Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm noticing on MS Network Monitor a ton of NetBios Name Service broadcasts coming from a particular workstation. When I run netmon on that desktop it cannot resolve the application producing them (but does log them).

First question, is this bad?

Next question, what could be causing this so we can either move it to a server or stop it entirely?

The workstation is Windows XP with no attached printers. A "ton" is 1 broadcast every 2-5 seconds.

share|improve this question
How much is a 'ton'? Does the desktop have an attached print printer that it is sharing? What OS is the desktop? – Zoredache May 5 '10 at 18:26
1 every 2-5 seconds doesn't seem bad. If you have some packet capture software you should be able to find out more info about the broadcast. – dbasnett May 9 '10 at 13:53
up vote 2 down vote accepted

I'm not sure how to trace why it's broadcasting, but if you want to disable NetBios on that workstation follow the directions from here:

  1. Click Start, Control Panel, and then click Network Connections.

  2. Right-click Local Area Connection, and then click Properties from the shortcut menu.

  3. Select Internet Protocol (TCP/IP), and then click the Properties button.

  4. When the Internet Protocol (TCP/IP) Properties dialog box opens, click the Advanced button.

  5. Click the WINS tab.

  6. Click the Disable NetBIOS Over TCP/IP option.

  7. Click OK to close the Advanced TCP/IP Settings dialog box.

  8. Click OK to close the Internet Protocol (TCP/IP) Properties dialog box

  9. Click OK to close the Local Area Connections dialog box.

The document also might give you some pointers on troubleshooting it.

Edit: You can disable NetBios, and then see if any of the applications on that workstation break. Then you'll have another avenue for troubleshooting.

Edit: You can also user Wireshark to do a packet trace on the NIC of the workstation and find out what it's looking for.

share|improve this answer

If you cannot find the application with netmon, try some tools from sysinternal:

Sysinternals Process Utilities:

Sysinternals Networking Utilities:

If I were you, I would like to try 'Process Monitor' first.

share|improve this answer

To answer your first question -yes , because sending broadcasts will clog your network/consume bandwidth.

It could be that the workstation is trying to find a name that is repeatedly failing and is resorting to NetBios all the time to try to find that name.

share|improve this answer

Check if there are some old printers or shares setup on that machine that no longer exist.

Check My Network Places to see if you have any other cached connections.

See if stopping the indexing service helps.

share|improve this answer

Stop the Workstation Service and it will stop making these netbios requests. I was on my laptop on a public network and I noticed that my laptop was broadcasting the names of all the computers on my home network over and over again, and since I dont want the names of my home computers being broadcasted anywhere but at home, whenever i leave the house I make sure to turn off that pesky Workstation service as soon as I remember. Microsoft should make this more clear and I googled this for a while before figuring it out myself by turning off random services until the workstation service finally stopped it.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.