I have a 200 ms response to a tracert (Windows) query, which I need to understand. I ran a capture, and find multiple name queries (NBSTAT) before each group of pings.
I know the following:
NetBIOS over TCP is enabled
The source machine is on one domain, and the destination is on another
The source machine is on one subnet, and the destination is on another
I am using port mirroring on an HP enterprise switch, which is doing the routing
How do I figure out what is happening ?
