NetBIOS Broadcasts

[NcCorduan]

All,

Just trying to clean up our network a little bit, and I discovered through my sniffer that many (most? all?) of the machines on my VLAN (and I assume the others on the network...) regularly send out NetBIOS Datagram broadcasts.

We don't do anything with NetBIOS, but we're a Windows 2000 / XP shop with Windows 2000 servers running in native-mode, and I know they use some NetBIOS protocols for SMB, etc...

That said, what is it exactly that's causing my PC's to constantly announce themselves through NetBIOS b-type traffic, and is there anything I can do to stop it, or is just going to be a fact of life?

Thanks!!

 

[jpm121]

Other than disabling NetBIOS over TCP/IP (which sounds less than desirable for you) you may be able to filter it using access lists on your switch. Filter ports 137 & 138.

 

[jpm121]

Doh, clicked Send too soon...

Depending on the number of machines, running WINS might be a good idea.

 

[NcCorduan]

I thought about disabling NetBIOS over TCP/IP, but I've found that it's not even an option on alot of these machines. I could try turning off the NetBIOS Helper service and see what happens...

Re: WINS -- my understanding from Microsoft was that I didn't need to worry about WINS since I have no pre-Win2K machines.

 

[bcastner]

Disabling Netbios over TCP/IP is an option on all of the machines.

TCP/IP Properties, Advanced, WINS tab, you will see the option box.

 

[NcCorduan]

Thanks -- Can't believe I didn't see that.

I tried turning off the browser services, BTW, and that didn't stop it. The machines are still making their 4/8/12 host announcements (MAILHOST\BROWSE).

 

[NcCorduan]

Errr... That's MAILSLOT\BROWSE.

Sorry.

 

[bcastner]

You can turn off the Browser service if you are in a pure IP setting, it only applies to Netbios settings.

The mailslot browse is not from the computer browser.