Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Windows 7 PC, and have been monitoring network traffic using Wireshark, and I'm seeing this PC send out a lot of NetBIOS Name Queries for non-existent computer names.

These are some of the ones I've seen it send...

  • Name query NB AURORA_NT
  • Name query NB WPAD
  • Name query NB UTI
  • Name query NB WORK
  • Name query NB WORKGROUP
  • Name query NB CRESTLINE

Does anyone have ideas?

I just discovered that the queries for WPAD seemed to be related to Outlook. It seems that WPAD is for Windows Proxy Auto Discovery. So, if you have "Automatically detect proxy settings" turned on, then the WPAD name queries would be normal.

This still doesn't explain AURORA_NT...

share|improve this question
You might look in .. Windows/System 32/Drivers/etc/hosts Also try shutting down some services to see where they are coming from. I'm guessing you are using something like WireShark so you can see them? – Eliptical View Feb 2 '14 at 18:01

AURORA_NT, UTI, WORK, WORKGROUP and CRESLINE could all be devices that have once been on the network, and windows still wants their IP to talk to them.

Try cleaning out your old shared printers, mapped drived, network neighborhood or whatever it's called these days.

share|improve this answer
I would give you an upvote if you told us how to clean out those things ;) – KronoS Apr 5 '13 at 14:35

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.