Date: Sun, 3 Sep 2000 06:08:55 GMT From: groggy@iname.com To: "freebsd-questions" <questions@freebsd.org> Subject: Re: signature? Message-ID: <200009030608.GAA02427@groggy.anc.ptialaska.net>
next in thread | raw e-mail | index | archive | help
> It's not port UDP 68, it's netbios-ns; it's Windows boxs that like to do a
> netbios nameserver lookup on whoever connections to them. MS assumed that
> anything connecting to them "must" be a windows box and tries to log the
> Netbios name of it.... these end up as mostly noise in firewall logs.
>
> I specifically disabled monitoring of UDP 137/138 in my own firewalls as the
> number of stupid IIS servers that kept trying to find out the netbios name
> of the squid proxies was filling the logs with useless information...
this sounds good to me :) i figured it was some IIS crap ...
i think my ISP recently replaced their SunOS and System V boxes
with IIS servers - i know they renamed all their boxes - and that's
when this problem started. it still bothers me that they have a right
to clutter my connection with so much useless garbage! i mean, it does
cause "stalls" on connections to my server since 10 seconds
of every minute my connectin is jammed with this garbage ...
it would be a hassle to change providers for many reasons,
do i have any right to make them stop? :) i mean, it's
almost a DOS attack, isn't it? :)
> Aren't these caused by samba or another program of the sort which are
> answered by an "MS" machine? That is how it is on my network...
i am not running samba or anything ...
i have one other BSD machine on an ethernet,
but it is quiet and doesn't have anything to do with this.
it happens every minute ... 24 hours a day ...
i run only the following - apache + squid ...
(3.5.1-R)
ftp stream
telnet stream
pop3 stream
finger stream
auth stream
comsat dgram
ntalk dgram
my machine is groggy, and it seems to all be intiated with :
> > > 05:13:24.048994 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns >
> 208.151.115.193.netbios-ns: udp 68
> > > 05:13:24.049044 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns >
> 208.151.115.193.netbios-ns: udp 68
i am neither of those machines ...
Active Internet connections (including servers)
Socket Proto Recv-Q Send-Q Local Address Foreign Address (state)
c39722a0 tcp 0 4 groggy.telnet xxx.groggy.2034 ESTABLISHED
c39723c0 tcp 0 0 groggy.domain *.* LISTEN
c39724e0 tcp 0 0 *.3128 *.* LISTEN
c3972600 tcp 0 0 *.http *.* LISTEN
c3972720 tcp 0 0 *.smtp *.* LISTEN
c3972840 tcp 0 0 *.printer *.* LISTEN
c3972960 tcp 0 0 *.auth *.* LISTEN
c3972a80 tcp 0 0 *.finger *.* LISTEN
c3972ba0 tcp 0 0 *.pop3 *.* LISTEN
c3972cc0 tcp 0 0 *.telnet *.* LISTEN
c3972de0 tcp 0 0 *.ftp *.* LISTEN
c3972f00 tcp 0 0 localhost.domain *.* LISTEN
c3971f00 tcp 0 0 groggy.domain *.* LISTEN
c3941c00 udp 0 0 groggy.domain *.*
c3941cc0 udp 0 0 *.3130 *.*
c3941d20 udp 0 0 *.1058 *.*
c3941d80 udp 0 0 *.ntalk *.*
c3941de0 udp 0 0 *.biff *.*
c3941e40 udp 0 0 *.syslog *.*
c3941f60 udp 0 0 *.1024 *.*
c3941ea0 udp 0 0 localhost.domain *.*
c3941f00 udp 0 0 groggy.domain *.*
Active UNIX domain sockets
Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr
c3a64e00 stream 0 0 c3a60040 0 0 0 /var/run/ppp
c3a64ec0 stream 0 0 c3a60b80 0 0 0 /var/run/printer
c3a64fc0 stream 0 0 c3a62440 0 0 0 /var/run/ndc
c3a64d80 dgram 0 0 0 c3a64f80 0 c3a64dc0
c3a64dc0 dgram 0 0 0 c3a64f80 0 c3a64e40
c3a64e40 dgram 0 0 0 c3a64f80 0 c3a64e80
c3a64e80 dgram 0 0 0 c3a64f80 0 c3a64f00
c3a64f00 dgram 0 0 0 c3a64f80 0 c3a64f40
c3a64f40 dgram 0 0 0 c3a64f80 0 0
c3a64f80 dgram 0 0 c3a62080 0 c3a64d80 0 /var/run/log
> > > i don't use dhcp or anything like that ...
