1

I've one computer in our network which I first named PC029. Shortly after I changed its name to PC021. This was more than a year ago. Today I've found (thanks to Wireshark) that this computer is flooding the network with NetBIOS and LLMNR queries like

A pc029 (LLMNR)
AAAA pc029 (LLMNR)
NB PC029 (NetBIOS)

I've search through registry and files and I don't know how can I prevent this from happening. Any idea?

Farlop
  • 193
  • 1
  • 1
  • 7

1 Answers1

2

After further researching I found the guilty. It was SQL Server Reporting Services installed in that machine doing all that queries. As the user does not use that feature, I've uninstalled that component and checked that traffic goes back to normal.

Farlop
  • 193
  • 1
  • 1
  • 7
  • According to [this source](https://docs.microsoft.com/en-us/sql/sql-server/install/security-considerations-for-a-sql-server-installation#disabled_protocols), Microsoft recommends NetBIOS should be disabled on servers in the perimeter (whatever that means). – simonpa71 Aug 10 '17 at 15:37