Getting lots of NetBios NBTSTAT Queries after upgrading to MR3 not having this issue prior.

[wmiller]

Getting lots of NetBios NBTSTAT Queries after upgrading to MR3 not having this issue prior. I have 2x 110c on MR3. I have a IPSEC VPN Tunnel between the 2 offices. I have a DC Svr2k3r2 each side. I have rescently upgraded both to MR3. Now I have this problem ---> Solids for few days now. 2011-03-30 11:57:06 10.0.10.10 10.0.0.10 137/udp netbios: NBTStat.Query, repeated 3 times 2011-03-30 11:56:58 10.0.10.10 10.0.0.10 137/udp netbios: NBTStat.Query 2011-03-30 11:56:57 10.0.10.10 10.0.0.10 137/udp netbios: NBTStat.Query 2011-03-30 11:56:55 10.0.10.10 10.0.0.10 137/udp netbios: NBTStat.Query 2011-03-30 11:44:51 10.0.10.10 10.0.0.10 137/udp netbios: NBTStat.Query, repeated 3 times I have spam and virus scanned both servers, rebooted them, and cleaned out profiles and temp files, with multiple programs (adware, spybot, McAfee Stinger, and Norton as far as scanners and specific use items not full on programs). Noting found. So either I am missing something that changed between MR2 Patch 2 to MR3 and need to make a few changes, or I now have a new problem that just happen to come up with in a few days of upgrading and never had this issue before. Any input would be greatly appreciated.

[Carl_Wallmark]

i would say Application Control, are you logging in the application control ?

[wmiller]

Hmmmmmm Dam I love when there is no course of action. I men I cuold block it i guess. NBTStat.QueryRelease Date Sep 11, 2006 Severity Info Impact Attackers can gain sensitive information about the network in preparation for future attacks. Description It indicates detection of an NBTStat query. NBTStat can display NetBIOS statistics, name tables for both local and remote systems and the name cache. A remote attacker can use this information to prepare for further attacks. Affected Products Any unprotected Microsoft Windows system running NetBIOS is vulnerable. Recommended Actions N/A

[ejhardin]

Device 10.0.10.10 and 10.0.0.10 are both NETBIOS enabled machines. If they are not in a domain and you use dns or a host file for resolving names then just disable NETBIOS on both machines. If you are in a domain then review your network and decide if NETBIOS is necessary. We do not use WINS or NETBIOS. We are 100% DNS. We also do not use link-layer or mdns but that is a different topic. NBTSTAT queries are simply Microsoft and IBM’s why of finding machines on the same subnet so that networking is simple and easy. For example if you have a home network and NETBIOS enabled then it will continuously send out NBTSTAT queries to find computers on the net to talk too. So when you go to Network Neighborhood you see your computers on the network.

[ede_pfau]

Isn' t there a Windows feature called ' Network Awareness' or such which relies on constant network browsing? I think it has been around since XP and can be disabled. You configure it in Folder Options, Advanced, uncheck " Automatically Search for Network Folders and Printers" , or the corresponding GP. Yes, I know that it is automatically disabled if you' re in a domain or if more than 32 devices are found during the scan. So maybe you' ve got a non-domain PC on your network now...

[wmiller]

Ede.. Well explained. Outstanding. But... Both of those IPs are my 10.0.0.10=DC/GC and 10.0.10.10 2nd DC/exchange @ a small corp office with 10 pcs and I can see all of them. 2 DCs doing lots of NBTSTAT queries back and fourth has nothing to do with fortigates there selves. This would be 2 servers having a heavy conversation. I was stating in logging and looking at old logs i have sitting around i dont see these line items anywhere period before the day I upgraded to MR3. By the way i have not taken the time to read about the forum itself. How do you score?

[ede_pfau]

I' m certainly not the expert for Server2003R2 but...as DCs they might query not because of themselves but on behalf of a domain member. So maybe it is not so far fetched to think of a recent change on your network. Apart from the annoyance, do these queries amount to a huge part of your bandwidth? Where do you see the log entries you gave us in your first post, just the Traffic Log? I' m more than happy if you fellow forum members dig what I contribute - I get plenty back when someone (finally) says it helped to solve his problem. After all, this is fun! If you even want to score a post you can click the " Rate this post!" link in the leftmost column.

[ejhardin]

This is not a firewall issue it is a server config. You need to read up on DC to DC traffic and configure based on your networks needs. If you are wondering why you were not see the traffic before the upgrade then you need to compare the firewall config file for anything that has changed. You never stated if this is from the app logs or IPS log. If IPS log note that they did change amount of IPS signatures that are logged and enabled. It is in the release notes. Basically it is not a firewall issue and needs to be resolve at the server level.