Microsoft KB Archive/830578

= NBLookup.exe command-line tool =

Article ID: 830578

Article Last Modified on 10/30/2006

-

APPLIES TO


 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows XP Professional
 * Microsoft Windows 2000 Server
 * Microsoft Windows Server 2003, Standard Edition (32-bit x86)
 * Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
 * Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)
 * Microsoft Windows NT Workstation 4.0 Developer Edition
 * Microsoft Windows NT Server 4.0 Standard Edition

-




 * SUMMARY
 * Command-Line Mode
 * Command-Line Mode Options
 * Command-Line Mode Examples
 * Interactive Mode
 * Interactive Mode Options
 * Interactive Mode Examples
 * Query List Mode
 * Query List Mode Options
 * Query List Mode Examples
 * Input File
 * Input File Format
 * Query Format
 * NBLookup Usage Examples
 * REFERENCES



SUMMARY
NBLookup is a command line diagnostic tool that uses the User Datagram Protocol (UDP) to send NetBIOS name queries to Microsoft Windows Internet Naming Service (WINS) servers. NBLookup requires TCP/IP version 4 to run. WINS servers accept name resolution requests on UDP port 137.

NBLookup runs on the following operating systems:
 * Microsoft Windows NT 4.0
 * Microsoft Windows 2000
 * Microsoft Windows XP
 * Microsoft Windows Server 2003

You can obtain NBLookup from the Microsoft Download Center.

The following file is available for download from the Microsoft Download Center:

Download the NBLookupV1.exe package now.

For additional information about how to download Microsoft Support files, click the following article number to view the article in the Microsoft Knowledge Base:

119591 How to Obtain Microsoft Support Files from Online Services

Microsoft scanned this file for viruses. Microsoft used the most current virus-detection software that was available on the date that the file was posted. The file is stored on security-enhanced servers that help to prevent any unauthorized changes to the file.

NBLookup can be run in command-line mode, in interactive mode, and in query list mode. The following table contains the correct syntax for each mode.

back to the top

Command-Line Mode
You can use Command Line mode to send a single NetBIOS name query to a single WINS server. After the response appears, the program ends. The following table contains the possible return values for this query.

These return values can be useful in scripts.

To exit NBLookup before it has completed in command-line mode, press CTRL+C.

back to the top

Command-Line Mode Options
Command line mode uses the following syntax:

nblookup [-options]

must be a valid NetBIOS name that has a maximum of 15 alphanumeric characters. This NetBIOS name cannot contain period (.) characters (dots) or any special characters such as ampersands (&) or percent signs (%).

The following table contains descriptions of the options that you can use with NBLookup in command-line mode.

back to the top

Command-Line Mode Examples
The following example queries WINS server 169.254.1.10 for the File Server service that computer1 has registered:

nblookup /s 169.254.1.10 computer1

The following example queries the WINS server that is named WINS1 for the domain controllers that are registered in the domain that is named DOMAIN1:

nblookup /s WINS1 /x 1C DOMAIN1

back to the top

Interactive Mode
This mode is similar to the interactive mode of the NSLookup tool.

NBLookup starts a command shell that accepts a limited number of commands and parameter settings. You can use this mode to troubleshoot issues that require you to send the same queries repeatedly, although each repetition may use different parameter settings.

To exit NBLookup before it has completed in interactive mode, type quit or exit, and then press ENTER. The program exits the command shell and the program ends.

back to the top

Interactive Mode Options
Interactive mode uses the following syntax:

nblookup [-options]

The following table lists the options that are available in interactive mode.

You can use the set OPTION=value option to set specified option values for NBLookup. The following table describes the option values that you can set by using the set option.

To view a list of query types that you can use with the set suffix=x option, type nblookup /suffix_help at a command prompt, and then press ENTER, or type shelp from within NBLookup.

back to the top

Interactive Mode Examples
To use NBLookup in interactive mode, type the following command at a command prompt, and then press ENTER:

\NBLookup.exe

Note In this example,  is the path of the NBLookup.exe file on your computer.