> >
> > Are you sure you're not running some other daemon which uses this
> > service? Take a look with 'ps lax' and see what you get.
ps alx ... (i don't think anything is unusual here ...)
UID PID PPID CPU PRI NI VSZ RSS WCHAN STAT TT TIME COMMAND
0 0 0 0 -18 0 0 0 sched DLs ?? 0:00.12 (swapper)
0 1 0 0 10 0 424 72 wait Is ?? 0:00.02 /sbin/init -
0 2 0 0 -18 0 0 0 psleep DL ?? 0:00.63 (pagedaemon
0 3 0 0 18 0 0 0 psleep DL ?? 0:00.18 (vmdaemon)
0 4 0 0 18 0 0 0 syncer DL ?? 0:13.37 (syncer)
0 42 1 0 2 0 2232 1060 select Is ?? 0:02.28 named
0 45 1 0 2 0 832 284 select Is ?? 0:00.71 syslogd
0 48 1 0 2 0 908 156 select Is ?? 0:00.08 inetd
0 51 1 0 10 0 944 204 nanslp Ss ?? 0:00.49 cron
0 55 1 0 2 0 840 0 select IWs ?? 0:00.00 (lpd)
0 62 1 0 2 0 1596 832 select Ss ?? 4:49.61 ppp -ddial -
0 66 1 0 2 0 1320 556 select Ss ?? 0:01.40 sendmail: ac
65534 76 75 0 -6 0 760 220 piperd Is ?? 0:00.02 (unlinkd) (u
0 77 1 0 2 0 1696 748 select Ss ?? 0:08.00 httpd
0 83 1 0 3 0 836 0 siodcd IW ?? 0:00.00 (getty)
65534 84 77 0 2 0 1696 0 accept IW ?? 0:00.00 (httpd)
65534 85 77 0 2 0 1720 0 accept IW ?? 0:00.00 (httpd)
65534 86 77 0 2 0 1696 0 accept IW ?? 0:00.00 (httpd)
65534 87 77 0 2 0 1696 0 accept IW ?? 0:00.00 (httpd)
65534 88 77 0 2 0 1720 0 accept IW ?? 0:00.00 (httpd)
0 113 48 0 2 0 884 296 select Ss ?? 0:16.86 telnetd
65534 620 77 0 2 0 1720 0 accept IW ?? 0:00.00 (httpd)
65534 621 77 0 2 0 1696 0 accept IW ?? 0:00.00 (httpd)
65534 622 77 0 2 0 1708 0 accept IW ?? 0:00.00 (httpd)
65534 767 77 0 2 0 1720 0 accept IW ?? 0:00.00 (httpd)
1000 114 113 0 10 0 596 0 wait IWs p0 0:00.00 (sh)
0 157 114 0 10 0 604 232 wait S p0 0:00.70 su (sh)
1000 2309 157 0 10 0 496 248 - T p0 0:00.03 su -c um (sh
1000 2310 2309 0 10 0 1396 676 - T p0 0:00.23 awk -f /root
1000 2348 2310 0 10 0 496 248 - T p0 0:00.01 sh -c cd /ho
1000 2350 2348 0 28 0 1284 976 - T p0 0:05.59 joe 00.0902.
0 2414 157 0 28 0 400 240 - R+ p0 0:00.00 ps -alx
0 82 1 0 3 0 836 0 ttyin IWs+ v0 0:00.00 (getty)
0 68 1 2 10 0 512 0 wait IW con- 0:00.00 (sh)
0 71 68 20 10 0 504 0 wait IW con- 0:00.00 (sh)
65534 75 71 0 2 0 8844 4788 poll S con- 1:23.24 squid -NsY
> > On Saturday, 2 September 2000 at 20:14:03 +0000, groggy@iname.com wrote:
> > > can anyone tell me what the heck my ISP is doing to my machine?
