NetBIOS Computer-Name Discovery With Otter

Read registered computer names

Otter sends one unicast wildcard Node Status (NBSTAT) query to UDP 137. It prefers the active workstation name over the server name and retains the returned name table, suffixes, flags, workgroup, unit ID, and raw response as a netbios observation.

This probe uses no credentials, broadcast discovery, name registration, or SMB session. It works from Linux and Windows and is enabled by default. Disable it with --no-netbios, "noNetbios": true, or the GUI toggle.

Keep names separate from hardware identity

The reported NetBIOS unit ID remains raw evidence, including when it is all zeros. It does not replace ARP/DCP MAC correlation. With ARP explicitly disabled, a response without a correlated MAC stays in unresolved; a computer name cannot create a physical identity on its own.

For reported OS and domain evidence, compare the separate SMB and RPC probes. To select targets and protocol settings, configure Otter.