Windows Server 2008 Thread, Broadcast Storm LLMNR in Technical; Hi Folks,
I have a Windows Server 2008 box that on Wednesday starting firing out LLMNR packets on port 5355. ...
16th June 2009, 10:53 AM #1
- Rep Power
Broadcast Storm LLMNR
I have a Windows Server 2008 box that on Wednesday starting firing out LLMNR packets on port 5355. At it's peak it was firing 29,000 a second. Which crippled our network and some of the sourounding schools lost the internet.
I have disable IPv6 on the NIC and have used group policy and a registry hack to disable LLMNR traffic but I still have the storm occuring.
NOD 32 show nothing and Search and Destroy comes back clean.
I don't want to rebuild this server as it it one of our application servers. I could use a backup but I'm afraid that without knowing the cause or cure it might occur again.
16th June 2009, 12:39 PM #2
Last edited by SYNACK; 16th June 2009 at 12:41 PM.
23rd June 2009, 02:31 PM #3
- Rep Power
I've already tried both of those but to no avail. It now looks like with the exception of my Exchange server all of my Win 2008 and Vista machines broadcast on the network immediatley.
My next step will be to 'pull' buildings off the network to see if a machine in an adjacent building is telling these machines to broadcast. SpyBot S&D and NOD32 both come back negative.
Any other ideas?
By damien.deakes in forum How do you do....it?
Last Post: 25th July 2008, 01:23 PM
By magicker2 in forum Network and Classroom Management
Last Post: 15th May 2008, 02:26 PM
By SteveBentley in forum How do you do....it?
Last Post: 11th April 2008, 10:22 PM
By armadillo in forum Network and Classroom Management
Last Post: 17th October 2007, 12:45 PM
By CyberNerd in forum Educational Software
Last Post: 15th March 2007, 03:09 AM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)
Tags for this Thread