NetBT Event ID 4321 and SNMP request?

[raseron]

running xp home sp2 on a laptop, connecting via a cisco vpn client (v5.x)

i'm not sure where to post this, so i'll start here, seeing as the laptop
seems to be at the root of the issue.

the issue:
it all started because I was getting warnings from our Environmental
Monitoring appliance that it “Received SNMP request with unsupported
community string 'public'.†I tracked the message to a specific laptop, when
it is connected to our network via our vpn.
by checking the laptops event log, and on subsequent ‘live’ observation, I
noticed that the SNMP warning occurs at the same time that the laptop’s
system event log shows a series of NetBT errors, like so:

“Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4321
Date: 6/4/2008
Time: 4:57:44 PM
User: N/A
Computer: LAPTOP
Description:
The name "WSXP032 :0" could not be registered on the Interface with
IP address 192.168.10.200.
The machine with the IP address 192.168.10.91 did not allow the name to be
claimed by this machine.â€

any idea if/how these two things are related? I’ve been reading up on NetBT
and have been trying to figure out how it could be related to the SNMP
request on my Environmental Monitoring appliance, but I’m at a loss.

thanks in advance.
ross

 

[VorDesigns]

Hi,

Take a look here:

http://support.microsoft.com/default.aspx?scid=kb;EN-US;822659
http://support.microsoft.com/default.aspx?scid=kb;EN-US;291382

 

[AdiGri]

A few comments about event id 4321 here:

http://www.eventid.net/display.asp?eventid=4321&eventno=1822&source=NetBT&phase=1

However, I can't see how would a NetBIOS problem would be directly
related to an SNMP request. Chances are there is some software
installed on that laptop that attempts to "discover" the network by
scanning the hosts and sending the default "public" SNMP community
name (in case the remote host is configured to respond to such
requests). The 4321 event might simply indicate that there is another
computer with the same name (the 0 at the end indicates the computer
tried to register the "Workstation Service" but it conflicted with
another machine that has that name).

Adrian Grigorof
www.eventid.net