K
Kristin Thomas [MSFT]
CJ,
You are right about broadcast packets, something destined for a specific IP
address is not a broadcast packet. Broadcast is only sent to a machine's
broadcast address.
Name Service datagrams are used primarily to register and resolve names on
the network, and they are sent and received by NetBT and WINS only over
TCP/UDP port 137.
So is the machine in question a WINS server? Does it have replication
partners set up with those IP addresses you are seeing?
Best Regards,
Kristin Thomas, MCSE, MCP
Microsoft Enterprise Network Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Win2K Srv sending NBSTAT name query broadcasts to Internet
IPs
| thread-index: AcQLcq6yPnGoflIlRF2S4/aiJ3diDw==
| X-Tomcat-NG: microsoft.public.win2000.networking
| From: "=?Utf-8?B?Q0o=?=" <[email protected]>
| Subject: Win2K Srv sending NBSTAT name query broadcasts to Internet IPs
| Date: Tue, 16 Mar 2004 08:21:05 -0800
|
| I have noticed that my Win2K server is sending NBSTAT broadcast packets
to random IP addresses outside of my local network. The broadcasts always
originate from the server on port 137 and are always destined for some IP
address on port 137. The destination IP addresses always seem to be
different and many times are nonexistant.
I say random because there is no time pattern to the broadcasts. Sometimes
there are sent every couple of minutes and sometimes the period between
broadcasts are much longer.
Can anyone explain why this might be happening. I can understand this if
the broadcasts were to machines on my local network but not out onto the
Internet. I also don't understand the concept of a broadcast being sent to
a specific IP address. I thought broadcasts were sent out to all systems on
the local network.
Please advise.
CJ
|
You are right about broadcast packets, something destined for a specific IP
address is not a broadcast packet. Broadcast is only sent to a machine's
broadcast address.
Name Service datagrams are used primarily to register and resolve names on
the network, and they are sent and received by NetBT and WINS only over
TCP/UDP port 137.
So is the machine in question a WINS server? Does it have replication
partners set up with those IP addresses you are seeing?
Best Regards,
Kristin Thomas, MCSE, MCP
Microsoft Enterprise Network Support
Get Secure! - www.microsoft.com/security
=====================================================
When responding to posts, please "Reply to Group" via
your newsreader so that others may learn and benefit
from your issue.
=====================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
--------------------
| Thread-Topic: Win2K Srv sending NBSTAT name query broadcasts to Internet
IPs
| thread-index: AcQLcq6yPnGoflIlRF2S4/aiJ3diDw==
| X-Tomcat-NG: microsoft.public.win2000.networking
| From: "=?Utf-8?B?Q0o=?=" <[email protected]>
| Subject: Win2K Srv sending NBSTAT name query broadcasts to Internet IPs
| Date: Tue, 16 Mar 2004 08:21:05 -0800
|
| I have noticed that my Win2K server is sending NBSTAT broadcast packets
to random IP addresses outside of my local network. The broadcasts always
originate from the server on port 137 and are always destined for some IP
address on port 137. The destination IP addresses always seem to be
different and many times are nonexistant.
I say random because there is no time pattern to the broadcasts. Sometimes
there are sent every couple of minutes and sometimes the period between
broadcasts are much longer.
Can anyone explain why this might be happening. I can understand this if
the broadcasts were to machines on my local network but not out onto the
Internet. I also don't understand the concept of a broadcast being sent to
a specific IP address. I thought broadcasts were sent out to all systems on
the local network.
Please advise.
CJ
|