> For the complete documentation index, see [llms.txt](https://www.impacket.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.impacket.wiki/reference/library-api/smb-and-netbios/nmb.md).

# NetBIOS/NMB

> NetBIOS Name Service implementation for name resolution and node status queries

## Overview

The `nmb` module provides a complete implementation of the NetBIOS Name Service (NBNS) protocol. It enables NetBIOS name resolution, node status queries, and NetBIOS session management over TCP and UDP.

## Key Classes

### NetBIOS

Main class for NetBIOS Name Service operations.

```python
from impacket import nmb

nb = nmb.NetBIOS()
response = nb.gethostbyname('WORKSTATION', timeout=1)
```

* **Parameter `servport`** **`int`:** NetBIOS Name Service port number

### Methods

#### gethostbyname()

Resolve a NetBIOS name to IP address.

```python
response = nb.gethostbyname(nbname, qtype=TYPE_WORKSTATION,
                             scope=None, timeout=1)
```

* **Parameter `nbname`** **`str`:** NetBIOS name to resolve
* **Parameter `qtype`** **`int`:** NetBIOS name type:
  * `TYPE_WORKSTATION` (0x00) - Workstation service
  * `TYPE_SERVER` (0x20) - File server service
  * `TYPE_DOMAIN_MASTER` (0x1B) - Domain master browser
  * `TYPE_DOMAIN_CONTROLLER` (0x1C) - Domain controller
  * `TYPE_MASTER_BROWSER` (0x1D) - Master browser
* **Parameter `scope`** **`str`:** NetBIOS scope identifier (rarely used)
* **Parameter `timeout`** **`int`:** Query timeout in seconds
* **Returns `return`** **`NBPositiveNameQueryResponse`:** Object containing IP addresses for the name

#### getnodestatus()

Query node status information.

```python
entries = nb.getnodestatus(nbname, destaddr=None,
                            type=TYPE_WORKSTATION,
                            scope=None, timeout=1)
```

* **Parameter `nbname`** **`str`:** NetBIOS name to query (use `'*'` for any name)
* **Parameter `destaddr`** **`str`:** IP address to send query to. If `None`, uses broadcast or nameserver.
* **Parameter `type`** **`int`:** NetBIOS name type
* **Parameter `scope`** **`str`:** NetBIOS scope
* **Parameter `timeout`** **`int`:** Query timeout in seconds
* **Returns `return`** **`list[NODE_NAME_ENTRY]`:** List of NetBIOS name entries registered by the node

#### getnetbiosname()

Get the NetBIOS name for an IP address.

```python
name = nb.getnetbiosname(ip)
```

* **Parameter `ip`** **`str`:** IP address to query
* **Returns `return`** **`str`:** NetBIOS name of the server type (0x20)

#### getmacaddress()

Get MAC address from last node status query.

```python
mac = nb.getmacaddress()
```

* **Returns `return`** **`str`:** MAC address in format `'AA-BB-CC-DD-EE-FF'`

#### set\_nameserver()

Set a specific NetBIOS nameserver.

```python
nb.set_nameserver('192.168.1.10')
```

* **Parameter `nameserver`** **`str`:** IP address of NetBIOS nameserver

#### set\_broadcastaddr()

Set the broadcast address for queries.

```python
nb.set_broadcastaddr('192.168.1.255')
```

* **Parameter `broadcastaddr`** **`str`:** Broadcast address

### NetBIOSTCPSession

TCP-based NetBIOS session for SMB communication.

```python
session = nmb.NetBIOSTCPSession(myname, remote_name, remote_host,
                                 remote_type=TYPE_SERVER,
                                 sess_port=139, timeout=60)
```

* **Parameter `myname`** **`str`:** Local NetBIOS name
* **Parameter `remote_name`** **`str`:** Remote NetBIOS name
* **Parameter `remote_host`** **`str`:** Remote IP address
* **Parameter `remote_type`** **`int`:** Remote NetBIOS name type
* **Parameter `sess_port`** **`int`:** Session port (139 for NetBIOS, 445 for direct SMB)
* **Parameter `timeout`** **`int`:** Connection timeout

#### send\_packet()

Send a NetBIOS session packet.

```python
session.send_packet(data)
```

* **Parameter `data`** **`bytes`:** Data to send

#### recv\_packet()

Receive a NetBIOS session packet.

```python
packet = session.recv_packet(timeout=None)
```

