No announcement yet.

DC sending out netbios-ssn packets

  • Filter
  • Time
  • Show
Clear All
new posts

  • DC sending out netbios-ssn packets


    I got an odd thing going on here.
    One of my Domain Controllers is sending out packets on 139 (netbios session service) to
    Obviously, that is not a computer in my network...
    Unless, would that happen if someone slapped a piece of networking equipment in to one of my ethernet jacks? Like a router or something... But, more importantly, who would do that....

    Anyway, ideas?

  • #2
    Re: DC sending out netbios-ssn packets

    This your private or works network?

    It is continuously attempting to send packets?

    Has a host with the IP address ever been on your network?

    Michael Armstrong
    MCITP: EA, MCTS, MCSE 2003, MCSA 2003: Messaging, CCA, VCP 3.5, 4, 5, VCAP5-DCD, VCAP5-DCA, ITIL, MCP, PGP Certified Technician

    ** Remember to give credit where credit is due and leave reputation points sigpic where appropriate **


    • #3
      Re: DC sending out netbios-ssn packets

      My workplace network.
      The DC sends out something like 3 packets every 5 minutes. Like, there was a computer there that the DC is trying to reconnect with. Every once in awhile it picks other random IPs to send the same 139 packets to, as well.

      Before, I'd see DCs send out netbios-ns packets to odd various IPs; but, I figured that was nothing more than my own doing. i.e. Taking a computer off the network, and the DC is trying to resolve the name... The fact that the packets are getting dropped at the firewall probably doesn't help, eh? But, if a computer just wasn't there the DC wouldn't get any sort of acknowledgment anyway.

      Oddly enough. Our file server just sent out 3 packets to from port 1597 to 3817 TCP.


      • #4
        Re: DC sending out netbios-ssn packets

        Can you please a screenshot of the trace?
        Technical Consultant

        MCITP(EA, SA), MCSA/E 2003:Security, CCNA, SNAF, DCUCI, CCSA/E/E+ (R60), VCP4/5, NCDA, NCIE - SAN, NCIE - BR, EMCPE
        "No matter how secure, there is always the human factor."

        "Enjoy life today, tomorrow may never come."
        "If you're going through hell, keep going. ~Winston Churchill"