WINS Expert?

[D Grayston]

Anyone out there an expert on WINS?

All WINS servers send out an IGMP packet to multicast
address 224.0.1.24 by default at startup. Then every
40min announce their presence throughout your network
looking for auto-replication partners. We have 100+ WINS
servers that should only be replicating with configured
partners. No reason for these servers to try to find auto-
replication partners - there aren't any.

KB article Q151761 full describes this behavior. The
registry settings suggested in the article, I find, have
zero affect on these announcements.

I'd like to stop this traffic for several reasons. 1) our
host based firewall software is blocking response to these
announcements at a rate of 4 per minute = about 5000/day,
2) a side affect of the blocking is generating an EventID
4204. 3) The System Event log is full within 2 days.

Tough question for this group but any help is appreciated.

David

 

[NuT CrAcKeR]

For starters... you have wayyyyyyyyy too many WINS servers. You will run
into problems with losing <1C> records after the 21st server is added to the
environment.

There is a limit to the number that you can have in an environment, and it
is likely that you are running into replication and database convergence
issues as well.

As for your multicast group question, i have never witnessed this behavior
before. Sorry i can t help you with that.

NuTs

 

[D Grayston]

Thanks for the thoughts.

As for the number of WINS servers.....each
department/school/administrative unit does their own
thing. But we all share the infrastructure. Hence 100's
of WINS servers that have nothing to do with each other.

All the multicast traffic is default behavior of WINS -
try blocking port 42 and you'll see it. It wants to ping
all possible WINS servers it can and replicate if possible
(sounds virus like) every 40min.

We do have an odd, very open structure, with each unit
being very automomous. Our routers were all upgraded a
few weeks ago - now the multicast traffic that was once
confined to the subnet gets sent throughout the campus -
they tell me it is an 'upgrade'.

David