* **Parameter `timeout`** **`int`:** Receive timeout in seconds
* **Returns `return`** **`NetBIOSSessionPacket`:** Received packet

### NetBIOSUDPSession

UDP-based NetBIOS datagram service.

```python
session = nmb.NetBIOSUDPSession(myname, remote_name, remote_host,
                                 remote_type=TYPE_SERVER,
                                 sess_port=138)
```

## Constants

### Port Numbers

```python
NETBIOS_NS_PORT = 137         # Name Service
NETBIOS_SESSION_PORT = 139    # Session Service
SMB_SESSION_PORT = 445        # Direct SMB (no NetBIOS)
```

### Name Types

```python
TYPE_WORKSTATION = 0x00       # Workstation service
TYPE_CLIENT = 0x03            # Messenger service
TYPE_SERVER = 0x20            # File server service
TYPE_DOMAIN_MASTER = 0x1B     # Domain master browser
TYPE_DOMAIN_CONTROLLER = 0x1C # Domain controller
TYPE_MASTER_BROWSER = 0x1D    # Master browser
TYPE_BROWSER = 0x1E           # Browser service
TYPE_NETDDE = 0x1F            # NetDDE service
TYPE_STATUS = 0x21            # Node status
```

### Node Types

```python
NODE_B = 0x0000              # Broadcast node
NODE_P = 0x2000              # Point-to-point node
NODE_M = 0x4000              # Mixed node
NODE_GROUP = 0x8000          # Group name
NODE_UNIQUE = 0x0            # Unique name
```

## Supporting Classes

### NODE\_NAME\_ENTRY

Represents a NetBIOS name entry from node status.

* **Returns `NAME`** **`bytes`:** NetBIOS name (15 bytes)
* **Returns `TYPE`** **`int`:** Name type suffix (0x00, 0x20, etc.)
* **Returns `NAME_FLAGS`** **`int`:** Name flags (active, permanent, conflict, etc.)

### NBPositiveNameQueryResponse

Response from name query containing IP addresses.

```python
response = nb.gethostbyname('WORKSTATION')
for ip in response.entries:
    print(f"IP: {ip}")
```

* **Returns `entries`** **`list[str]`:** List of IP addresses

### NetBIOSSessionPacket

Represents a NetBIOS session packet.

* **Returns `get_type()`** **`int`:** Packet type (MESSAGE, REQUEST, RESPONSE, etc.)
* **Returns `get_trailer()`** **`bytes`:** Packet data payload
* **Returns `get_length()`** **`int`:** Payload length

## Exceptions

### NetBIOSError

Raised when NetBIOS operations fail.

```python
try:
    response = nb.gethostbyname('UNKNOWN')
except nmb.NetBIOSError as e:
    print(f"NetBIOS error: {e}")
```

### NetBIOSTimeout

Raised when operations timeout.

```python
try:
    response = nb.gethostbyname('HOST', timeout=1)
except nmb.NetBIOSTimeout:
    print("Query timed out")
```

## Usage Examples

### Name Resolution

```python
from impacket import nmb

nb = nmb.NetBIOS()

# Resolve NetBIOS name to IP
try:
    response = nb.gethostbyname('WORKSTATION',
                                 qtype=nmb.TYPE_SERVER,
                                 timeout=2)

    print(f"Found {len(response.entries)} addresses:")
    for ip in response.entries:
        print(f"  {ip}")

except nmb.NetBIOSTimeout:
    print("Name resolution timed out")
except nmb.NetBIOSError as e:
    print(f"Error: {e}")
```

### Node Status Query

```python
from impacket import nmb

nb = nmb.NetBIOS()

# Query node for all registered names
try:
    entries = nb.getnodestatus('*', '192.168.1.100')

    print(f"NetBIOS names for 192.168.1.100:")
    for entry in entries:
        name = entry['NAME'].decode('latin-1').strip()
        name_type = entry['TYPE']

        # Get human-readable type
        type_str = nmb.NAME_TYPES.get(name_type, 'Unknown')

        print(f"  {name:<15} <{name_type:02X}> {type_str}")

    # Get MAC address
    mac = nb.getmacaddress()
    print(f"\nMAC Address: {mac}")

except nmb.NetBIOSError as e:
    print(f"Error: {e}")
```

