Inspect the NetBIOS name cache with nbtstat on Windows
The forgotten legacy tool that still answers 'which Windows machine is \OLDFILESERVER?' and resolves names on networks without DNS.
01Command
$ nbtstat -c02What it does
Legacy Windows shares, printers, and old NAS devices still register NetBIOS names, and when DNS fails on a LAN these names are what SMB falls back to. `nbtstat -c` shows your local cache, `nbtstat -A <ip>` asks a specific machine what names it owns (its response includes its MAC address), and `nbtstat -R` purges the cache so stale names reload. It's read-only unless you use -R or -RR, so it's safe to poke around with.
03Risk
04Undo
✓No undo needed — this command does not change persistent state.
05Sources
- NBTSTAT - Windows CMDEvidence: SS64 explains nbtstat -c displays cached NetBIOS names and -R reloads the cache from the LMHOSTS file.
- nbtstat | Microsoft LearnEvidence: Microsoft documents nbtstat switches: -c lists the NetBIOS name cache, -A queries a remote machine by IP address, -R purges the cache.
Last verified: 2026-09-17 · Category: Network
06Related solutions
Purge cached DNS lookups so Windows re-resolves hostnames from scratch — the fix for 'the new server is live but my browser still hits the old one'.
A built-in PowerShell one-liner that answers 'is port 5432/3389/443 actually open through this network?' — no telnet client needed.
Display the IP-to-MAC address cache Windows built by talking to neighbors — a quick way to spot which devices are on your subnet.