Avatar of DonovanV
DonovanV asked on

Excessive NBNS query activity

I've been watching wireshark capturing on my wireless connection. I have found that when I am not in my primary network I get a massive amount of NBNS queries going on. My laptop is querying the names of some of my machines that would normally be expected on my primary network. I have tried purging the netbios cache with nbtstat -R but it had no effect. Anyone have any ideas short of turning off NBNS? I figure its kind of necessary if I am not in an environment that is using a DNS server.
Networking ProtocolsInternet Protocols

Avatar of undefined
Last Comment

8/22/2022 - Mon
Chris Dent

I advise you install a WINS server and make sure all clients use it if you can.

If the clients are not members of a domain have DHCP (if you can) hand out a NetBIOS Node Type (Option 46) of 0x8 (Hybrid) which will have them check the WINS server before they think about Broadcasting for a name.

If a WINS server is out of the question then you're a bit stuck with the Broadcast traffic unless NetBIOS over TCP/IP is disabled.


Hi Chris-Dent,

  I can see where you're going with that answer. That would definitely solve the issue in my network but may I though a wrinkle into the situation and see what you think?

  Lets say I set up a WINS server at my home network. One of my nodes is a laptop. As soon as that laptop travels to another network I assume it would start asking everyone on the new network where the names of its cached counterparts are to be found. Honestly my PCs at home don't chatter that much but taking my laptop off site and having it ask everyone where to find the names of my home machines is frustrating to me.

That being the case am I left with uninstalling NetBIOS over TCP and maybe setting up my own DNS server at home?

Thanks much,
Chris Dent

It's a bit odd really, unless you had mapped drives, or a domain at home I wouldn't really expect it to be sending out a lot of queries for that network.

You could disable NetBIOS over TCP/IP if you prefer, that certainly gets rid of the traffic, and DNS would allow you to resolve names (although you lose network browsing through My Network Places).

Otherwise you could configure the Node Type on the laptop (I think it can be done in the registry) to Point To Point. That gets rid of broadcast entirely and tells it to use a WINS server only.

All of life is about relationships, and EE has made a viirtual community a real community. It lifts everyone's boat
William Peck

Now you see my interest in the heavy broadcasts when I'm off my home netowork. I don't have mapped drives so my thought was that if NetBIOS kept a cache then if I cleared it it would be fine. Wrong on that one. My other thought is that maybe its windows at fault for caching the names. Ever notice the history kept in the my network places area? Do you think there is a chance that windows is asking to resolve those history lines in an attempt to validate them? My laptop obviously has the names is querying stored somewhere other than the NetBIOS cache. Hmmm....

What are the names that it is trying to resolve?  Chris-D is on the right track asking about mapped drives, but there may be other services that your machine is automatically looking for.  Because it can't resolve the names via the other networks' DNS servers, it's resorting to broadcasts.

Is this machine a part of a domain?

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

Great news -
You may also want to check My Network Places to see if you have any other cached connections.  
You can turn off the option to automatically cache any \\xxxx  network connections using the preferences in ciadv.msc
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

Thanks artthegeek.

I wouldn't have thought the indexing service was responsible for doing that. My guess would have been explorer. That's good info. One question for you. If i have disabled the indexing service are those settings still applicable?