["Sarun Suttivisatchai" <Sarun_Sut@xxxxxxxxxxxxxxxxx>]

Hi Vijay,

This may or may not declare as the problem if you are:
1.	intending to use the feature of NLB – Network Load Balancing.  It may not declare as the problem. 
		The NLB is a default feature after you install the Win2K Advance Server.  By its nature, this protocol will broadcast every second.  So, it will generate a huge traffic in the network.  The reason why you can not find the source IP, it is because of this protocol will use the virtual MAC Address.  So, you may not find any IP of this virtual device.  By recommendation from Microsoft, if you really need to use this protocol, you have to run this protocol in another physical segment.

2.	not intending to use the feature, it should be a problem to you.
	I always find that this is the incorrect installation of my users who need to build a box of Win2K Advance Server in my network for testing.  It will be better to give them the information about this default feature how it impacts to our network.  By the other hand, it should be build the awareness to them by telling the Network Engineering or Administrator Team before plug any workstation in the network.

	To disable this service, you can do it by disable on the Local Area Connection properties->Click install->Service to list all the Network Service, then you will find the “Network Load Balancing”.  If you do not really need to use it, remove it.

	I know that it is quite hard to find which host is generate such a broadcast in the network, but I think the Win2K Advance Server Box may not install much more than you effort.  Good luck.

Best Regards,
Narong  Tanprasert.
CRM & Call Center
TelecomAsia  Corporation Public Co.,Ltd.
Tel : (662) 0-699-1532
E-Mail : Narong_Tan@xxxxxxxxxxxxxxxxx


	-----ข้อความต้นฉบับ-----
	จาก:	Guy Harris [SMTP:guy@xxxxxxxxxxxx]
	ส่งเมื่อ:	20 ธันวาคม 2003 16:28
	ถึง:	Vijay Kumar
	สำเนาถึง:	ethereal-users@xxxxxxxxxxxx
	เรื่อง:	Re: [Ethereal-users] Vijay - network broadcast problem.

	On Sat, Dec 20, 2003 at 12:06:17AM -0800, Vijay Kumar wrote:
	>  I am receiving a broadcast packets on my network of Ethertype x886f 
	>  sourced from MAC address 02:01:00:00:00:00 and destination is 
	>  ff:ff:ff:ff:ff:ff
	>  On some ethereal , I can see this broadcast as "MS NLB heartbeat"
	>  and on  some I just see them as "Ethernet II"

	Ethereal first recognized that in 0.9.16; older versions won't recognize
	it.

	>  Also I have read the link : 
	>  http://www.ethereal.com/lists/ethereal-users/200202/msg00013.html
	> 
	>  But I am not able to find the source IP Address / machine. 

	Those packets just run atop Ethernet; there *is* no source IP address.

	>  Please help me in finding out the solution. 
	> 
	>  Currently I am also trying to change the HUB and check whether the 
	>  problem is on the HUB. 

	You say "problem" and speak of a "solution"; this isn't necessarily a
	problem.  Those packets appear to be sent out with a Windows 2000 server
	feature:

		http://www.microsoft.com/technet/treeview/default.asp?url=/TechNet/prodtechnol/windows2000serv/deploy/confeat/nlbovw.asp

	(about which I know nothing, so if you want details, check that URL). 
	Perhaps the only "problem" is that you have, on your network, Windows
	2000 (or Windows 2003 Server?) machines with the Network Load Balancing
	feature enabled.

	_______________________________________________
	Ethereal-users mailing list
	Ethereal-users@xxxxxxxxxxxx
	http://www.ethereal.com/mailman/listinfo/ethereal-users


- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
This message may contain legally privileged, proprietary and/or confidential information. If you are not the intended recipient, any review, dissemination or copying of this message is prohibited.  Please notify us immediately by replying to this email, notifying us of your receipt. Please delete this email after you have notified us. The information regarding the sender is not intended to be a signature for purposes of binding the sender or the company to any contract or agreement under the Electronic Transaction Act.