Excessive network traffic

[shadow57]

Hello all.

Our school network had 100 workstations NT4/XP Pro mixture with NT4 Servers and ran great..

We hired a company to purchase a new server and do a server migration to 2003.

After they finished the upgrade problems started

Most problems have been solved but we have still got excessive traffic on the network slowing it down.

I used Ethereal to analyse the traffic and discovered that the excess traffic was the workstations doing NBNS broadcasts for the previously NT4 removed server.

It turns out that the broadcasts are WINS. They are for computers that do not exist on this domain but did exist

on the previous domain at one time but were removed.

The only way, it seems to stop this, is to reinstall the workstations.

Has anyone got any idea what went wrong or how to stop the machines from broadcast for these non existing machines.

Thanks John

Edited February 4, 2006 by shadow57

[cluberti]

Have you tombstoned all of the records for the old machines in the WINS database, and cleared out the NBT cache on the workstations?

Also, was this a domain migration, or did you simply create a new domain and migrate all the machines over?

[Mr Snrub]

...

It turns out that the broadcasts are WINS. They are for computers that do not exist on this domain but did exist on the previous domain at one time but were removed.

The only way, it seems to stop this, is to reinstall the workstations.

...

If the broadcasts come from the clients and stop if they are rebuilt, then something is lingering in the client with a reference to the NetBIOS names of the old NT4 boxes.

I would take a look in the C:\WINNT\SYSTEM32\DRIVERS\ETC\LMHOSTS file first.

If they are broadcasting for the names of the servers then it's probably not configured with those as WINS servers as you would have those listed by IP address, but it's worth double-checking the client network config.

Rather than rebuild the workstations, does it help if you remove them from the domain and re-add them instead?