Windows 95 NBTSTAT: View NetBIOS Connections

This article explores NBTSTAT, the native command-line utility in Windows 95 designed to monitor and troubleshoot NetBIOS over TCP/IP (NetBT) connections. It outlines how the tool operates, details the core switches used to inspect active protocol sessions and name tables, and explains the difference between NetBIOS tracking and general TCP/IP connection monitoring.

The Role of NBTSTAT in Windows 95

In Windows 95, the primary tool used to view active NetBIOS protocol statistics and connection states was NBTSTAT (nbtstat.exe). While Windows 95 introduced graphical networking interfaces through the Control Panel and Network Neighborhood, protocol-level troubleshooting relied on command-line diagnostic utilities run from the MS-DOS Prompt (command.com).

NBTSTAT specifically targeted NetBIOS over TCP/IP, the protocol suite enabling legacy Windows local area network (LAN) services—such as file sharing, network browsing, and print sharing—to run across routable TCP/IP networks.

Viewing Active Protocol Connections

To inspect active sessions and connections between local and remote machines, Windows 95 users relied on specific switches executed with the NBTSTAT command:

  • nbtstat -s: Lists current NetBIOS sessions, their connection state, and the number of packets sent and received, resolving remote computer IP addresses into NetBIOS names where possible.
  • nbtstat -S: Displays the active sessions table listing remote endpoints strictly by their IP addresses rather than attempting name resolution, providing a faster readout over slow or congested links.

Additional Diagnostic Switches

Beyond viewing open sessions, NBTSTAT provided visibility into the local cache and registered names that made these connections possible:

  • nbtstat -c: Displays the NetBIOS name cache, which contains the name-to-IP address mappings resolved through broadcasts or WINS (Windows Internet Name Service) servers.
  • nbtstat -n: Displays the local NetBIOS name table, showing which services (such as the Workstation service or Server service) the local machine has registered on the network.
  • nbtstat -R: Purges and reloads the remote NetBIOS name cache using the local LMHOSTS lookup file.

NBTSTAT vs. NETSTAT

Windows 95 also included the NETSTAT utility. While NETSTAT monitored standard, transport-layer TCP and UDP ports and connection states (such as ESTABLISHED or LISTENING), it lacked awareness of NetBIOS service identifiers. NBTSTAT was the dedicated utility required whenever network administrators needed to map NetBIOS computer names to TCP/IP connections and diagnose session drops in Windows 95 workgroups and NT domains.