Windows 7 PC sends a lot of NetBIOS Name Queries for non-existent computer names

Question

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names.

These are some of the ones I've seen it send...

• Name query NB AURORA_NT
• Name query NB WPAD
• Name query NB UTI
• Name query NB WORK
• Name query NB WORKGROUP
• Name query NB CRESTLINE

Does anyone have ideas?

---

I just discovered that the queries for WPAD seemed to be related to Outlook. It seems that WPAD is for Windows Proxy Auto Discovery. So, if you have "Automatically detect proxy settings" turned on, then the WPAD name queries would be normal.

This still doesn't explain AURORA_NT...

Solution 1

AURORA_NT, UTI, WORK, WORKGROUP and CRESLINE could all be devices that have once been on the network, and windows still wants their IP to talk to them.

Try cleaning out your old shared printers, mapped drived, network neighborhood or whatever it's called these days.

Solution 2

Further to @user214435's answer, apparently if you've ever connected to a print server, it gets stored and your computer will continue to try to contact it until you explicitly tell it not to. Unfortunately, it seems that you need to enter the extensive labyrinth that is the Windows Registry to do this. Thankfully, here's the location you need:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Print\Providers\Client Side Rendering Print Provider\Servers

Remove old server names from there and it should stem the NetBIOS flood.

Comments

[Elliptical view]

You might look in .. Windows/System 32/Drivers/etc/hosts Also try shutting down some services to see where they are coming from. I'm guessing you are using something like WireShark so you can see them?

[Prerak Diwan]

I would give you an upvote if you told us how to clean out those things ;)