0

I am seeing on the gateway of a WiFi network a flood of these messages:

12:32:53.334215 IP PRINTER.netbios-ns > 10.10.10.254.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; UNICAST
12:32:53.334295 IP 10.10.10.254.netbios-ns > PRINTER.netbios-ns: NBT UDP PACKET(137): REGISTRATION; NEGATIVE; RESPONSE; UNICAST

What do they mean, exactly? Where is the host trying to register? To which service?

(Note: I previously asked a question about these messages in the context of the printer sending them but since there were no answers I would like to understand the underlying message to try to fix it myself)

WoJ
  • 3,607
  • 9
  • 49
  • 79
  • Next time, please edit the question instead. Also: Don't be too impatient. You asked the question on a sunday (our slowest day) and the majority of users (in the US) will only just start their day now. – Sven Mar 21 '16 at 11:55
  • @Sven: I realized in the meantime that my question was probably too specific, i.e. that it dealt with a specific device while the problem may have been a more general one (NetBIOS registration). I should have edited it instead, you are right. – WoJ Mar 21 '16 at 11:56

1 Answers1

2

I just found the solution, without clearly understanding the reason.

A post brought me to the right direction:

The specific traffic you're seeing is SMB traffic as the machine attempts to register itself with the master browser/force a browser election.

My gateway server has samba enabled and looking at nmdb logs I realized that there was continously the message 

[2016/03/21 12:57:18.985257,  0] ../source3/nmbd/nmbd_incomingrequests.c:213(process_name_registration_request)
  process_name_registration_request: unicast name registration request received for name PRINTER<20> from IP 10.10.10.20 on subnet UNICAST_SUBNET. Error - should be sent to WINS server

I edited /etc/samba/smb.conf to enable the WINS server (wins support = yes and wins server = 10.10.10.254) on this host (it was disabled by default) which ended the problem.

WoJ
  • 3,607
  • 9
  • 49
  • 79
  • Just to add, avoid using both `wins support = yes` and `wins server = ...` in the same config file. Use the 1st when you want your samba to act like a wins server and use the 2nd if you want your samba to communicate to another wins server. – Mladen B. Mar 24 '20 at 12:56