Windows Forum

Ask something
Discussion Locked

Strange network traffic

0 helpful
6 replies

by mteal

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

We have a number of servers in the head office, and a single server in each of a number of regional/'non head office' locations. Most servers are NT4.There is one Win2000 server in head office. The PDC is in head office, there is a BDC in head office, and each regional server is a BDC. All sites are connected by 64K or 128K ISDN.

We have begun to see a large amount of traffic (average 2 to 3Kbyte/sec) on each of the links to regional sites. This is fairly steady traffic and started last Wednesday (8 days).

I have run some traces and found that each Windows (NT,2000 professional, Win95) PC is actually sending a netbios_dgm request to EVERY server, including one server that hasn't been there for over a year.

Therservers are alsosending these requests.

The network addressing is 10.x.x.x/255.255.0.0
Head office is 10.1.x.x

Some examples are:

pc12340.company.com -> 10.1.255.255 UDP D=138 S=138 LEN=224
pc12340.company.com -> 10.1.255.255 UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-alb.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-omp.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-ger.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-man.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-wmp.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-bun.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> 10.2.4.1 UDP D=138 S=138 LEN=243

So, PC12340 is broadcasting, then sending requests to several remote servers. It also sends a request to 10.2.4.1 This one doesn't exist!!!

Also, looking at traffic for a single regional server (10.2.4.1 - this one doesn't exist anymore!!) All the pcXXXXX addresses are in the10.1.x.x subnet.

6 replies

by ntoz

May I send you a small capture utility that will grab some better traces that I can look at with a sniffer? Im Im able to look down into the packets I might be able to better tell you what the traffic is.

Pete

P.S. Sent you an email asking youthe same thing.

by ntoz

Hey I sent you that tool, you should have it by now. Were on opposite ends of the planet so I will assume at this point, your gone home for the day. I will send more info directy on email as to what Im looking for.

by mteal

Thank you very much for your help.At the moment, the problem seems to have been resolved. One of the other consultants flushed the WINS database and for whatever reason this seems to have resolved the problem, at least for now. I'll make another post on TR if/when it happens again.

by nsa13

From your output (is this Snort?) it looks like your boxes are sending browser election datagrams to one another. It would make sense. For the most part only your servers are performing the dialog, the size of the packets is very small, and its using UDP as the communication medium. All three are highly indicative of a browser election. Check your event logs to see if a computer is trying to force elections alot. For example, if a server is setup and told that it will be the Master Browser, and another box has the same setting it'll create a small war for them as they battle it out. =)

In theory one would be elected and the packets would stop.. =)

My only other guess given the small size is DHCP lease requests. But, I thoughtthat DHCP used TCP.. tho, using UDP would make sense since a computer requesting a lease wouldn't have its own IP information and would need the ability of the UDP protocol in order to obtain the lease.. wierd.

=)

GL

This discussion is closed to new replies.