How to get a list of SMB shares

September 21, 2008

Getting the list of SMB shares on a network isn't as easy as it should be. I spent weeks trying to hunt down a solution online and after asking the Samba mailing list, the Samba IRC channel, Apple DTS and emailing a bunch of people, I finally got the answer. You would think this would be very simple to do, but there is one trick you need to know to discovering all the available shares.

First step is to get a list of master browsers:

nmblookup -M -- -

Output looks like this:

querying __MSBROWSE__ on 172.26.44.255
172.26.44.202 __MSBROWSE__<01>
172.26.44.168 __MSBROWSE__<01>

Parse out the IP addresses and pass them to smbclient:

smbclient -g -p 139 -NL (ip address)

Output looks like this:

Server|StevesServer|
Server|SharedPC|
Workgroup|MyWorkgroup
Workgroup|Fredsworkgroup

Parse out the "Workgroup" lines and save the names in an array.

Now comes the trick. For some reason, on some networks, the list of master servers returned with nmblookup -M -- - is incomplete. I'm sure there is a reason why this happens, but I have no idea why.

To get the complete list of master browsers, take your array of workgroups and ask each one for it's master browser like this:

nmblookup -M (workgroup)

Output looks like this:

172.26.44.94 WORKGROUP<1d>

Parse out the ip address. This is another master browser!

Now take the list of master browser returned from nmblookup -M -- - and combine it with any master browsers received querying the workgroup names and run this again for each ip:

smbclient -g -p 139 -NL (ip address)

Server|StevesServer|
Server|SharedPC|
Workgroup|MyWorkgroup
Workgroup|Fredsworkgroup

This time parse out the "Server" lines from the output you will have a complete list of SMB shares.

Posted by sgehrman at September 21, 2008 6:47 PM