text input file - Must specify the path and the name of the input file - Cannot be used with command-line mode options |
| /qr | - Used to specify the name of the report file to create when you use /ql | - Used only with the /ql option - Cannot be used with command-line mode options - Must specify the path and the name of the report file - Automatically appends the .htm extension to the specified file name - By default, the report file name is Nblookup.htm |
| /ql | - Used to create a sample input file that is named In-nblookup.txt | - Cannot be used with any other options - The autocreate command |
| /y | - Used to overwrite the existing report file without prompting | - Cannot be used with command-line mode options - Useful in scripts |
back to the top
Query List Mode Examples
The following command builds a sample input file that is named In-nblookup.txt:nblookup /ql
The following command runs queries that are specified in the input file that is named In-nblookup.txt. The command then creates a report that is named Myreport.htm:nblookup /ql in-nblookup.txt /qr myreport
back to the topInput File
After you have identified all the WINS servers and all the WINS records that are important in your environment, you can write your own customized NBLookup input files. You can then use these customized files with NBLookup and DNSLint to help you with administration, ongoing maintenance, and troubleshooting.DNSLint is a tool for DNS troubleshooting. DNSLint also has a /ql (Query List) option. You can use NBLookup and DNSLint to quickly collect information about WINS and DNS records that are important in your environment.
NBLookup verifies the specified input file before using its contents to send WINS queries. NBLookup verifies the specified IP addresses to make sure that they are valid. NBLookup also verifies the validity of each field on each line. Comments that start with a semicolon (;) are ignored. Comments that start with a plus sign (+) are printed in the report. Typically, these comments are small (less than 500 characters).
After NBLookup has verified the input file, it starts to send the WINS queries that are listed in the input file to the WINS servers that are specified in the input file. If a destination WINS server does not respond to a query, NBLookup retries the query. If the WINS server does not respond again, NBLookup bypasses any other queries that are specified in the input file for that WINS server. This behavior avoids the delay that occurs if many WINS queries are sent to a server that is not responding. For example, if two queries to a WINS server time out two times, NBLookup does not send any other queries that are listed in the input file to that WINS server.
back to the top
Input File Format
The input file has the following format:NBLookup
[wins~server] 192.168.138.20
mydomain,1b
mydomain,1c
dc1,20,nr
dc1,00
host,*
| Code | Description | Details |
| NBLookup | - Used to specify that the file is an NBLookup input file | - The first item that NBLookup tries to locate when it opens the input file - Must appear at the top of the file - If NBLookup is not the first word that the tool reads when it opens the file, NBLookup rejects the specified input file and generates an error |
| [wins~server] 192.168.138.20 | - Used to specify the IP address of a WINS server to send queries to | - Must include [wins~server] and a valid IP address - If either of these components is missing, NBLookup rejects the specified input file and generates an error |
| mydomain,1b and mydomain,1c | - Used to specify the queries that NBLookup sends to the specified WINS server | - Details appear in the "Query Format" section of this article |
back to the top
Query Format
The queries in the input file use the following syntax:mydomain,1b
The first field in the line is the NetBIOS name to query. In this example, the name is mydomain. A comma must follow the NetBIOS name. No spaces are permitted on either side of the comma.The second field follows the comma that appears immediately after the NetBIOS name to query. The second field is the type of record or the NetBIOS suffix (the 16th character) to query for. (For more information about common valid types, see the "Common Valid Record Types" table that appears later in this section.)
If the suffix that is specified is the asterisk character (*), NBLookup queries for the specified name by using the 00, the 20, and the 03 records in one command.
A comma always follows the type of record. No spaces are permitted on either side of the comma.
You may use an optional third field to turn recursion on or off. This field immediately follows the comma that appears after the second field. By default, recursion is on. To turn off recursion, append ,nr after the query type.
Nothing follows the third field. The first two fields are required and no spaces are permitted in the query line.
Note You can view the list of common valid record types by running one of the following commands:
- In command-line mode: nblookup /suffix_help
- In interactive mode: shelp or
?s
Common Valid Record Types
| Name | Number(h) | Type | Usage |
| <computername> | 00 | U | Workstation service |
| <computername> | 01 | U | Messenger service |
| <\--__MSBROWSE__> | 01 | G | Master Browser |
| <computername> | 03 | U | Messenger service |
| <computername> | 06 | U | Remote Access Server service |
| <computername> | 1F | U | NetDDE service |
| <computername> | 20 | U | File Server service |
| <computername> | 21 | U | Remote Access Server client service |
| <computername> | 22 | U | Exchange Interchange (MSMail Connector) |
| <computername> | 23 | U | Exchange Store |
| <computername> | 24 | U | Exchange Directory |
| <computername> | 30 | U | Modem Sharing Server service |
| <computername> | 31 | U | Modem Sharing client service |
| <computername> | 43 | U | SMS Clients Remote Control |
| <computername> | 44 | U | SMS Administrators Remote Control Tool |
| <computername> | 45 | U | SMS Clients Remote Chat |
| <computername> | 46 | U | SMS Clients Remote Transfer |
| <computername> | 87 | U | Microsoft Exchange MTA |
| <computername> | 6A | U | Microsoft Exchange IMC |
| <computername> | BE | U | Network Monitor Agent |
| <computername> | BF | U | Network Monitor Application |
| <username> | 03 | U | Messenger service |
| <domain> | 00 | G | Domain Name |
| <domain> | 1B | U | Domain Master Browser |
| <domain> | 1C | G | Domain Controllers |
| <domain> | 1D | U | Master Browser |
| <domain> | 1E | G | Browser Service Elections |
| <INet~Services> | 1C | G | IIS |
| <IS~computer name> | 00 | U | IIS |
NBLookup Comment Types
NBLookup supports two types of comments that use two different symbols:- The semicolon symbol (;) indicates a comment that NBLookup ignores. If you want to add a comment to the input file that is only visible when the input file is edited, add this type of comment.