The greater-than (>) sign appears in the NBLookup interface as a prompt. To run any of the following commands, type the command at the > prompt, and then press ENTER:  The following command lists the IP address of the default WINS server:

SERVER

 The following command sets the query type to 1B (Master Browser):

set type=1B

  The following command queries the default WINS server for master browsers in the domain. In this example, the domain is named TESTDOMAIN.

testdomain

When you run this command, NBLookup displays output that is similar to the following: Recursion is on

Querying WINS Server: 157.55.253.218 NetBIOS Name: testdomain Suffix: 1B

Name returned: TESTDOMAIN Record type: Unique IP Address: 157.54.5.150 Note In this example, 157.54.5.150 is the IP address of the master browser in the TESTDOMAIN domain.  The following command sets the query type to Workstation Service (00), to Messenger Service (03), and to File Server Service (20):

set type=*

 The following command displays the current option values:

set all

 The following command queries the default WINS server for the Workstation Service, for the Messenger Service, and for the File Server Service that are registered with the computer that is named MYSERVER:

MYSERVER

</ul>

back to the top

Query List Mode
Query list mode uses the following syntax:

nblookup -ql input_file [-qr report_file]

Query List Mode uses an input file to specify the parameters of WINS queries.

back to the top

Query List Mode Options
The following table lists the options that are available in query list mode.

back to the top

Query List Mode Examples
The following command builds a sample input file that is named In-nblookup.txt:

nblookup /ql

The following command runs queries that are specified in the input file that is named In-nblookup.txt. The command then creates a report that is named Myreport.htm:

nblookup /ql in-nblookup.txt /qr myreport

back to the top

Input File
After you have identified all the WINS servers and all the WINS records that are important in your environment, you can write your own customized NBLookup input files. You can then use these customized files with NBLookup and DNSLint to help you with administration, ongoing maintenance, and troubleshooting.

DNSLint is a tool for DNS troubleshooting. DNSLint also has a /ql (Query List) option. You can use NBLookup and DNSLint to quickly collect information about WINS and DNS records that are important in your environment.

NBLookup verifies the specified input file before using its contents to send WINS queries. NBLookup verifies the specified IP addresses to make sure that they are valid. NBLookup also verifies the validity of each field on each line. Comments that start with a semicolon are ignored. Comments that start with a plus sign (+) are printed in the report. Typically, these comments are small (less than 500 characters).

After NBLookup has verified the input file, it starts to send the WINS queries that are listed in the input file to the WINS servers that are specified in the input file. If a destination WINS server does not respond to a query, NBLookup retries the query. If the WINS server does not respond again, NBLookup bypasses any other queries that are specified in the input file for that WINS server. This behavior avoids the delay that occurs if many WINS queries are sent to a server that is not responding. For example, if two queries to a WINS server time out two times, NBLookup does not send any other queries that are listed in the input file to that WINS server.

back to the top

Input File Format
The input file has the following format: NBLookup [wins~server] 192.168.138.20 mydomain,1b mydomain,1c dc1,20,nr dc1,00 host,* The following table describes the elements of this input file.

back to the top

Query Format
The queries in the input file use the following syntax:

mydomain,1b

The first field in the line is the NetBIOS name to query. In this example, the name is mydomain. A comma must follow the NetBIOS name. No spaces are permitted on either side of the comma.

The second field follows the comma that appears immediately after the NetBIOS name to query. The second field is the type of record or the NetBIOS suffix (the 16th character) to query for. (For more information about common valid types, see the &quot;Common Valid Record Types&quot; table that appears later in this section.)

If the suffix that is specified is the asterisk character (*), NBLookup queries for the specified name by using the 00, the 20, and the 03 records in one command.

A comma always follows the type of record. No spaces are permitted on either side of the comma.

You may use an optional third field to turn recursion on or off. This field immediately follows the comma that appears after the second field. By default, recursion is on. To turn off recursion, append ,nr after the query type.

Nothing follows the third field. The first two fields are required and no spaces are permitted in the query line.

Note You can view the list of common valid record types by running one of the following commands:
 * In command-line mode: nblookup /suffix_help
 * In interactive mode: shelp or ?s

NBLookup Comment Types
NBLookup supports two types of comments that use two different symbols:
 * The semicolon symbol indicates a comment that NBLookup ignores. If you want to add a comment to the input file that is only visible when the input file is edited, add this type of comment.
 * The plus sign (+) indicates a comment that appears in the HTML report. If you want to add extra information to the report that makes the report easier to understand, use this type of comment.

