I was wondering if there is a way of listing all the smb servers on a local network (like looking at a network neighborhood in windows) via the command line in fedora.

  • What do you mean with 'smb servers'? Do you mean Samba servers, or do you mean all file servers (wether Samba or Windows, wether in my own or in other workgroups/domains) which speak the SMB protocol? – Kurt Pfeifle Aug 2 '10 at 10:36
  • 1
    Also, your question's title (mentioning 'smb shares') somewhat contradicts its text (mentioning 'smb servers'). Which one did you mean? – Kurt Pfeifle Aug 2 '10 at 14:34

This command is a very little known secret of Samba. It returns IP adresses of all Samba servers in one's own broadcast domain:

nmblookup __SAMBA__

This one returns a list of all NetBIOS names and their aliases of all Samba servers in the neighbourhood (it does a 'node status query'):

nmblookup -S __SAMBA__

This one returns a list of all IP adresses of SMB servers (that is, Linux+Unix/Samba or Windows) in the neighbourhood:

nmblookup '*'

Finally, all NetBIOS names and their aliases of all SMB servers (Linux+Unix/Samba or Windows):

nmblookup -S '*'

The command given in the other answer nmblookup -S WORKGROUP does NOT return all Samba or all SMB servers from the neighbourhood. Instead, it returns all servers' NetBIOS names who happen to be members of a workgroup named 'WORKGROUP'. The results are independent of the servers' OS (wether that is Windows, or wether that is Linux/Samba) -- and it is a well known fact that sometimes lots of Windows member server are part of a Samba-controlled domain or workgroup. [Yes, it happens that Samba's default workgroup name is 'WORKGROUP'... but so what??]. -- But the question was 'How do I get to know all SMB (Samba?!?) servers in my network neighbourhood?'

  • This should be marked as the correct answer. – rbellamy Dec 13 '15 at 21:11
  • 3
    Interestingly using these suggestions I only see the Samba share on the server I'm currently on. To really detect another Samba server (it has WORKGROUP workgroup), I had to run nmblookup -S WORKGROUP.. not sure how to really list any server since nmblookup -S '*' and other commands only returned the local server as mentioned above. – davidhq Feb 21 '17 at 13:01
  • For me also, the other answer worked better, though not correct. nmblookup -S '*' returns only the local server. more information might be needed... SAMBA only returns samba servers, while I'd all like all SMB share (windows included). At least I found the window share which were part of WORKGROUP. I'm not sure why all the fuss about samba/smbd, and why this answer would get the points. – Fred Mar 3 '18 at 13:17
  • @Fred: The answer says explicitly (not clearly enough?!?) that (1) with __SAMBA__ you get the Samba servers, and (2) with '*' you get all SMB servers. This answer gets points because it is the correct one. – Kurt Pfeifle Mar 29 '18 at 12:26
  • I only say this is not working on my computer. I'm using ubuntu 16.04, nmblookup from package samba-common-bin 2:4.3.8+dfsg-0ubuntu1. Maybe there is something wrong with my environment. Or regression in the tools, it's been a long time this question was answered. The previous comment suggests I'm not alone seeing this behaviour. – Fred Mar 30 '18 at 17:44
nmblookup -S WORKGROUP 

from the: https://web.archive.org/web/20101121043732/http://brneurosci.org/linuxsetup38b.html

  • You might need to tweak the firewall settings on a default install. – Ophidian Jul 14 '10 at 18:46
  • 2
    I'll downvote this answer. -- I can't believe such a WRONG answer gets 2 upvotes. The given command only lists servers which are members of a workgroup named "workgroup". And it lists them regardless of OS (Samba/Linux or not, Windows or not). The question was about getting to know all SAMBA servers on the local network (regardless of workgroup name). – Kurt Pfeifle Aug 2 '10 at 10:12
  • 7
    Actually, he didn't say he was looking for all samba servers. He said "all the smb servers". I suppose I failed to elaborate to the degree that you did, in that you can search for wildcard workgroups--but really, I made it clear that I was referencing the manual, and I got the OP what he needed. Not to mention, I answered half a month before you did--I don't understand what you're so bent out of shape about. – andyortlieb Oct 27 '10 at 15:00

On my network - as of this writing (things do change) - smbtree is my preferred solution. It asks for your password (meaning your Samba password), and then it gives a nicely detailed list that includes netbios name, available shares, and the share description.

nmblookup, on the other hand, does not list all the available shares on my network. I do not know why it does not, but it doesn't.

From the smbtree man page:

smbtree is a smb browser program in text mode. It is similar to the "Network Neighborhood" found on Windows computers. It prints a tree with all the known domains, the servers in those domains and the shares on the servers.

The nmblookup command does have more switches and options. The nmblookup man page: nmblookup man page

Noted for posterity - as these answers do stick around - and as I said, I find that smbtree would be a better answer to the OP on my network.

  • The output of smbtree is great! - Wish it didn't ask for my PWD when im logged in a root tho, never seen that before! – FreeSoftwareServers Dec 16 '16 at 2:00
  • @FreeSoftwareServers Try smbtree -N if you are looking at services that don't need passwords. – Ben C Feb 2 '18 at 8:54
  • I understand, it wanted the SMB password not my root password, they were likely the same, but yes i have my shares restricted to non dhcp IP address pool, but no password – FreeSoftwareServers Feb 3 '18 at 11:48

a better way, more fiendly printed, is to use smbtree.

$ smbtree
Enter user01's password: DOMAIN_A
        \\FREEBOX_SERVER                Freebox Server
                \\FREEBOX_SERVER\IPC$                   IPC Service (Freebox Server)
                \\FREEBOX_SERVER\Disque dur             AutoShare of fbxhdiskd partition 2
  • @Corvus-B had already suggested smbtree in an answer long before. – user4838962 Jun 5 '18 at 4:19

In samba version 4, nmblookup '*' no longer works; it only gives the local server. It used to work in samba version 3.

Now, you have to use nmblookup WORKGROUP, which as Kurt mentioned, only returns servers in workgroup WORKGROUP.


Another way to do this is via Avahi (Bonjour), as long as the servers are publishing:

avahi-browse -r _smb._tcp

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.