Burst of NetBIOS traffic going to retired DC

Recently we noticed bursts of NetBIOS traffic that is originating from our Domain Controllers and going to an old domain controller that has been retired.  The old DC was on a network that has been removed from our network and is no longer accessible, so essentially these packets are going no where.  

When the domain controller was removed, we removed AD with dcpromo.  We then did a metadata clean up.  Then finally manually purged the DNS for any reference to the old DC.  When we noticed this occurring, I went back into the remaining DC’s, ran the meta data clean up again and the old DC still does not exist.  

I sniffed traffic off our LAN and inspected the NetBIOS packets and I see bursts of a lot of NetBIOS traffic going from our current DC’s to the old DC.  We are talking like 1500 packets in the course of 5 seconds.  There are three basic packets I see, these were taken with a tcpdump –vvv:


18:06:20.655165 IP (tos 0x0, ttl   1, id 28553, offset 0, flags [none], proto: UDP (17), length: 78) A.A.A.A.61452 > X.X.X.X.137: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
TrnID=0xFA21
OpCode=0
NmFlags=0x10
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=AUTODISCOVER    NameType=0x00 (Workstation)
QuestionType=0x20
QuestionClass=0x1



18:14:19.463478 IP (tos 0x0, ttl   1, id 29257, offset 0, flags [none], proto: UDP (17), length: 78) A.A.A.A.53064 > X.X.X.X.137: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
TrnID=0x8110
OpCode=0
NmFlags=0x10
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=WPAD            NameType=0x00 (Workstation)
QuestionType=0x20
QuestionClass=0x1



18:16:52.553095 IP (tos 0x0, ttl 109, id 2072, offset 0, flags [none], proto: UDP (17), length: 78) A.A.A.A.61452 > X.X.X.X.137: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST
TrnID=0xFA51
OpCode=0
NmFlags=0x10
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=ISATAP          NameType=0x00 (Workstation)
QuestionType=0x20
QuestionClass=0x1



I have searched the interwebs for a solution but to no avail.  Can anyone tell me how I can stop this form occurring?

LVL 1
logicb0mbAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Bruno PACIIT ConsultantCommented:
Hi,

These look like WINS queries... Your current DCs search for NetBIOS names "AUTODISCOVER", "WPAD" and "ISATAP"... As these queries are sent to a specific IP address, not a broadcast address, this means your old server is still appearing as a WINS server on the IP configuration of a netcard on your new DC.

What is also possible is that the DNS server service on your new DC is configured to interrogate WINS server in case of unknown DNs name...

Go on DNS management console on your new DC. Select the DNS zone and open properties. Click on the "WINS" tab to check if WINS search is enable.

Have a good day
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
logicb0mbAuthor Commented:
I found one of our zones with a WINS forwarder to the old server.  I have removed it and the traffic seems to have stopped.  I am monitoring the traffic to confirm that I no longer see the NetBIOS traffic.

0
logicb0mbAuthor Commented:
I have been monitoring the traffic and it appears to have disappeared.

There was 1 record out of 50 that had the setting described.  That was enough to cause this problem.  

Thanks for the help.

0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Databases

From novice to tech pro — start learning today.