Broadcasts from another subnet

  • Thread starter Thread starter Drazen
  • Start date Start date
D

Drazen

There is Server1 (Windows 2000, SP4) with two NICs but
which does not function as router (Routing and remote access
is disabled). Two network cards have the following addresses:
192.168.0.13 and 192.168.102.102. My question is why do I see
network broadcasts on my segment (192.168.0.X) from subnet
192.168.102.X? Sniffing with Ethereal shows following broadcasts from
subnet 102 (source address in 192.168.102.X range):
ARP requests (Who has 192.168.102.X, tell 192.168.102.Y),
Gratuitous ARP requests, NBNS Name queries sent to 192.168.102.X,
NBIPX Find name queries, BROWSE Host announcements...and so on.
So why do I see those broadcasts at all, and is there a way for me
to eliminate them. Where exactly and how could I accomplish that?

P.S. My filter for broadcasts was: eth.dst == ff:ff:ff:ff:ff:ff
 
Drazen-

The broadcasts appear to be on the local subnet only, which is normal. You
can configure your router(s) to forward broadcasts, but it's usually only
done for a very specific purpose and I doubt yours are configured that way.
Broadcasts are a normal and good thing, and you need them for proper
communications. The only major thing you need to worry about broadcasts is
storms. Broadcast storms are caused from spanning-tree issues on your
network. I don't remember the hard numbers but I think up to 25% is OK, for
broadcasts.
 
Neteng, thank you for your answer.
I don't have antyhing against broadcasts as long as that
traffic is generated by hosts in *my* subnet (192.168.0.X).
However, I can see broadcasts from *another* subnet, (that is,
source address of that packets is from hosts in 192.168.102.X
range.)...How can i eliminate that traffic?
Networks 192.168.0.X and 192.168.102.X are not connected by
router at all. The computer which has two NICs with IP's
192.168.0.13 and 192.168.102.102 is not configured as router at *ALL*.
 
Here is a capture from ethereal...
I've filtered the output to show only broadcasts (eth.dst ==
ff:ff:ff:ff:ff:ff)
As you can see most of the broadcasts are from our subnet (192.168.0),
but
alot from another (192.168.102).

--start--

No. Time Source Destination
Protocol Info
39 6.449944 192.168.0.16 Broadcast ARP
Who has 192.168.0.147? Tell 192.168.0.16

Frame 39 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:06:5b:05:6a:4b, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
40 6.558905 192.168.0.10 Broadcast ARP
Who has 192.168.0.110? Tell 192.168.0.10

Frame 40 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:b0:d0:f9:71:2d, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
41 6.559629 192.168.0.15 Broadcast ARP
Who has 192.168.0.110? Tell 192.168.0.15

Frame 41 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
68 13.577257 192.168.102.43 Broadcast ARP
Who has 192.168.102.20? Tell 192.168.102.43

Frame 68 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0b:cd:fc:60:59, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
69 13.578226 192.168.102.43 Broadcast ARP
Who has 192.168.102.19? Tell 192.168.102.43

Frame 69 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0b:cd:fc:60:59, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
70 13.585525 00000000.000bcdfc6059 00000000.ffffffffffff NBIPX
Find name JASNA<20>

Frame 70 (98 bytes on wire, 98 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
Internetwork Packet eXchange
NetBIOS over IPX

No. Time Source Destination
Protocol Info
72 13.648030 00000000.000bcdfc6059 00000000.ffffffffffff NBIPX
Find name MARIOB<20>

Frame 72 (98 bytes on wire, 98 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
Internetwork Packet eXchange
NetBIOS over IPX

No. Time Source Destination
Protocol Info
84 15.399214 192.168.0.159 192.168.0.255 NBNS
Name query NB GAUSS.IPCCK.HR<20>

Frame 84 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:02:b3:87:a3:89, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.0.159 (192.168.0.159), Dst Addr:
192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
87 16.149306 192.168.0.159 192.168.0.255 NBNS
Name query NB GAUSS.IPCCK.HR<20>

Frame 87 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:02:b3:87:a3:89, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.0.159 (192.168.0.159), Dst Addr:
192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
88 16.499058 192.168.0.15 Broadcast ARP
Who has 192.168.0.152? Tell 192.168.0.15

