Workstations broadcasting DCERPC, network slow (2)

Hi!

I've got a bunch of workstations running Windows 98 that are broadcasting,
according to Ethereal, DCERPC traffic and slowing down the network to a
crawl.

This is the protocol info from Ethereal:

DCERPC Request: seq: 0 opnum: 0 len: 0 UNKUUID:
00000000-0000-0000-0000-000000000000 rpcver: 0

It's the same for all broadcasting machines all the time.

I scanned the machines with GFILanGuard NSS and it tells me that they're
running Windows 98 and that only ports 139 and 427 are open.

We are running Novell NetWare 5.x and 6.x in addition to Windows servers.

All computers have the Novell client installed.

I haven't been able to locate the machines physically yet...

What can be the reason for them to broadcast this?

Thanks!

Hard to say from what you posted but try running the free TCPView tool from
SysInternals on those computers once you locate them to see what the port to
process mappings are which should help you determine which application is
causing the problem. Otherwise install a personal firewall such as Zone
Alarm on them and wait for the application to try to access the network
which will cause a pop up box to show with the executable/process name.
There really is no way to know until you find the computers first. ---
Steve


"alekz" <(E-Mail Removed)> wrote in message
news:%23c%(E-Mail Removed)...
> Hi!
>
> I've got a bunch of workstations running Windows 98 that are broadcasting,
> according to Ethereal, DCERPC traffic and slowing down the network to a
> crawl.
>
> This is the protocol info from Ethereal:
>
> DCERPC Request: seq: 0 opnum: 0 len: 0 UNKUUID:
> 00000000-0000-0000-0000-000000000000 rpcver: 0
>
> It's the same for all broadcasting machines all the time.
>
> I scanned the machines with GFILanGuard NSS and it tells me that they're
> running Windows 98 and that only ports 139 and 427 are open.
>
> We are running Novell NetWare 5.x and 6.x in addition to Windows servers.
>
> All computers have the Novell client installed.
>
> I haven't been able to locate the machines physically yet...
>
> What can be the reason for them to broadcast this?
>
> Thanks!
>