We help IT Professionals succeed at work.

NetBT Event ID: 4319

DanR
DanR asked
on
Our Web server has suddenly started throwing one or two of these errors a day.  What is causing it?  The full text of the error message, as well as results from nbtstat -n are below.  Alas, I have not happened to be checking the event log any time near when the error occurs, so I'm not sure the nbtstat output is worth much.

Event Type:     Error
Event Source:     NetBT
Event Category:     None
Event ID:     4319
Date:          10/9/2001
Time:          12:53:43 AM
User:          N/A
Computer:     WWW
Description:
A duplicate name has been detected on the TCP network.  The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
Data:
0000: 00 00 04 00 01 00 54 00   ......T.
0008: 00 00 00 00 df 10 00 c0   ....fl..?
0010: 05 01 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........
0028: d8 3e bf d1               y>??    



nbtstat -n results:

Local Area Connection:
Node IpAddress: [xxx.xxx.xxx.xxx] Scope Id: []

                NetBIOS Local Name Table

       Name               Type         Status
    ---------------------------------------------
    WWW            <00>  UNIQUE      Registered
    WWW            <20>  UNIQUE      Registered
    WORKGROUP      <00>  GROUP       Registered
    WORKGROUP      <1E>  GROUP       Registered
    WWW            <03>  UNIQUE      Registered
    INet~Services  <1C>  GROUP       Registered
    IS~WWW.........<00>  UNIQUE      Registered
    WORKGROUP      <1D>  UNIQUE      Registered
    ..__MSBROWSE__.<01>  GROUP       Registered
    TIENET_ADMIN   <03>  UNIQUE      Registered
Comment
Watch Question

IT Systems Admin
CERTIFIED EXPERT
Commented:
Are you using a public IP address for your web server or are you running NAT(Network Address Transalation).  It looks like you are running a public IP and there is another person on your ISP doing the same thing and their computer name matches yours, WWW.  You may consider getting a router and setting up NAT and if you don't have a lot of hits on your site, the Linksys is a pretty good solution.  You can just change the computer name, but you may have this problem in the future.  Try to change it to something unique if you do.
CERTIFIED EXPERT

Commented:
Which SP for W2K?
See here: http://support.microsoft.com/support/kb/articles/Q261/1/25.ASP

NBSTSTAT -A and convert offset 28 to decimal to get the computer name:
http://support.microsoft.com/support/kb/articles/Q120/7/52.asp

Author

Commented:
patch575
We're doing NAT through an SMC Barricade router.

shekerra
That server has SP2.

Your second link looks promising, but following the decoding advice I get in that article, it appears that 225.191.62.232 is releasing the name WWW.  That's not an address that exists in our internal LAN.  I'll run the NBTSTAT -A when I have a chance.

Author

Commented:
Oops, I was giving info on the wrong server.  This server is one over in our ISP's offices.  So patch575, you hit the nail on the head.  The points are yours.

Shekerra, I'm opening up a separate 50 pt. question for you, since you were also helpful.  The question ID is 20208229, and the title is "Points for Shekerra"

Author

Commented:
Oops, I was giving info on the wrong server.  This server is one over in our ISP's offices.  So patch575, you hit the nail on the head.  The points are yours.

Shekerra, I'm opening up a separate 50 pt. question for you, since you were also helpful.  The question ID is 20208229, and the title is "Points for Shekerra"

Explore More ContentExplore courses, solutions, and other research materials related to this topic.