Computers on LAN keep on broadcasting?

[Buzzard7]

My firewall is showing my computers constantly broadcasting using ethier port 137 or 138. This just started doing this a few days ago. My antivirus doesn't show any viruses. I also have a switch, a printer, and two, "Snap Servers", NAS sending out the same broadcast. I used a packet sniffer to see what was going on and here is some of the results;
BROWSE Host Announcement NANCY, Workstation, Server, NT Workstation, Potential Browser
BROWSE Host Announcement LAURA, Workstation, Server, NT Workstation, Potential Browser, Backup Browser
BROWSE Host Announcement Sandra, Workstation, Server, NT Workstation, Potential Browser
BROWSE Host Announcement Denise, Workstation, Server, NT Workstation, Potential Browser
BROWSE Host Announcement Dell 2500, Workstation, Server, Domain Member Server,Print Queue Server

How can I get this to stop?

 

[netmanrick]

Sounds like Master Browser handshaking going on.
What Microsoft OS are you running ?

Rick Harris
SC Dept of Motor Vehicles
Network Operations

 

[Buzzard7]

Most Of the computers are XP some are 2000. About two weeks ago I installed 3, 2003 servers.

 

[mpennac]

There is a registry setting that has the key of MaintainServerList. If this is set to Auto, the workstation will attempt to become a Local Master Browser, or a Backup Browser. If this value is set to Yes, it will be a Preferred Browser Server. This will help it win the election if no other machine is set to Yes.

If it is set to No, it will not attempt to be a Local Master, or Backup Browser. This will get rid of those broadcasts.

Most likely this setting is not in the registry, it must be added manually. Just search Microsoft Knowledgebase to find out where it goes.

Mike

http://www.nps-llc.com

 

[Buzzard7]

I tried turning the MaintainServerList to No on 5 computers, but this computers are still broadcasting out. Some of the computers boadcast to 255.255.255.255 and some to 128.90.255.255 and some to 192.168.255.255. The 128.90.. is my trusted network and the 192.168.. is my optional network. The computers on the trusted broadcast to either 255.255.255.255 or 128.90.255.255. The optional broadcasts to either 255.255.255.255 or 192.168.255.255.

 

[vipergg]

Did you check each workstation for a virus ??? If it just started on its own it certain sounds like a virus . Also is it a lot or just occasional . You are always going to have some broadcast on a network .

 

[Buzzard7]

I checked for viruses, and there wasn't any. It is a lot, and it's constant.

 

[bcastner]

http://support.microsoft.com/?kbid=288801

http://support.microsoft.com/?id=818092

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q188305

 

[Buzzard7]

I haven't found the problem yet. I have been using a packet filter and it said that UDP is using about 35% of my network. That is more than TCP on my network. Here is some more information from the packet filter.

Destination Protocol Info
128.90.255.255 NBNS Name query NB TROY<20>
128.90.255.255 NBNS Name query NB MARVIN<20>
128.90.255.255 NBNS Name query NB JAN<20>
128.90.255.255 NBNS Name query NB WORKGROUP<1b>
128.90.255.255 NBNS Name query NB DAVID<20>


I am also receiving traffic from 224.0.1.22 and 224.0.0.251. I read that this is multicasting. Could multicasting have anything to do with this?

Can one computer make all the other computers broadcast to 128.90.255.255 using port 137 or 138?

 

[Buzzard7]

I found the problem. I have an optional network and a trusted network. The optional network switch was plugged in to the trusted switch.

Thanks for all the help.