netbios query in tracert capture

asked 2018-04-04 17:20:25 +0000

I have a 200 ms response to a tracert (Windows) query, which I need to understand. I ran a capture, and find multiple name queries (NBSTAT) before each group of pings.

I know the following:

NetBIOS over TCP is enabled

The source machine is on one domain, and the destination is on another

The source machine is on one subnet, and the destination is on another

I am using port mirroring on an HP enterprise switch, which is doing the routing

How do I figure out what is happening ?

edit retag flag offensive close merge delete


Hello big-bite

Don't know if this is still an issue.

To answer this question we need some information:

  • What operating system is the source system?
  • Do you specify the remote system by name or by IP address?

Assuming that you run tracert on a Windows system:

  • Do you use a WINS server? (probably not, check with ipconfig /all)
  • What NetBIOS node type is configured (probably H-node, check with ipconfig /all)
  • What is the name resolution policy?

Of course the most important question is: When do you migrate your legacy Windows hosts to a more recent operating system, that runs SMB2 (or better: SMB3).

Good luck

Eddi gravatar imageEddi ( 2018-04-19 18:55:16 +0000 )edit