- The plus sign (+) indicates a comment that appears in the HTML report. If you want to add extra information to the report that makes the report easier to understand, use this type of comment.
NBLookup
;This is a sample NBLookup input file.
;This is the type of file that NBLookup reads when you specify the /ql option.
;This file must be in ANSI text format (use Notepad.exe).
;The first word in all NBLookup input files must be NBLookup,
;as you can see at the top of this sample file.
;A semicolon (;) indicates a comment that NBLookup ignores when it processes the file.
;A plus sign (+) indicates a comment that will appear in the HTML report
;and in the optional text report.
;Use this type of comment when you want to add additional information to the report
;to make it easier to understand
;This file is made up of three types of data:
;1. WINS server (or servers) to query
;2. WINS queries
;3. Optional NetBIOS Scope ID
;[wins~server] 169.254.46.138
;This line specifies the IP address of a WINS server to send queries to
;[wins~server] must be specified, followed by a valid IP address.
;Later lines in the file indicate the queries to send to this server:
;server1,20
;host1,00,nr
;mydomain,1b
;mydomain,1c
;Format of queries:
;first field = NetBIOS name to query
;maximum of 15 valid characters
;second field = type of record to query for
;examples: 00, 20, 1B, 1C
;run /suffix_help for a list of valid query types
;These two fields are required, they are delimited by using a comma.
; No spaces are permitted.
;third field = disable recursion option
;By default, NBLookup uses recursion.
;You can send a query and request recursion.
;example: nr
;This field is optional. If you use it, this field must follow the second field and a comma.
;[scopeid] 'my_scopeid'
;This line specifies the scope ID to use for all later queries.
;Replace my_scopeid with the scope ID that you want.
;Note: Scope IDs are case sensitive and must be between single quotation marks.
;[scopeid] ';reset'
;This line resets the scope ID for all later queries.
;Only use scope IDs in your queries if you use scope IDs in your environment.
[wins~server] 192.168.138.20
+This WINS server is named wins1.cp.msft.net.
mydomain,1b ;identifies PDC
mydomain,1c ;identifies 20 PDCs
[scopeid] 'edmonton';set scope id to edmonton
dc1,20,nr;file server service with no recursion
dc1,00 ;workstation service
[scopeid] ';reset' ;Do not use a scope ID for the next query.
host,00 ;workstation serviceTo process the input file, run the following command at a command prompt:
nblookup /ql input.txt
back to the topNBLookup Usage Examples
If you verify a specified set of WINS records on multiple WINS servers, this information can help you to diagnose and to fix problems that missing or incorrect WINS records may have caused.For example, if clients are experiencing problems when they try to log on to the domain, verify that the 1C records that the clients use to find domain controllers are available and are accurate. This information can help you determine if WINS is a cause of the problem.
Also, if you receive reports that users are having problems browsing the network by using NetBIOS browsing through Windows Explorer, this tool quickly verifies all the 1B records that are involved with NetBIOS browsing on the network on all the WINS servers that are supposed to have these records. Therefore, you can quickly determine if missing or incorrect WINS records may be related to the problem.
In another case, some users may be experiencing problems when they try to gain access to shares on servers by using the servers' names. However, the users can gain access to the shares by using the IP addresses. To determine whether name resolution is the problem, or to rule out name resolution as a possible cause, you must verify all the related WINS records on all the WINS servers that are used to resolve a server's name. The /ql (Query List) option that permits NBLookup to read instructions from the specified text file provides this functionality. After NBLookup has verified that the file is a valid NBLookup input file, it runs the queries that are specified in the file and then returns the results in an easy-to-read HTML report. Administrators can customize this input file to specify the WINS servers to query and to specify the WINS records to look for on each server.
back to the top
For additional information about the DNSLint tool, click the following article numbers to view the articles in the Microsoft Knowledge Base: back to the top
Keywords: kb, kbinfo, ocsentirenet, kbwinservnetwork, kbdownload