none
How to process cmd "nbtstat -A ip-address" output and display the computer name in Powershell RRS feed

  • Question

  • Hi All,

    I am very new to PowerShell and I just start to play with it last week and base on my requirement now. I got this native windows command "nbtstat" that I run to validate remote computer hostname.  I am trying to make a function to pass ip-address to the command. Right now I am trying to make the code run first. The command output will be like below:

    PS C:\> nbtstat -A 10.xx.xx.xxx

    Local Area Connection:
    Node IpAddress: [0.0.0.0] Scope Id: []

        Host not found.

    Wireless Network Connection:
    Node IpAddress: [10.xx.xx.xxx] Scope Id: []

               NetBIOS Remote Machine Name Table

           Name               Type         Status
        ---------------------------------------------
        COMPUTERNAME01 <00>  UNIQUE      Registered
        LAB01          <00>  GROUP       Registered
        LAB01           <1E>  GROUP       Registered
        COMPUTERNAME01 <20>  UNIQUE      Registered

        MAC Address = XX-XX-XX-XX-XX-XX

    I want the function to return "COMPUTERNAME01" or the hostname only for every ip-address that I check.

    Here is what I got so far and I do not know how to split the result to display the "COMPUTERNAME01" only. I am open for any suggestion from the experts. Many thanks in advance.

    $nbtstat_out = nbtstat -A 10.xx.xx.xxx | Select-String -Pattern "\s*(\S+)\s+<20>"; $nbtstat_out

    PowerShell Console:
    COMPUTERNAME01 <20>  UNIQUE      Registered


    • Edited by mimiAufa Friday, February 7, 2014 6:53 PM
    Friday, February 7, 2014 6:53 PM

Answers

  • I'd probably do something like this:

    $nbtStat = nbtstat -A 10.xx.xx.xxx
    
    $computerName = ''
    
    foreach ($line in $nbtStat)
    {
        if ($line -match '^\s*([^<\s]+)\s*<00>\s*UNIQUE')
        {
            $computerName = $matches[1]
            break
        }
    }
    
    $computerName

    • Marked as answer by mimiAufa Saturday, February 8, 2014 4:59 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Friday, February 7, 2014 7:14 PM

All replies

  • try this:

    nbtstat -A 192.168.1.101 | ?{$_ -match '\<00\>  UNIQUE'} | %{$_.SubString(4,14)}


    ¯\_(ツ)_/¯

    • Marked as answer by mimiAufa Saturday, February 8, 2014 4:59 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Friday, February 7, 2014 7:08 PM
  • But this is easier:

    [System.Net.Dns]::GetHostByAddress('192.168.1.101').hostname


    ¯\_(ツ)_/¯

    • Proposed as answer by Jason Warren Friday, February 7, 2014 11:28 PM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:51 AM
    Friday, February 7, 2014 7:10 PM
  • I'd probably do something like this:

    $nbtStat = nbtstat -A 10.xx.xx.xxx
    
    $computerName = ''
    
    foreach ($line in $nbtStat)
    {
        if ($line -match '^\s*([^<\s]+)\s*<00>\s*UNIQUE')
        {
            $computerName = $matches[1]
            break
        }
    }
    
    $computerName

    • Marked as answer by mimiAufa Saturday, February 8, 2014 4:59 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    • Marked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Friday, February 7, 2014 7:14 PM
  • Here's something quick while I'm waiting for GP to finish installing:

    function Resolve-NameFromIP {
        
        param(
        [Parameter(Mandatory,ValueFromPipeline)]
        [string[]]
        $IPAddress
        )
    
        process {
    
            foreach ($addr in $IPAddress) {
    
                If (Test-Connection $addr -Count 1 -Quiet -ErrorAction SilentlyContinue ) {
    
                    $details = [System.Net.DNS]::GetHostByAddress($addr)
    
                    $props = @{
                        HostName = $details.HostName
                        IPAddress = $addr
                    }
                }
                
                Else { $props = @{ HostName = 'IP DOES NOT RESOLVE' ; IPAddress = $addr } }
    
                New-Object PsObject -Property $props
            }
        }
    
    }
    
    Resolve-NameFromIP -IPAddress '10.10.10.10','10.20.20.20','10.30.30.30'
    
    Get-Content .\ipList.txt | Resolve-NameFromIP

    EDIT: Before anyone pokes at me, yeah, yeah yeah I know, it doesn't parse nbtstat.


    Don't retire TechNet! - (Don't give up yet - 12,575+ strong and growing)


    Friday, February 7, 2014 7:16 PM
  • I guess the pipeline approach works as well, but I'd still use $matches to get at the computer name rather than SubString, personally:

    $computerName = nbtstat -A 10.xx.xx.xxx |
        Where-Object { $_ -match '^\s*([^<\s]+)\s*<00>\s*UNIQUE' } |
        ForEach-Object { $matches[1] }

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:00 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    Friday, February 7, 2014 7:16 PM
  • Since you asked:

    nbtstat -A 192.168.1.101 | ?{$_ -match '\<00\>  UNIQUE'} |%{if($_ -match '(?<x>\S+)'){$matches['x']}}


    ¯\_(ツ)_/¯

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:00 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    Friday, February 7, 2014 8:46 PM
  • Careful; it is possible for the computer name to run right into the <00> with no whitespace separating them. I had similar code to that in an old VBScript or batch file, and eventually encountered that problem.
    Friday, February 7, 2014 9:41 PM
  • Never happens.  There is always a space between.

