Netbios Broadcasts

[k_babb]

Hi i am after some advice

i need to be able to find out what application/service is sending out net bios broadcasts on a network segment the requests are for machines that no longer are on the network but something is trying to obtain there ip address as they are not in dns any more i am assuming this is why they are resorting to netbios broadcasts i need to some how isolate what application or service is trying to find out. but have no idea how to go about it any help or advice would be great


thanks in advance

[stephengarbett]

Download wireshark and monitor your NIC on the server. You will be able to capture all packets, and identify the source IP of the host that sent the request.