Unusual Amount of NETBIOS traffic over my network!

Posted on 2006-04-26
Last Modified: 2008-03-03
Thanks in advance for any help given!

I have a small network for my small IT business consisting of a server and around 4 pcs!

I have noticed in the last day or two slower than usual general network and internet speeds!

I have been using a program which i have used before on the server which is PTGR Traffic Grapher, which i have found usefull in the past.

Upon looking into this i noticed at seemingly irregular intervals there is massive amounts of netbios data running through the system, and i mean massive, in one case up to a 1GB in a 5 min time slot. Now i am working on what this could be but does anyone have any ideas of tools i can use to more specifically locate the problem or even what the problem could be, im 99% sure its a virus somewhere and im currently runinng a full site scan. Ill let you know how this goes!

you can see the traffic log here if you would like:

Look at the netbios traffic amounts in certain sections.

Just on another note i installed Microsofts CRM 3.0 the otherday just for some testing, but i cant imagine that this is anything to do with it.

Again thanks for the help.
Question by:crossfireit
    LVL 27

    Expert Comment

    'PTGR Traffic Grapher' - I don't know what is the program. I cannot find it in google.
    Probably 'NETBIOS' traffic also includes CIFS file transfers, so you have large file transfers in your LAN.
    To be shure, use some other program with 'TCP' port numbers or find what exactly included in 'NETBIOS' column.
    LVL 2

    Author Comment

    Sorry my mistake

    PRTG Traffic Grapher

    CIFS, Is that linux orientated???
    LVL 27

    Expert Comment

    No, CIFS is the same protocol as Microsoft Windows uses for shares.
    LVL 27

    Expert Comment

    I've looked to default sensors of PRTG. Yes NETBIOS also includes SMB traffic (file transfers).
    So you have large file transfers.
    LVL 4

    Expert Comment

    Try for SASSER Virus, very old and headache maker, If u have a firewall. block ports used by before mention.

    You mention a server??. can you tell us what kinda server? NAT W2k3, RRAS?.. u kow, whatever is your gateway is probably logging the local traffic...

    if u find such logs, only 5-6 lines of abnormal traffic would be enough to identify the problem...

    LVL 6

    Accepted Solution

    If you need to identify the traffic a little better try using ethereal.

    This should tell you exactly which host is initiating the traffic and what is in the payload.

    I have found the tool extremely usefull in troubleshooting.



    Featured Post

    Netscaler Common Configuration HowTo guides

    If you use NetScaler you will want to see these guides. The NetScaler HowTo Guides enable administrators to get NetScaler up and running by providing instructions for common configuration scenarios and some not so common ones.

    Join & Write a Comment

    Article by: IanTh
    Hi Guys After a whole weekend getting wake on lan over the internet working, I thought I would share the experience. Your firewall has to have a port forward for port 9 udp to your local broadcast x.x.x.255 but if that doesnt work, do it to a …
    Some time ago I was asked to set up a web portal PC to put at our entrance. When customers arrive, they could see a webpage 'promoting' our company. So I tried to set up a windows 7 PC as a kiosk PC.......... I will spare you all the annoyances I…
    Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

    731 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    15 Experts available now in Live!

    Get 1:1 Help Now