Windows XP domain client quering for non-existent netbios name

Posted on 2009-02-24
Last Modified: 2012-05-06
Windows XP clients are causing unnecessary broadcast traffic by quering for a name that does not exist anymore. This problem was found when scanning network traffic with Microsoft Network Monitor 3.2.

The address is IM.xx.xx.xx (domain bits removed). This used to be a host record for a Debian Linux that had Openfire (jabber server) installed. Now this machine has been removed and Openfire is now running on Windows 2003 server that has host record EIM.xx.xx.xx (using Windows server dns). Clients still have Spark installed and is works like a charm.

I know that Spark is not searching for old address because in network monitor software I can see netbios queries (nbtns) even if Spark is not running.

What is causing these broadcast messages? I have ran "ipconfig /flushdns", "nbtstat -R" and "nbtstat -RR".
Question by:cdenter
    LVL 6

    Assisted Solution

    Check with host files on one workstation
    Check the DNS Host A record if there are residual entries.
    Run ipconfig /registerdns after ipconfig /flushdns.    

    Author Comment

    Hosts file is unmodified. Only one line with address (loopback). ipconfig didn't help. I search registry for im's fqdn and did not find anything. I also searched with im's former ip address and came up with nothing. ARP table does not have anything helpful.

    I Did some more network monitoring and the client follows normal name resolution procedures. First asks WINS servers (2 x windows 2003) for that name. WINS responds with "requested name does not exist". After that client start to send broadcast messages. 3 message in a row (default defined in Windows registry) and continues to do this for some time and at some point asks again from WINS servers.

    Microsoft Network Monitor 3.2 cannot isolate the process that is causing this traffic. It would help a lot if I new what program is sending these requests. Any help would be appreciated.

    Accepted Solution

    Problem solved. While scanning only one client machine's network traffic I started to shutdown services from that machine and kept an eye on the network monitor. Broadcast messages stopped suddenly when I stopped antivirus programs management agent service. One old firewall rule which allowed traffic to im.xx.xx.xx address was still enable.

    What made this problem a little harder to find was the fact that Microsoft Network Monitor (3.2) was not able to show any information of the process that was sending these broadcast messages.

    Tools used to solve problem: Microsoft Network Monitor 3.2 and Sysinternals Process Explorer (11.33)


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Looking for New Ways to Advertise?

    Engage with tech pros in our community with native advertising, as a Vendor Expert, and more.

    Suggested Solutions

    Title # Comments Views Activity
    xp cannot copy or paste from folder to folder 16 118
    XP won't boot 27 125
    Virtual PC for Windows 10 18 135
    Map drive keeps removing itself 9 45
    Most of the time we are in fix when all of sudden our systems behave weirdly.  Such problems cost time and effort... so it's best to take some preventive actions so that we can avoid such issues or overcome such problems more easily. Preventive M…
    Disclosure: Use this tutorial only when no other options helps to get Windows XP running without any problems and you don't want to format the drive. The back up of the data is the responsible of the user, however there is a description of how t…
    Need more eyes on your posted question? Go ahead and follow the quick steps in this video to learn how to Request Attention to your question. *Log into your Experts Exchange account *Find the question you want to Request Attention for *Go to the e…
    Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…

    761 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    9 Experts available now in Live!

    Get 1:1 Help Now