Unusual Amount of NETBIOS traffic over my network!

Thanks in advance for any help given!

I have a small network for my small IT business consisting of a server and around 4 pcs!

I have noticed in the last day or two slower than usual general network and internet speeds!

I have been using a program which i have used before on the server which is PTGR Traffic Grapher, which i have found usefull in the past.

Upon looking into this i noticed at seemingly irregular intervals there is massive amounts of netbios data running through the system, and i mean massive, in one case up to a 1GB in a 5 min time slot. Now i am working on what this could be but does anyone have any ideas of tools i can use to more specifically locate the problem or even what the problem could be, im 99% sure its a virus somewhere and im currently runinng a full site scan. Ill let you know how this goes!

you can see the traffic log here if you would like:


Look at the netbios traffic amounts in certain sections.

Just on another note i installed Microsofts CRM 3.0 the otherday just for some testing, but i cant imagine that this is anything to do with it.

Again thanks for the help.
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

'PTGR Traffic Grapher' - I don't know what is the program. I cannot find it in google.
Probably 'NETBIOS' traffic also includes CIFS file transfers, so you have large file transfers in your LAN.
To be shure, use some other program with 'TCP' port numbers or find what exactly included in 'NETBIOS' column.
crossfireitAuthor Commented:
Sorry my mistake

PRTG Traffic Grapher

CIFS, Is that linux orientated???
No, CIFS is the same protocol as Microsoft Windows uses for shares.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

I've looked to default sensors of PRTG. Yes NETBIOS also includes SMB traffic (file transfers).
So you have large file transfers.
Try for SASSER Virus, very old and headache maker, If u have a firewall. block ports used by before mention.


You mention a server??. can you tell us what kinda server? NAT W2k3, RRAS?.. u kow, whatever is your gateway is probably logging the local traffic...

if u find such logs, only 5-6 lines of abnormal traffic would be enough to identify the problem...

If you need to identify the traffic a little better try using ethereal.

This should tell you exactly which host is initiating the traffic and what is in the payload.


I have found the tool extremely usefull in troubleshooting.



Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.