Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials

Netbios port scan by Orion server

Hi,

Our Orion server is continuously using Netbios (UDP 137) port to reach out to all the devices that are monitored by the Orion tool, Please help me to identify why this is required and see if it could be stopped.

Background - We are seeing a lot of traffic at the Firewall and Security guys want it to be cross-checked.

NPM 9.5.1, NCM 5.5.0. NTA 3.7

I se a post aready present in forums, however I could not understand how to disable it.

Thanks,

Harry

Find more posts tagged with

Accepted answers

GoldTipu

This is more than likely attributed to NetBIOS

This is due to the behavior of Windows servers that use NetBIOS (as well as DNS) to resolve IP addresses to names using the "gethostbyaddr()" function.

This shouldn't be too big of a concern for you.

You might want to disable the NetBios Over TCP/IP protocol on the interface and use the <font color="#13b4dc">LMHOSTS</font> file for the servers that needs to be resolved using NB names. That might be the case e.g. of the SQL Server.

You should no more have any NetBios Lookup Query trying to go through your firewall if you do so.

Some posts about the same issue:

[Netbios name resolution needed? | http://thwack.solarwinds.com/message/11158#11158]

[okay to disable NetBIOS over TCP/IP? | http://thwack.solarwinds.com/message/35428#35428]

[Re: Is NetFlow 3.1 Application Passive or Active??? | http://thwack.solarwinds.com/message/66253#66253]

[http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/wwhelp.htm?context=SolarWinds&file=OrionNetFlowPHDNSResolutionOptions.htm | http://www.solarwinds.com/NetPerfMon/SolarWinds/wwhelp/wwhimpl/js/html/wwhelp.htm?context=SolarWinds&file=OrionNetFlowPHDNSResolutionOptions.htm]

Disable on interface level.

NetBios+over+TCPIP.jpg

All comments

GoldTipu

This is more than likely attributed to NetBIOS

This is due to the behavior of Windows servers that use NetBIOS (as well as DNS) to resolve IP addresses to names using the "gethostbyaddr()" function.

This shouldn't be too big of a concern for you.

You should no more have any NetBios Lookup Query trying to go through your firewall if you do so.

Some posts about the same issue:

[Netbios name resolution needed? | http://thwack.solarwinds.com/message/11158#11158]

[okay to disable NetBIOS over TCP/IP? | http://thwack.solarwinds.com/message/35428#35428]

[Re: Is NetFlow 3.1 Application Passive or Active??? | http://thwack.solarwinds.com/message/66253#66253]

Disable on interface level.

NetBios+over+TCPIP.jpg

HarryInfy

Thanks Malik, a very naive question, Disabling this wont affect my Orion monitoring for any modules right?

keithdarl

We had exactly the same problem, and disabled the Netbios over TCP settings withinth eadaptors on the pollers as detailed by Malik, no negative impact on the systems were seen.

GoldTipu

Hi Harry.

It will not effect Orion monitoring and will not effect other modules .

Please let me know if you required further details or have any question .

If this worked for you or helped please mark this as answared for others.

Kind Regards

Radioteacher

We saw the same traffic and did the same proceedure to stop UDP 137 scanning.

The security team was happy. So are the System Admins.

Have a well monitored day!