Frame 88 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
89 16.722333 192.168.0.15 Broadcast ARP
Who has 192.168.0.95? Tell 192.168.0.15

Frame 89 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
92 16.899397 192.168.0.159 192.168.0.255 NBNS
Name query NB GAUSS.IPCCK.HR<20>

Frame 92 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:02:b3:87:a3:89, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.0.159 (192.168.0.159), Dst Addr:
192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
135 20.639875 192.168.0.118 192.168.0.255
BROWSER Host Announcement SKOLA, Workstation, Server, NT Workstation

Frame 135 (243 bytes on wire, 243 bytes captured)
Ethernet II, Src: 00:0d:56:8f:d5:a6, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.0.118 (192.168.0.118), Dst Addr:
192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port:
netbios-dgm (138)
NetBIOS Datagram Service
SMB (Server Message Block Protocol)
SMB MailSlot Protocol
Microsoft Windows Browser Protocol

No. Time Source Destination
Protocol Info
142 23.707607 192.168.0.15 Broadcast ARP
Who has 192.168.0.95? Tell 192.168.0.15

Frame 142 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
148 25.856697 192.168.0.11 Broadcast ARP
Who has 192.168.0.20? Tell 192.168.0.11

Frame 148 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:b0:d0:f9:71:15, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
151 26.977454 192.168.0.186 Broadcast ARP
Who has 192.168.0.121? Tell 192.168.0.186

Frame 151 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:80:c8:56:48:7c, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
161 28.899620 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<20>

Frame 161 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
162 28.930509 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<00>

Frame 162 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
164 29.128247 192.168.102.32 192.168.102.255
BROWSER Host Announcement MILENA, Workstation, Server, NT
Workstation, Potential Browser

Frame 164 (243 bytes on wire, 243 bytes captured)
Ethernet II, Src: 00:d0:09:e5:b8:4b, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.32 (192.168.102.32), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-dgm (138), Dst Port:
netbios-dgm (138)
NetBIOS Datagram Service
SMB (Server Message Block Protocol)
SMB MailSlot Protocol
Microsoft Windows Browser Protocol

No. Time Source Destination
Protocol Info
165 29.531020 192.168.0.16 Broadcast ARP
Who has 192.168.0.196? Tell 192.168.0.16

Frame 165 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:06:5b:05:6a:4b, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
166 29.645576 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<20>

Frame 166 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
167 29.676951 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<00>

Frame 167 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
168 29.708326 192.168.0.15 Broadcast ARP
Who has 192.168.0.95? Tell 192.168.0.15

Frame 168 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
169 29.859122 192.168.0.16 Broadcast ARP
Who has 192.168.0.182? Tell 192.168.0.16

Frame 169 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:06:5b:05:6a:4b, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
172 30.395668 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<20>

Frame 172 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
173 30.427042 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<00>

Frame 173 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
176 31.177614 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<00>

Frame 176 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
177 31.926977 192.168.102.12 192.168.102.255 NBNS
Name query NB MARIO<00>

Frame 177 (92 bytes on wire, 92 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Internet Protocol, Src Addr: 192.168.102.12 (192.168.102.12), Dst
Addr: 192.168.102.255 (192.168.102.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port:
netbios-ns (137)
NetBIOS Name Service

No. Time Source Destination
Protocol Info
182 32.694335 192.168.102.12 Broadcast ARP
Who has 192.168.102.98? Tell 192.168.102.12

Frame 182 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:0d:9d:4a:00:56, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
192 35.709776 192.168.0.15 Broadcast ARP
Who has 192.168.0.95? Tell 192.168.0.15

Frame 192 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:02:b3:65:69:f3, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

No. Time Source Destination
Protocol Info
201 40.144403 192.168.0.22 Broadcast ARP
Who has 192.168.0.147? Tell 192.168.0.22

Frame 201 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 00:b0:d0:d0:6a:c4, Dst: ff:ff:ff:ff:ff:ff
Address Resolution Protocol (request)

---end-
 
Drazen-

I'm no expert with Ethereal, but it looks like it could be in promiscuous
mode for both NIC's. Can you sniff on a different machine and see if you
still see broadcasts from both subnets?
 
Back
Top