I'm running netprobe 0.4 on an NT4.0 box on a small Windows network (no Novell) and I see a large number of ether.NETBIOS (LLC/SAP F0F0) packets (and bytes). In fact, it is the largest amount of traffic by several orders of magnitude. When I try to see what hosts are generating this traffic, nothing appears. Can anyone tell me where to start looking to identify what might be flooding these packets across our network?
If I understand properly, since the machine that is "sniffing" or running network probe is directly connected to the switch (as are most other machines on the network), I am only seeing those packets which are not sent directly to their intended recipient by the switch? To see this traffic, I would have to enable "spanning" on the switch as per the page you referenced? Do I have it right?
Thanks again for your quick (and informative comments!) I am trying to identify some strange behaviours on the network (large database programs slowing down erratically).