Background
Had an insomnia night last week. And, so took to the laptop and wanted to troubleshoot an issue.
As part of that troubleshooting exercise I knew Network Traffic Pattern might be pertinent.
Wireshark
Network Traffic
Here is sample of some of what I noticed through capturing Network Traffic.
Image
Explanation
Noticed a lot of Name Resolution Traffic.
Inclusive of protocols that line up with Network Resolution issues are DNS & NBNS.
DNS stands for Domain Name Server and NBNS Stand for Netbios Name Server.
Netbios Name Server ( NBNS )
Though running Windows. it is no longer a Netbeui World.
Strictly TCP/IP.
Review Configuration
Let us review our Network Configuration on specific adapters.
As I am currently on wireless, let us focus on just the Wireless Adapter.
GUI
Here is how to do so through the GUI.
Wireless Network Connection 2
Advanced TCP/IP Settings – WINS
Image
Explanation
Currently, we are set to receive NetBIOS Settings from the DHCP Server; that appears to be the default MS Windows Setting.
Command Line Shell
And, here are a couple of options to do so via the Command Line Shell.
ipconfig
Script
ipconfig /all
Output
Explanation
NetBIOS over Tcpip is Enabled
WMI – Query – Win32_NetworkAdapterConfiguration
Script
set _hostname="." set _propList="DHCP*,IPAddress,DefaultIPGateway,DNSDomainSuffixSearchOrder,DNSEnabledForWINSResolution,DNSServerSearchOrder,TcpipNetbiosOptions" set _command="Get-WmiObject -Class Win32_NetworkAdapterConfiguration -Filter IPEnabled=TRUE -ComputerName %_hostname% | Select-Object -Property %_propList% " powershell -Command %_command%
Output
Explanation
- TcpipNetbiosOptions
- 0
- Default Setting; and we remember default settings is to get the setting from the DHCP Server
- 0
WMI – Set – Win32_NetworkAdapterConfiguration
Let us use wmic and pass along the nicconfig verb; calling the SetTcpipNetbios method and sending along argument 2.
Remember 2 mean Netbeui disabled.
Please pass along the right index, as well.
Each NIC Card has an index and it is displayed when one queries the Network Configuration.
Script
REM - Use NetBIOS setting from the DHCP server set _netBiosSettingDHCPServer=0 REM - Enable NetBIOS over TCP/IP set _netbiosSettingEnabled=1 REM - Disable NetBIOS over TCP/IP set _netbiosSettingDisabled=2 set _hostname="." set _index=15 wmic nicconfig where index=%_index% call SetTcpipNetbios %_netbiosSettingEnabled%
Image
Confirmed Change
GUI
Image
Console
Image – ipconfig /all
Wireshark – Take 2
Network Traffic
Went back to Wireshark and took another trace.
Image
Explanation
Noticed a slew of NBNS Traffic targeted at our DNS Server.
BTW, our local DNS Server are set for “Recursion Desired“.
That way they can forward unresolved Name Resolution traffic to our ISP…Which will be most of the requests we get.
Remediation
Connected to each of our internal DNS Servers and disabled Netbeui Name Resolution on the NIC Cards, as well.
Windows DHCP
If we had a Windows DHCP Server, would have disabled that option on the DHCP Scope, as well.
Wireless Access Point ( WAP )
I doubt that our Wireless Access Point supports DHCP and so will skip that step for now.
References
- Client Configuration
- Script
- Tim Dunn
- Tim Dunn – Is NetBIOS over TCP/IP Enabled?
Posted On :- 2011-June-29th
Link
- Tim Dunn – Is NetBIOS over TCP/IP Enabled?
- Scripting Guy
- Use PowerShell to Identify Your Real Network Adapter
Posted On :- 2011-Oct-7th
Link
- Use PowerShell to Identify Your Real Network Adapter
- T.dejesus
- Simple powershell help
Posted On :- 2014-April-14th
Link
- Simple powershell help
- Dan Stolts, ITProGuru
- Using PowerShell to Get or Set NetworkAdapterConfiguration-View and Change Network Settings Including DHCP, DNS, IP Address and More (Dynamic AND Static) Step-By-Step
Link
- Using PowerShell to Get or Set NetworkAdapterConfiguration-View and Change Network Settings Including DHCP, DNS, IP Address and More (Dynamic AND Static) Step-By-Step
- Q/A
- Slow Cross-Domain login to StoreFront site
Link
- Slow Cross-Domain login to StoreFront site
- Visual
- Jim Boyce
- Get IT Done: Improve network performance by disabling NetBIOS over TCP/IP
Published On : -2002-Nov-5th
Link
- Get IT Done: Improve network performance by disabling NetBIOS over TCP/IP
- Jim Boyce
- Server Configuration
- How to disable NetBIOS over TCP/IP by using DHCP server options
Link
- How to disable NetBIOS over TCP/IP by using DHCP server options