From owner-freebsd-questions  Mon Sep  4 15: 8:44 2000
Delivered-To: freebsd-questions@freebsd.org
Received: from pop.hccnet.nl (pop.hccnet.nl [193.172.127.94])
	by hub.freebsd.org (Postfix) with ESMTP id 5BCB737B424
	for <questions@FreeBSD.ORG>; Mon,  4 Sep 2000 15:08:41 -0700 (PDT)
Received: from parmenides.utp.net by pop.hccnet.nl
	via uds1-115.dial.hccnet.nl [193.173.115.1] with ESMTP
	id AAA24873 (8.8.5/1.13); Tue, 5 Sep 2000 00:08:36 +0200 (MET DST)
Received: from localhost (janko@localhost)
	by parmenides.utp.net (8.9.3/8.9.3) with ESMTP id AAA01594;
	Tue, 5 Sep 2000 00:08:38 +0200 (CEST)
	(envelope-from janko@compuserve.com)
X-Authentication-Warning: parmenides.utp.net: janko owned process doing -bs
Date: Tue, 5 Sep 2000 00:08:38 +0200 (CEST)
From: Janko van Roosmalen <janko@compuserve.com>
X-Sender: janko@parmenides.utp.net
To: "Crist J . Clark" <cjclark@reflexnet.net>
Cc: Greg Lehey <grog@lemis.com>,
	FreeBSD Questions <questions@FreeBSD.ORG>, groggy@iname.com
Subject: Re: signature?
In-Reply-To: <20000903155613.O62475@149.211.6.64.reflexcom.com>
Message-ID: <Pine.BSF.4.10.10009050003250.1576-100000@parmenides.utp.net>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
X-Loop: FreeBSD.ORG



On Sun, 3 Sep 2000, Crist J . Clark wrote:

>  
> On Sun, Sep 03, 2000 at 10:26:18PM +0200, Janko van Roosmalen wrote:
> > The "netbios-ns" makes me think of a Windows 95/98/NT station or a
> > Samba server. 
> > 
> > Checking "/etc/services" however points to a bootp client.
> > 
> > bootpc          68/tcp          # BOOTP client
> > bootpc          68/udp
> 
> Uhh, but where do you see any traffic on this port?

[snip] 
> > > > 05:13:25.668925 groggy.45057 > 208.151.115.193.netbios-ns: udp 68
> > > > 05:13:25.668957 groggy.45057 > 208.151.115.193.netbios-ns: udp 68
> > > > 05:13:25.699102 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
> > > > 05:13:25.699133 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
> > > > 05:13:25.808811 groggy.46773 > 208.151.115.193.netbios-ns: udp 68
> > > > <snip>
> 
> I see 'netbios-ns' (137), 51488, 46346, 32996, 45057, and 46773 ports
> and every single one is sent to port 137. Are you talking about that
> trailing 68, the packet size?

Crist,

Yes, you are right. I was too focussed on the trailing 68. But at least I
know how to spell your name ;) 

Janko 




To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message