The following sample input file contains both types of comments. This sample file is generated by running the nblookup /ql autocreate command. NBLookup
 * This is a sample NBLookup input file.
 * This is the type of file that NBLookup reads when you specify the /ql option.
 * This file must be in ANSI text format (use Notepad.exe).


 * The first word in all NBLookup input files must be NBLookup,
 * as you can see at the top of this sample file.


 * A semicolon indicates a comment that NBLookup ignores when it processes the file.


 * A plus sign (+) indicates a comment that will appear in the HTML report
 * and in the optional text report.
 * Use this type of comment when you want to add additional information to the report
 * to make it easier to understand


 * This file is made up of three types of data:
 * 1. WINS server (or servers) to query
 * 2. WINS queries
 * 3. Optional NetBIOS Scope ID


 * [wins~server] 169.254.46.138
 * This line specifies the IP address of a WINS server to send queries to
 * [wins~server] must be specified, followed by a valid IP address.


 * Later lines in the file indicate the queries to send to this server:
 * server1,20
 * host1,00,nr
 * mydomain,1b
 * mydomain,1c


 * Format of queries:
 * first field = NetBIOS name to query
 * maximum of 15 valid characters


 * second field = type of record to query for
 * examples: 00, 20, 1B, 1C
 * run /suffix_help for a list of valid query types


 * These two fields are required, they are delimited by using a comma.
 * No spaces are permitted.
 * third field = disable recursion option
 * By default, NBLookup uses recursion.
 * You can send a query and request recursion.
 * example: nr


 * This field is optional. If you use it, this field must follow the second field and a comma.


 * [scopeid] 'my_scopeid'
 * This line specifies the scope ID to use for all later queries.
 * Replace my_scopeid with the scope ID that you want.
 * Note: Scope IDs are case sensitive and must be between single quotation marks.
 * [scopeid] ';reset'
 * This line resets the scope ID for all later queries.
 * Only use scope IDs in your queries if you use scope IDs in your environment.

[wins~server] 192.168.138.20

+This WINS server is named wins1.cp.msft.net.

mydomain,1b    ;identifies PDC mydomain,1c    ;identifies 20 PDCs

[scopeid] 'edmonton'   ;set scope id to edmonton

dc1,20,nr  ;file server service with no recursion dc1,00 ;workstation service

[scopeid] ';reset' ;Do not use a scope ID for the next query. host,00 ;workstation service The sample input file In-nblookup.txt is generated in the local directory. If the file already exists, NBLookup prompts you for permission to overwrite it.

To process the input file, run the following command at a command prompt:

nblookup /ql input.txt

back to the top

NBLookup Usage Examples
If you verify a specified set of WINS records on multiple WINS servers, this information can help you to diagnose and to fix problems that missing or incorrect WINS records may have caused.

For example, if clients are experiencing problems when they try to log on to the domain, verify that the 1C records that the clients use to find domain controllers are available and are accurate. This information can help you determine if WINS is a cause of the problem.

Also, if you receive reports that users are having problems browsing the network by using NetBIOS browsing through Windows Explorer, this tool quickly verifies all the 1B records that are involved with NetBIOS browsing on the network on all the WINS servers that are supposed to have these records. Therefore, you can quickly determine if missing or incorrect WINS records may be related to the problem.

In another case, some users may be experiencing problems when they try to gain access to shares on servers by using the servers' names. However, the users can gain access to the shares by using the IP addresses. To determine whether name resolution is the problem, or to rule out name resolution as a possible cause, you must verify all the related WINS records on all the WINS servers that are used to resolve a server's name. The /ql (Query List) option that permits NBLookup to read instructions from the specified text file provides this functionality. After NBLookup has verified that the file is a valid NBLookup input file, it runs the queries that are specified in the file and then returns the results in an easy-to-read HTML report. Administrators can customize this input file to specify the WINS servers to query and to specify the WINS records to look for on each server.

back to the top

<div class="references_section">