First, take a general look at the network. Then, look for suspicious patterns:
- Connect Wireshark to the network. Make sure the workstation running Wireshark is on the same broadcast domain as the clients that are having the problems.
- Configure the display filter nbns.flags.response == 0. It will give you the NBNS requests. You will see many broadcasts, as shown in the following screenshot:
Figure 15.1: NBNS packet types
- As you saw in the preceding screenshot, in the capture file you will see the following:
- NBNS registration packets (1): In the examples, there are registrations with the names WORKGROUP and ETTI. The NBNS server ...