• Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login
Netgate Discussion Forum
  • Categories
  • Recent
  • Tags
  • Popular
  • Users
  • Search
  • Register
  • Login

NBNS storms

Scheduled Pinned Locked Moved Problems Installing or Upgrading pfSense Software
10 Posts 5 Posters 5.1k Views
Loading More Posts
  • Oldest to Newest
  • Newest to Oldest
  • Most Votes
Reply
  • Reply as topic
Log in to reply
This topic has been deleted. Only users with topic management privileges can see it.
  • S
    Stryderking
    last edited by Apr 7, 2013, 7:13 PM

    Hello all,

    First of all MY FAULT not pfsense this program is amazing and i recommend it to everyone i can! All the time i get NBNS storms and i have checked for loops in my network, i have found none so this leads me to believe its a config issue. i am at a total loss and i am not sure where to start! if anyone can give me any pointers i would be grateful. i can provide any information needed.

    i have two Wans and 1 lan with a simple class C network.

    the only issue i can think of is that lan 1 and wan 1 are a class C subnet. i have reinstalled on different servers a DL360G5, DL380G4, and DL380G5. and i eventually get a massive NBNS storm. i have this disabled in DHCP options. so please let me know what additional info i need to provide!

    -a desperate I.T. Guy (Eric)

    1 Reply Last reply Reply Quote 0
    • S
      Stryderking
      last edited by Apr 7, 2013, 7:19 PM

      Also side note.

      I cannot save my homepage GUI. i set all my windows open on the the traffic monitor and set it down to 1 second click save then it just goes back to default immediately. Not critical just annoying.

      1 Reply Last reply Reply Quote 0
      • W
        wallabybob
        last edited by Apr 7, 2013, 8:19 PM

        What is a NBNS storm?

        1 Reply Last reply Reply Quote 0
        • C
          chpalmer
          last edited by Apr 7, 2013, 8:25 PM

          http://lmgtfy.com/?q=nbns+storm

          :P

          Triggering snowflakes one by one..
          Intel(R) Core(TM) i5-4590T CPU @ 2.00GHz on an M400 WG box.

          1 Reply Last reply Reply Quote 0
          • J
            johnpoz LAYER 8 Global Moderator
            last edited by Apr 8, 2013, 1:41 AM

            And what are these queries for??  Why would things on your network not resolve?  So computers are sending out nbns queries via directed broadcast - do they not get an answer?

            Correctly setting up name resolution on your network would remove the need for machines to attempt to broadcast for something.

            Can you post some examples of these queries..

            What did you disable via dhcp?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

            1 Reply Last reply Reply Quote 0
            • S
              Stryderking
              last edited by Apr 8, 2013, 7:10 PM

              Hello thank you for the response. Here is some of the NBNS packets captured when it is not storming. i do not have a capture yet from when it is storming. During this time the DHCP/DNS server is online and running. but when it floods it takes all the phones offline and every network attached device. the network will run for a few days then all hell breaks loose. Usually on friday night around 7pm once ive gone home! haha. the option i disabled in dhcp is no longer disabled it was name bios for server 2003 to slow down the nbns but it made no difference. Thank you for your time.

              No. Time Source Destination Protocol Length Info
              1 0.000000000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
              Frame 1: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              6 0.715468000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
              Frame 6: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              10 1.432635000 192.168.0.109 192.168.0.255 NBNS 92 Name query NB MFC98
              Frame 10: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: AsustekC_c8:f0:80 (00:24:8c:c8:f0:80), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.109 (192.168.0.109), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              19 3.582563000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 19: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              22 4.401744000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 22: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              32 5.118513000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 32: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              76 10.853239000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 76: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              83 11.672022000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 83: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              87 12.388738000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 87: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              117 16.382186000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 117: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              121 17.100441000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 121: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              129 17.918210000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 129: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              138 18.532569000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 138: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              140 18.942524000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 140: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              144 19.249351000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 144: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              148 19.761345000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 148: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              155 20.068532000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 155: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service
              No. Time Source Destination Protocol Length Info
              160 20.478520000 192.168.0.175 192.168.0.255 NBNS 92 Name query NB MFC-9
              Frame 160: 92 bytes on wire (736 bits), 92 bytes captured (736 bits) on interface 0
              Ethernet II, Src: Hewlett-_4d:e7:bc (00:1f:29:4d:e7:bc), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
              Internet Protocol Version 4, Src: 192.168.0.175 (192.168.0.175), Dst: 192.168.0.255 (192.168.0.255)
              User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137)
              NetBIOS Name Service

              1 Reply Last reply Reply Quote 0
              • J
                johnpoz LAYER 8 Global Moderator
                last edited by Apr 8, 2013, 7:26 PM Apr 8, 2013, 7:24 PM

                So its looking for printers? that is what I would assume MFC98, and MFC-9 are..

                Do those printers exist?  Why do they not answer?  You could always setup wins records for those devices or use lmhost files on the machines.

                You could also just setup dns for those devices so you don't have to resort to netbios broadcast for them.

                Fix the source of why your seeing the queries in the first place and your issue goes away ;)

                edit:  Seems 192.168.0.175 really wants to find MFC-9 and .109 wants to find MFC98.. So why can they not find them, are they not on this network any longer, have they been retired? Names changed?, etc..

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                1 Reply Last reply Reply Quote 0
                • S
                  Stryderking
                  last edited by Apr 9, 2013, 8:06 PM

                  What your saying is that somthing is looking for the printer? its not the printer sending out the request?

                  these printers do exist.

                  the name did change awhile ago. not sure what device is 175 or 109. Well thank you!

                  1 Reply Last reply Reply Quote 0
                  • N
                    Nachtfalke
                    last edited by Apr 9, 2013, 8:23 PM

                    I have such "problems" sometimes when people are coming to my guest VLAN and they have filestations or something like that connected at home but the computer cannot find that on my network.

                    Perhaps your users have "old" printers installed and their operating system tries to connect to these printers periodically.

                    1 Reply Last reply Reply Quote 0
                    • J
                      johnpoz LAYER 8 Global Moderator
                      last edited by Apr 9, 2013, 8:37 PM

                      Well you should be able to find them on your network just do a nbtstat -A to the Ips and that should give you the hostname.

                      They are clearly clients, looking for those devices.  I guest printers from the MFC in their name.

                      As to such problems on a guest vlan - their broadcasts would be limited to your guest vlan, so not sure how it would be a problem?

                      As to periodically?  That 192.168.0.175 box really wants to find that printer, the is broadcasting every half second or so for it ;)

                      If I were you I would spend some time watching your broadcast traffic and cleaning up - if they are looking for something that does not exist fix the client so he has the new name, or remove the old device from his setup.  if your seeing broadcast for stuff that answers - look to why it got all the way to broadcasting for it, broadcasting is normally last method.

                      Should look to host, lmhost first then dns, then if node type is hybrid it would do lookup to wins if your running it then finally broadcast for the name.  So fix your name resolution, are clients/printers not registering themselves in dns?  Are they dhcp or static - pretty much any device on your network that would ever be accessed should be in dns.  And while  your at it get your reverse zones setup as well, so you can just query PTR for 192.168.0.175 and know what its hostname is, etc.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                      1 Reply Last reply Reply Quote 0
                      7 out of 10
                      • First post
                        7/10
                        Last post
                      Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.
                        This community forum collects and processes your personal information.
                        consent.not_received