Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 8976
  • Last Modified:

BROWSER Host Announcement machine, workstation, server

using ethereal i discovered i have a lot of broadcast like this:
browser host announcement machine, workstation, server
the machines doing this are workstations with computer browser services disabled. why is this happening? and mostly why would it happen so frequently? the workstation doesn't have to broadcsat its presence every couple of minutes right?
this browser issue is killing me!!!
thanx,
tiby
0
LCiaccio
Asked:
LCiaccio
  • 4
  • 3
1 Solution
 
giltjrCommented:
This is normal operation.  Windows (actually NETBIOS devices) will broadcast to let the world know that it exists.  I forget the exact timeing, but Windows will broadcast when it startup, then 30 seconds later and then in increases the time between broadcasts until it works it way up to  once every 12 minutes.

Why is this causing you a problem?  Unless you have a fairly large flat IP subnet, this should cause very little traffic on your LAN.
0
 
LCiaccioAuthor Commented:
the problem is I do have a large flat network. i'm working on segmenting it. if i disable netbios over tcp/ip those announcement should stop right?
0
 
giltjrCommented:
Yes the annoucments will stop.  However so will your ability to do file sharing and just about anything else that Windows does over the LAN.

How large and how flat? For this to be a problem I would assume that you would need to have thousands of PC's.  We have hundreds (500-600) and the broadcasts are a small percentage of our traffic.  ARP's make up more the of the traffic than NETBIOS broad casts.
0
Who's Defending Your Organization from Threats?

Protecting against advanced threats requires an IT dream team – a well-oiled machine of people and solutions working together to defend your organization. Download our resource kit today to learn more about the tools you need to build you IT Dream Team!

 
LCiaccioAuthor Commented:
i don't need to do any  file sharing between workstations. all shares are on the servers and i'm not going to disable netbios for them. my network is about 300-350 macs &PCs.
i see a lot of arp-ing between workstations and they should need to know of eachother.  
0
 
LCiaccioAuthor Commented:
doing a capture with ethereal i see the arps are 58% of the traffic. is this normal? could it be anything wrong with the arp chache on machines? virus? i'm going crazy here.
0
 
giltjrCommented:
I think you are in over your head.  NETBIOS is the protocol used to allow file sharing, on  both sides.  That is a desktop uses NETBIOS to map a drive to a server and to read and write file from/to the server.

It like having a telephone.  You need one if you are going make calls or receive calls.  Just because you are not going to make a call does not mean that you do not need a phone.

Be careful of how you look at things.  ARP's accounting for 58% of all packets, yes that is nomal.  However ARP's accounting for 58% of all traffic, which normally means byte count,  is abnormal.

Hosts cache ARP's for a very short time period.  I not sure what the default is on Windows, but I have seen any where from as low as 30 seconds to as high as 5 minutes.  You can set it on some devices, but 30 seconds to 5 minutes are the "normal" defaults.   So if host does not "talk" to another computer for the cache time, the ARP entry is purged from the cache and the next time it needs to talk to it, it must issue the ARP again.
0
 
giltjrCommented:
I just check.  MS will remove a ARP entry from the cache after two minutes of NOT being referenced.  However MS will also remove a ARP entry that is being used after 10 minutes.  So even if you are activity talking to another host, after 10 minutes the entry is removed and a new ARP must be done.  

Basically every entry in a MS ARP cache is purged at either 2 minute or 10 minute intervals.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

  • 4
  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now