NBNS storms
-
Hello all,
First of all MY FAULT not pfsense this program is amazing and i recommend it to everyone i can! All the time i get NBNS storms and i have checked for loops in my network, i have found none so this leads me to believe its a config issue. i am at a total loss and i am not sure where to start! if anyone can give me any pointers i would be grateful. i can provide any information needed.
i have two Wans and 1 lan with a simple class C network.
the only issue i can think of is that lan 1 and wan 1 are a class C subnet. i have reinstalled on different servers a DL360G5, DL380G4, and DL380G5. and i eventually get a massive NBNS storm. i have this disabled in DHCP options. so please let me know what additional info i need to provide!
-a desperate I.T. Guy (Eric)
-
Also side note.
I cannot save my homepage GUI. i set all my windows open on the the traffic monitor and set it down to 1 second click save then it just goes back to default immediately. Not critical just annoying.
-
What is a NBNS storm?
-
http://lmgtfy.com/?q=nbns+storm
:P
-
And what are these queries for?? Why would things on your network not resolve? So computers are sending out nbns queries via directed broadcast - do they not get an answer?
Correctly setting up name resolution on your network would remove the need for machines to attempt to broadcast for something.
Can you post some examples of these queries..
What did you disable via dhcp?
-
Hello thank you for the response. Here is some of the NBNS packets captured when it is not storming. i do not have a capture yet from when it is storming. During this time the DHCP/DNS server is online and running. but when it floods it takes all the phones offline and every network attached device. the network will run for a few days then all hell breaks loose. Usually on friday night around 7pm once ive gone home! haha. the option i disabled in dhcp is no longer disabled it was name bios for server 2003 to slow down the nbns but it made no difference. Thank you for your time.
No. Time Source Destination Protocol Length Info
1 0.000000000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
Frame 1: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
6 0.715468000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
Frame 6: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
10 1.432635000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
Frame 10: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
19 3.582563000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 19: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
22 4.401744000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 22: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
32 5.118513000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 32: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
76 10.853239000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 76: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
83 11.672022000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 83: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
87 12.388738000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 87: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
117 16.382186000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 117: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
121 17.100441000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 121: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
129 17.918210000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 129: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
138 18.532569000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 138: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
140 18.942524000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 140: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
144 19.249351000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 144: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
148 19.761345000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 148: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
155 20.068532000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 155: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service
No. Time Source Destination Protocol Length Info
160 20.478520000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
Frame 160: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
NetBIOS Name Service -
So its looking for printers? that is what I would assume MFC98, and MFC-9 are..
Do those printers exist? Why do they not answer? You could always setup wins records for those devices or use lmhost files on the machines.
You could also just setup dns for those devices so you don't have to resort to netbios broadcast for them.
Fix the source of why your seeing the queries in the first place and your issue goes away ;)
edit: Seems 192.168.0.175 really wants to find MFC-9 and .109 wants to find MFC98.. So why can they not find them, are they not on this network any longer, have they been retired? Names changed?, etc..
-
What your saying is that somthing is looking for the printer? its not the printer sending out the request?
these printers do exist.
the name did change awhile ago. not sure what device is 175 or 109. Well thank you!
-
I have such "problems" sometimes when people are coming to my guest VLAN and they have filestations or something like that connected at home but the computer cannot find that on my network.
Perhaps your users have "old" printers installed and their operating system tries to connect to these printers periodically.
-
Well you should be able to find them on your network just do a nbtstat -A to the Ips and that should give you the hostname.
They are clearly clients, looking for those devices. I guest printers from the MFC in their name.
As to such problems on a guest vlan - their broadcasts would be limited to your guest vlan, so not sure how it would be a problem?
As to periodically? That 192.168.0.175 box really wants to find that printer, the is broadcasting every half second or so for it ;)
If I were you I would spend some time watching your broadcast traffic and cleaning up - if they are looking for something that does not exist fix the client so he has the new name, or remove the old device from his setup. if your seeing broadcast for stuff that answers - look to why it got all the way to broadcasting for it, broadcasting is normally last method.
Should look to host, lmhost first then dns, then if node type is hybrid it would do lookup to wins if your running it then finally broadcast for the name. So fix your name resolution, are clients/printers not registering themselves in dns? Are they dhcp or static - pretty much any device on your network that would ever be accessed should be in dns. And while your at it get your reverse zones setup as well, so you can just query PTR for 192.168.0.175 and know what its hostname is, etc.
