This is a static archive of our old Q&A Site. Please post any new questions and answers at

Odd NETBIOS traffic


It is to my understanding that NetBIOS operates on port 137. I'm seeing NetBIOS traffic going from my machine to a remote address associated with an AT&T based IP address. I have that port blocked so I don't know why NBNS traffic is still showing up.

Please see below. I think this is a cause for concern.

alt text

asked 14 Jun '15, 12:26

Beldum's gravatar image

accept rate: 0%

One Answer:


The NB name queries are broadcast packets being sent by, looking for a host named WPAD.

The NBSTAT name queries are attempts by some Windows machine on your network to try to determine the NetBIOS host name for; that's just what Windows does, at least if it's configured to use NetBIOS-over-TCP, if some program is trying to find a host name for - it might try DNS first, and fall back on NetBIOS-over-TCP if that fails, or it might even try NetBIOS-over-TCP first.

answered 14 Jun '15, 13:37

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%