Hai dato un'occhiata alla pagina man?
Non dovrebbe smbutil lookup [-w host] name
fare il lavoro?
Global options are as follows:
-h Print a short help message.
-v Verbose output.
The commands and local options are:
help command
Print usage information about command.
lookup [-w host] [-t node_type] [-e] name
Resolve the given name to an IP address. The NetBIOS name server can be directly specified via
the -w option. The NetBIOS name type can be specified via the -t, the default is to lookup file
servers. For a complete list of name type please see "http://support.microsoft.com/kb/163409".
The NetBIOS names will be unpercent escaped out if the -e option is specified.
status [-ae] hostname
Resolve given hostname (IP address or DNS name) to NetBIOS workgroup and system name. All Net-
BIOS names will be displayed if the -a option is specified. All NetBIOS names will be percent
escaped out if the -e option is specified.
Per me ha funzionato (sostituendo il tuo esempio):
smbutil lookup -w 172.16.0.10 -e domainPC | awk '/IP address of/ {print $5}'