Port 138 udp is often traffic for the browse list where a computer broadcasts from
port 138 and to port 138 looking for a backup browser and the backup browser replies
if it hears the broadcast, but I don't think that is the care for you. However there
are other uses for it as shown in the link below with a paste I included from it.
http://support.microsoft.com/default.aspx?scid=kb;en-us;832017
138 UDP NetBIOS Datagram Service Computer Browser
138 UDP NetBIOS Datagram Service Messenger
138 UDP NetBIOS Datagram Service Server
138 UDP NetBIOS Datagram Service Net Logon
138 UDP NetBIOS Datagram Service Distributed File System
138 UDP NetBIOS Datagram Service Systems Management Server 2.0
138 UDP NetBIOS Datagram Service License Logging Service
One thing I suggest trying is to put a personal firewall such as Sygate [free to try]
on one of those computer ands wait for it to try to access that IP address and it
should tell you the executable/application/process that wants to access it which may
help you track down what is causing it to happen. If it gives you vague information
as far as a process, you can use the free Process Explorer from SysInternals to get
more detailed info on the process such as the related executable or service. ---
Steve
I have alot of NBNS traffic being issued on my network - port 138
Despite being on a 192.168.1.0 setup - I have several workstations
sending UDP to 192.168.2.240
We don't have WINS and never have - we gave a 2.0 network across a VPN
WAN link, it has no host at 2.240
any ideas?
Rick
