Netbios broadcasts

[Mike Keys]

I have several HPUX servers that are trying to connect to an IP of 10.1.1.3 using the netbios port of 137. Of course, the above IP is not defined anywhere in /etc/hosts and Samba is not enabled nor running on these servers. I've run netstat and grep'd for 137 but nothing.

How can netbios be running on these servers? the reason that this is an issue is because these servers are hammering our firewall with these requests.

I would like to turn off Netbios completely, but if Samba is not running then how can I.

Mike Keys

[Chan 007]

Mike,

Why not use tracert from your Desktop and see which that host?

oe use nslookup with ip address?

This will help a bit.

Chan

[eric roseme]

Maybe you have an old AS/U NetBIOS implementation left over. With AS/U, NetBIOS was installed in the kernel. If you do not swremove it, it is still around.

Eric Roseme

[RAC_1]

Apart form ASU and samba check also check CIFS. If you have lsof, try to check as follows.

lsof -i tcp/udp:port_no

[eric roseme]

So I guess that none of these is the solution.

I worked on a case a few years ago where the IT admin said the same thing. When I looked at the logs, the entries showed that the HP-UX server was receiving the NetBIOS broadcast packet - not sending it. It turned out that another vendor's storage server was broadcasting a multi-homed registration request for a WINS server. It was a defect.

How about posting your log entry?

Eric Roseme

[Mike Keys]

O.K. not to be a dunce, but which log.

The IP address mentioned above is that of our master backup server which is on its own seperate network. We are running Netbackup and this server is backed up by that master server. Each unix server is its own master media server which talks to the master backup server. This allows each unix box to control its own backup (so far it's not 100%).

It's one of these setups where we dump the backup via fibre to a disk storage unit (ADIC Pathlight VX) and then the backup is dumped to tape after 'x' amount of days.

All of our Windows servers talk to the master server on the 10.*.*.* network via a secondary NIC card. We've had issues getting the unix backups to occur over fibre on several of our unix boxes but we can backup via the Windows master backup server (10.1.1.3) over copper directly to a tape in the robot. I wonder if something has occured by doing this that now has our unix servers broadcasting to see if the 10.*.*.* network is available, kinda like a heartbeat. Either that or our netbackup program is trying to resolve the name of the master backup server via netbios.

The problem is that our servers are on a 172.17.*.* network so those packets end up hitting our firewall.

Does any of this make sense? I think the issue is related to our Netbackup software but have no clue on how to resolve this.

Also, i'm not responsible for any typos....:)