### Get NetBIOS Name from IP

```python
from impacket import nmb

def get_nbname(ip):
    """
    Get NetBIOS name for an IP address
    """
    nb = nmb.NetBIOS()
    try:
        name = nb.getnetbiosname(ip)
        return name
    except:
        return None

# Usage
ip = '192.168.1.100'
name = get_nbname(ip)
if name:
    print(f"{ip} -> {name}")
else:
    print(f"Could not resolve {ip}")
```

### Network Scanning

```python
from impacket import nmb
import ipaddress
import concurrent.futures

def scan_host(ip):
    """
    Scan a single host for NetBIOS
    """
    nb = nmb.NetBIOS()
    try:
        entries = nb.getnodestatus('*', ip, timeout=1)

        # Get server name (type 0x20)
        server_names = [e for e in entries if e['TYPE'] == nmb.TYPE_SERVER]
        if server_names:
            name = server_names[0]['NAME'].decode('latin-1').strip()
            return (ip, name, nb.getmacaddress())
    except:
        pass
    return None

# Scan subnet
network = ipaddress.ip_network('192.168.1.0/24')
hosts = [str(ip) for ip in network.hosts()]

print("Scanning for NetBIOS hosts...")

with concurrent.futures.ThreadPoolExecutor(max_workers=20) as executor:
    results = executor.map(scan_host, hosts)

    for result in results:
        if result:
            ip, name, mac = result
            print(f"{ip:<15} {name:<15} {mac}")
```

### Using with SMB

```python
from impacket import nmb, smb

# First resolve NetBIOS name
nb = nmb.NetBIOS()
response = nb.gethostbyname('FILESERVER')
ip = response.entries[0]

print(f"FILESERVER is at {ip}")

# Now connect via SMB
conn = smb.SMB('FILESERVER', ip)
conn.login('user', 'password')

# List shares
tid = conn.connect_tree(f'\\\\{ip}\\IPC$')
print("Connected successfully")
conn.logoff()
```

### Enumerating Domain Controllers

```python
from impacket import nmb

def find_domain_controllers(domain):
    """
    Find domain controllers for a domain
    """
    nb = nmb.NetBIOS()

    # Query for domain controller name (type 0x1C)
    try:
        response = nb.gethostbyname(domain,
                                     qtype=nmb.TYPE_DOMAIN_CONTROLLER)
        return response.entries
    except nmb.NetBIOSError:
        return []

# Usage
domain = 'CORP'
dcs = find_domain_controllers(domain)

if dcs:
    print(f"Domain controllers for {domain}:")
    for dc_ip in dcs:
        # Get DC name
        nb = nmb.NetBIOS()
        try:
            dc_name = nb.getnetbiosname(dc_ip)
            print(f"  {dc_name} ({dc_ip})")
        except:
            print(f"  {dc_ip}")
else:
    print(f"No domain controllers found for {domain}")
```

### Custom NetBIOS Session

```python
from impacket import nmb

# Create NetBIOS session
session = nmb.NetBIOSTCPSession(
    myname='CLIENT',
    remote_name='SERVER',
    remote_host='192.168.1.100',
    remote_type=nmb.TYPE_SERVER,
    sess_port=139
)

# Send data
data = b'SMB data here'
session.send_packet(data)

# Receive response
response = session.recv_packet(timeout=5)
print(f"Received {len(response.get_trailer())} bytes")

# Close session
session.close()
```

## Helper Functions

### encode\_name()

Encode a NetBIOS name.

```python
from impacket.nmb import encode_name

encoded = encode_name('WORKSTATION', nmb.TYPE_SERVER, scope=None)
```

* **Parameter `name`** **`str`:** NetBIOS name (max 15 characters)
* **Parameter `nametype`** **`int`:** Name type suffix
* **Parameter `scope`** **`str`:** NetBIOS scope
* **Returns `return`** **`bytes`:** Encoded NetBIOS name

### decode\_name()

Decode an encoded NetBIOS name.

```python
from impacket.nmb import decode_name

offset, name, scope = decode_name(encoded_data)
```

* **Parameter `name`** **`bytes`:** Encoded name data
* **Returns `offset`** **`int`:** Bytes consumed
* **Returns `name`** **`str`:** Decoded name
* **Returns `scope`** **`str`:** Scope identifier

## See Also

* [SMB](/reference/library-api/smb-and-netbios/smb.md) - SMB protocol implementation
* [SMBConnection](/reference/library-api/smb-and-netbios/smbconnection.md) - High-level SMB client


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://www.impacket.wiki/reference/library-api/smb-and-netbios/nmb.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.