We have a number of servers in the head office, and a single server in each of a number of regional/’non head office’ locations. Most servers are NT4.There is one Win2000 server in head office. The PDC is in head office, there is a BDC in head office, and each regional server is a BDC. All sites are connected by 64K or 128K ISDN.
We have begun to see a large amount of traffic (average 2 to 3Kbyte/sec) on each of the links to regional sites. This is fairly steady traffic and started last Wednesday (8 days).
I have run some traces and found that each Windows (NT,2000 professional, Win95) PC is actually sending a netbios_dgm request to EVERY server, including one server that hasn’t been there for over a year.
Therservers are alsosending these requests.
The network addressing is 10.x.x.x/255.255.0.0
Head office is 10.1.x.x
Some examples are:
pc12340.company.com -> 10.1.255.255 UDP D=138 S=138 LEN=224
pc12340.company.com -> 10.1.255.255 UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-alb.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-omp.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-ger.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-man.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-wmp.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> nts-bun.company.com UDP D=138 S=138 LEN=243
pc12340.company.com -> 10.2.4.1 UDP D=138 S=138 LEN=243
So, PC12340 is broadcasting, then sending requests to several remote servers. It also sends a request to 10.2.4.1 This one doesn’t exist!!!
Also, looking at traffic for a single regional server (10.2.4.1 – this one doesn’t exist anymore!!) All the pcXXXXX addresses are in the10.1.x.x subnet.