    ¯\_(ツ)_/¯

    Friday, February 7, 2014 11:11 PM
  • But in case someone is using illegally long names then this will work:

    nbtstat -A 192.168.1.101 | ?{$_ -match '\<00\>  UNIQUE'} |%{if($_ -match '(?<x>\S+)\s+\<'){$matches['x']}}


    ¯\_(ツ)_/¯

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:01 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:49 AM
    Friday, February 7, 2014 11:14 PM
  • FYI - I am not saying this is a best way. All other methods appear to be correct.  I just like the compact one-liner.

    ¯\_(ツ)_/¯

    Friday, February 7, 2014 11:30 PM
  • Never happens.  There is always a space between.

    ¯\_(ツ)_/¯


    NetBIOS names can be up to 15 characters long, not counting the byte that indicates the record type.  The output has exactly 15 characters for the name before it displays the <00>.  It's not an illegally long name; just a name that has the maximum number of characters.
    Saturday, February 8, 2014 1:40 AM
  • Which is not a problem for the substring method.

    ¯\_(ツ)_/¯

    Saturday, February 8, 2014 1:47 AM
  • But this is easier:

    [System.Net.Dns]::GetHostByAddress('192.168.1.101').hostname


    ¯\_(ツ)_/¯

    This is still the best answer in PowerShell.  Why take a risk of parsing text when their is a built-in method designed to do this correctly.


    ¯\_(ツ)_/¯

    Saturday, February 8, 2014 1:49 AM
  • True, assuming the poster wants a DNS lookup rather than what NetBIOS tells you. They can be different.

    Bill

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:20 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Saturday, February 8, 2014 3:08 AM
    Moderator
  • Hello mimiAufa

    I had the same problem a few days ago and I found this Simple method If u are interested i'll send u the Script which gives information in a Excel File

    (nbtstat -A 10.xx.xx.xxx | Select-String "<00>  UNIQUE      Registered").ToString().ToUpper().Split()[4]


    • Edited by Anji Vanamala Saturday, February 8, 2014 3:04 PM
    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:02 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Saturday, February 8, 2014 2:59 PM
  • Hello mimiAufa

    I had the same problem a few days ago and I found this Simple method If u are interested i'll send u the Script which gives information in a Excel File

    (nbtstat -A 10.xx.xx.xxx | Select-String "<00>  UNIQUE      Registered").ToString().ToUpper().Split()[4]


    That won't work as expected but this will:

    (nbtstat -A 192.168.1.101 | ?{$_ -match '\<00\>  UNIQUE'}).Split()[4]


    ¯\_(ツ)_/¯

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:02 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Saturday, February 8, 2014 3:32 PM
  • Or-

    nbtstat -A 192.168.1.101 | ?{$_ -match '^\s+(\S+)\s+\<00\>  UNIQUE'}|Out-Null;$matches[1]


    ¯\_(ツ)_/¯

    • Marked as answer by mimiAufa Saturday, February 8, 2014 5:02 PM
    • Unmarked as answer by mimiAufa Thursday, January 31, 2019 2:50 AM
    Saturday, February 8, 2014 3:37 PM
  • Hi Guys,

    Many thanks for the great sample and suggestions. All works perfectly. You guys make it so easy to craft the code. It make me want to learn and explore PowerShell scripting more. The reason I did not use the DNS lookup because our environment have some problem with it. I prefer to get the information directly from the "nbtstat -A ip-address". This will give me the true computer name that belong to the ip-address. Thanks again for the fast response. Really appreciate it.

    Saturday, February 8, 2014 4:01 PM
  • Post this thread on a bulletin board and call it a sampler.  ("Home Sweet PowerShell")


    ¯\_(ツ)_/¯

    Saturday, February 8, 2014 5:05 PM
  • Hello All,

    I too am pretty new to powershell and have got this work to display the nbtstat of servers without revealing their entity in the script.

     Looking for a similar kind of output however when ever i try to hide the entity/IP address of my system by defining it via variable the script is unable to generate an output. Here's what i am trying to do :-

    $nbtstatHostname = nbtstat -A $env:COMPUTERNAME| Select-String -Pattern "\s*(\S+)"

    $OUtput = $nbtstatHostname

    PS C:\Windows\System32> nbtstat -A $env:COmputername | Select-String -Pattern "\s*(\S+)"

    Ethernet 3:
    Node IpAddress: [192.XX.XX.XX] Scope Id: []
        The IP address is not in the correct format. It needs to be
        dotted decimal, for example 11.11.12.13
        You entered "SYSTEMHOSTNAME"

    My requirement is to show that the status of these nodes are registered and come out as a displayable output.

    Thanks In Advance.

    Friday, February 8, 2019 8:05 AM
  • Hello All,

    I too am pretty new to powershell and have got this work to display the nbtstat of servers without revealing their entity in the script.

    Please do not add new questions to another users thread.  Please start you own topic with complete information.

    This question has been answered and closed.



    \_(ツ)_/

    Friday, February 8, 2019 8:08 AM