This is Illustrated in the following Etherpeek packet trace.
Long DDP Header - Datagram Delivery Protocol Unused: %00 Hop Count: %0000 Datagram Length: 59 DDP Checksum: 0x0000 Dest. Network: 43203 Source Network: 43204 Dest Node: 229 Source Node: 213 Dest. Socket: 2 NBP Socket Source Socket: 253 DDP Type: 2 NBP NBP - Name Binding Protocol Function: 2 LkUp - Lookup Tuple Count: 1 NBP ID: 25 NBP Tuple #1 Node Address: 43204.213 Socket Number:253 Enumerator: 0 Object: = Type: workstation Zone: Dev Support Center (DTS)
and the target node replies with this packet:
Long DDP Header - Datagram Delivery Protocol Unused: %00 Hop Count: %0000 Datagram Length: 46 DDP Checksum: 0x0000 Dest. Network: 43204 Source Network: 43203 Dest Node: 213 Source Node: 229 Dest. Socket: 253 Source Socket: 2 NBP Socket DDP Type: 2 NBP NBP - Name Binding Protocol Function: 3 LkUp-Reply Tuple Count: 1 NBP ID: 25 NBP Tuple #1 Node Address: 43203.229 Socket Number:4 Enumerator: 1 Object: Jill's IIfx Type: Workstation Zone: *
At first glance, it would seem that we could get the desired result by using the PConfirmName call (since PConfirmName allows us to direct the NBP LkUp to the specific node by using the confirmAddr field, whereas the PLookupName would broadcast it to an entire zone). The PConfirmName call does not return the NBP Tuple information to the application, however: under classic AppleTalk, PConfirmName's sole purpose is to confirm or deny the existence of a registered NBP name.
This leaves you with the following alternatives:
Once you have a list of suspected network zones that the target is on, you can then direct a PLookupName to that zone. You will then have to parse through the responses to find the one that matches your target's node address.
Under classic AppleTalk you can open and register your own DDP listener by using the POpenSkt call, forming your own NBP-LkUp packet, and transmitting that packet to the target node's NBP listener socket (socket #2) with the PWriteDDP call.
The target will respond to you with a NBP LkUp-Reply, which will call back your DDP socket listener. You can parse the reply there.
Writing a DDP socket listener is tricky, but it's illustrated in the Network Watch (DMZ) sample available from DTS sample code library. Examine the doEcho function in the files dMZAT.c and SktListener.a.
Since the programming model is much simpler, you may want to investigate the Open Transport approach.