NetBios Broadcast/Browser

I have a few servers that are running Cisco Works. Lately they appear to be
running slow. Still working on it.

One of the ideas that my group is thinking about doing is to turn the
Computer Browser off. I have done that threw the services and I also told
the server not to maintain a list of servers.

We are currently in a peer to peer network. With that said, I have done
captures of the network packets and I still see broadcast packets coming from
the computer. The broadcast packets are coming out of port 138 that has the
computer name still in there.

I also have broadcast packets being sent out on port 137. I would like to
shut both of those down. Can I shut both of those ports down? If I do, what
will it effect?

I'm trying to eliminate excisive traffic coming out of the servers.

I thank you for all your help.
Terry

The broadcast packets are most likely the host name announcement
packets. You can hide the computers from the browse list and prevent
the host name announcement packets by editing the registry. Add the
following:

Hive: HKEY_LOCAL_MACHINE
Key: \SYSTEM\CurrentControlSet\Services\LanmanServer\Pa rameters
Name: Hidden
Data Type: dword
Value: 00000001

As far as closing the ports you could get away with this in a pure W2k
or higher environment.


"Harddrive747" <(E-Mail Removed)> wrote in message
news:
> I have a few servers that are running Cisco Works. Lately they appear
to be
> running slow. Still working on it.
>
> One of the ideas that my group is thinking about doing is to turn the
> Computer Browser off. I have done that threw the services and I also
told
> the server not to maintain a list of servers.
>
> We are currently in a peer to peer network. With that said, I have
done
> captures of the network packets and I still see broadcast packets
coming from
> the computer. The broadcast packets are coming out of port 138 that
has the
> computer name still in there.
>
> I also have broadcast packets being sent out on port 137. I would
like to
> shut both of those down. Can I shut both of those ports down? If I
do, what
> will it effect?
>
> I'm trying to eliminate excisive traffic coming out of the servers.
>
> I thank you for all your help.
> Terry

"Harddrive747" <(E-Mail Removed)> wrote in message
news:7A7EFA48-BDE0-4F53-8D29-(E-Mail Removed)...
> I have a few servers that are running Cisco Works. Lately they appear to
be
> running slow. Still working on it.
>
> One of the ideas that my group is thinking about doing is to turn the
> Computer Browser off. I have done that threw the services and I also told
> the server not to maintain a list of servers.
>
> We are currently in a peer to peer network.

Then the odds of the NetBIOS traffic being your main
culprit OR your users being conformatable without
browsing are both very low.

You probably should LEAVE the NetBIOS support (MS
Windows, even Win2003 has troubles without it) and
add a WINS server.

The clients (by default or set through DHCP) can then
query WINS with directed data grams and other than
the service annoucement you won't have so much broacasts,
and the service announcements should NOT have to leave
a subnet.

ALL machines need to be "WINS clients" in this case,
include "servers" , even the WINS server itself.

> With that said, I have done
> captures of the network packets and I still see broadcast packets coming
from
> the computer. The broadcast packets are coming out of port 138 that has
the
> computer name still in there.
>
> I also have broadcast packets being sent out on port 137. I would like to
> shut both of those down. Can I shut both of those ports down? If I do,
what
> will it effect?

Use a WINS server and it will all work without most
of that.

How many stations do you have?

In a peer network it is not likely to be that many...

> I'm trying to eliminate excisive traffic coming out of the servers.


--
Herb Martin


>
> I thank you for all your help.
> Terry