2

I'm noticing on MS Network Monitor a ton of NetBios Name Service broadcasts coming from a particular workstation. When I run netmon on that desktop it cannot resolve the application producing them (but does log them).

First question, is this bad?

Next question, what could be causing this so we can either move it to a server or stop it entirely?

The workstation is Windows XP with no attached printers. A "ton" is 1 broadcast every 2-5 seconds.

Holocryptic
  • 5,665
  • 2
  • 29
  • 37
Austin Salonen
  • 63
  • 2
  • 12
  • How much is a 'ton'? Does the desktop have an attached print printer that it is sharing? What OS is the desktop? – Zoredache May 05 '10 at 18:26
  • 1 every 2-5 seconds doesn't seem bad. If you have some packet capture software you should be able to find out more info about the broadcast. – dbasnett May 09 '10 at 13:53

5 Answers5

2

I'm not sure how to trace why it's broadcasting, but if you want to disable NetBios on that workstation follow the directions from here:

  1. Click Start, Control Panel, and then click Network Connections.

  2. Right-click Local Area Connection, and then click Properties from the shortcut menu.

  3. Select Internet Protocol (TCP/IP), and then click the Properties button.

  4. When the Internet Protocol (TCP/IP) Properties dialog box opens, click the Advanced button.

  5. Click the WINS tab.

  6. Click the Disable NetBIOS Over TCP/IP option.

  7. Click OK to close the Advanced TCP/IP Settings dialog box.

  8. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box

  9. Click OK to close the Local Area Connections dialog box.

The document also might give you some pointers on troubleshooting it.

Edit: You can disable NetBios, and then see if any of the applications on that workstation break. Then you'll have another avenue for troubleshooting.

Edit: You can also user Wireshark to do a packet trace on the NIC of the workstation and find out what it's looking for.

Holocryptic
  • 5,665
  • 2
  • 29
  • 37
2

If you cannot find the application with netmon, try some tools from sysinternal:

Sysinternals Process Utilities:
technet.microsoft.com/en-us/sysinternals/bb795533.aspx

Sysinternals Networking Utilities:
technet.microsoft.com/en-us/sysinternals/bb795532.aspx

If I were you, I would like to try 'Process Monitor' first.

aXqd
  • 127
  • 4
1

To answer your first question -yes , because sending broadcasts will clog your network/consume bandwidth.

It could be that the workstation is trying to find a name that is repeatedly failing and is resorting to NetBios all the time to try to find that name.

redknight
  • 857
  • 3
  • 9
  • 13
0

Check if there are some old printers or shares setup on that machine that no longer exist.

Check My Network Places to see if you have any other cached connections.

See if stopping the indexing service helps.

Sharjeel Aziz
  • 376
  • 3
  • 7
-2

Stop the Workstation Service and it will stop making these netbios requests. I was on my laptop on a public network and I noticed that my laptop was broadcasting the names of all the computers on my home network over and over again, and since I dont want the names of my home computers being broadcasted anywhere but at home, whenever i leave the house I make sure to turn off that pesky Workstation service as soon as I remember. Microsoft should make this more clear and I googled this for a while before figuring it out myself by turning off random services until the workstation service finally stopped it.

Jimmy G
  • 1