“Human-readable service names” (-h) option cannot be used without verbose (-v) option.
nbtscan [-v] [-d] [-e] [-l] [-t timeout] [-b bandwidth] [-r] [-q] [-s separator] [-m retransmits] (-f filename)|()
-v verbose output. Print all names received
from each host
-d dump packets. Print whole packet contents.
-e Format output in /etc/hosts format.
-l Format output in lmhosts format.
Cannot be used with -v, -s or -h options.
-t timeout wait timeout milliseconds for response.
Default 1000.
-b bandwidth Output throttling. Slow down output
so that it uses no more that bandwidth bps.
Useful on slow links, so that ougoing queries
don’t get dropped.
-r use local port 137 for scans. Win95 boxes
respond to this only.
You need to be root to use this option on Unix.
-q Suppress banners and error messages,
-s separator Script-friendly output. Don’t print
column and record headers, separate fields with separator.
-h Print human-readable names for services.
Can only be used with -v option.
-m retransmits Number of retransmits. Default 0.
-f filename Take IP addresses to scan from file filename.
-f – makes nbtscan take IP addresses from stdin.
what to scan. Can either be single IP
like or
range of addresses in one of two forms: or
nbtscan -r
Scans the whole C-class network.
Scans a range from to
nbtscan -v -s :
Scans C-class network. Prints results in script-friendly
format using colon as field separator.
Produces output like that:

nbtscan -f iplist
Scans IP addresses specified in file iplist.