> >
> > It's the name of your system:
> >
> > > Received: (from abc@localhost)
> > > by groggy.anc.ptialaska.net (8.9.3/8.9.3) id UAA02138
> > > for isp@freebsd.org; Sat, 2 Sep 2000 20:14:03 GMT
> > > (envelope-from groggy@iname.com)
i don't understand ...
> > > is it a recognizable signature? they repeat this every
> > > minute - and it does clog my connection a little!
> > > is it stuff i should allow - or is something strange
> > > going on? udp 68 is the "bootstrap protocol client".
> > > i don't know what the heck that has to do with me,
> > The messages seem to be coming from your end. I don't even see any
> > replies. The two messages at 05:13:25.548800 have nothing to do with
> > you, but suggest that you're on a broadcast medium. Considering that
> > the names suggest this is ADSL, you might ask your ISP about that.
i don't think i am initiating anything ... i am confused ...
it seems that my udp 68 stuff is initiated by those first 2 packets
using my machine as a relay or something - and i don't like being
a relay for anything :) i collected 5MB of this stuff in a
few hours, and it's exactly the same sequence over and over,
24 hours a day. enh-1 is one of my ISP's boxes.
why is it telling me "exceeded time in transit" ?
it seems to be some kinda probe or something, or what?
but what is getting my FBSD box (groggy) to reply?
> How is your IP assigned? Are you on a DSL circuit? PPPoE? 68 I belivei is
> also used for DHCP. So unless you use DHCP for sure block the traffic and
> see what happens..
it is a static IP - and if i block everything out
with ppp filters, nothing seems to change - but that
isn't stopping them from cluttering my connection,
and for what purpose? i don't know - but i don't
like it :) my machine is groggy - i don't know
what the meaning of those first 2 lines are -
it seems like my machine is being used
as some kind of relay?
i am just on an ordinary static modem dialup connection.
this is repeated every minute - EXACTLY the same - every single minute.
05:15:24.040621 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:24.040690 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:24.140647 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:24.140678 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:24.260679 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:24.260712 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:24.390320 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:24.390356 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:24.510326 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:24.510359 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:24.630326 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:24.630359 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:24.750323 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:24.750354 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:24.870327 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:24.870360 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:24.990343 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:24.990374 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:25.120346 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:25.120380 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:25.240318 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:25.240352 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:25.360508 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:25.360542 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:25.480337 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:25.480371 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:25.540626 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:25.540675 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:25.590329 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:25.590361 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:25.660467 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:25.660500 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:25.710312 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:25.710343 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:25.780613 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:25.780644 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:25.830333 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:25.830367 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:25.910272 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:25.910303 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:25.950345 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:25.950376 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:26.040337 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:26.040375 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:26.080330 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:26.080362 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:26.160306 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:26.160338 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:26.200359 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:26.200391 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:26.290300 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:26.290332 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:26.330318 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:26.330352 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:26.410323 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:26.410358 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:26.470325 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:26.470374 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:26.520400 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:26.520432 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:26.590339 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:26.590371 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:26.640321 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:26.640353 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:26.690360 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:26.690392 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:26.770299 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:26.770330 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:26.820697 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:26.820730 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:26.890317 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:26.890348 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:26.950327 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:26.950359 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:26.990323 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:26.990355 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:27.030374 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:27.030407 209-193-28-245.adsl.jnu.acsalaska.net.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:27.070354 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:27.070385 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:27.120316 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:27.120348 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:27.160288 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:27.160319 groggy.netbios-ns > 208.151.115.193.netbios-ns: udp 68
05:15:27.200344 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:27.200374 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:27.250291 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:27.250323 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:27.290315 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:27.290346 groggy.43171 > 208.151.115.193.netbios-ns: udp 68
05:15:27.340673 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:27.340705 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:27.370330 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:27.370360 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:27.410319 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:27.410353 groggy.54658 > 208.151.115.193.netbios-ns: udp 68
05:15:27.470359 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:27.470393 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:27.490299 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:27.490330 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:27.530343 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:27.530381 groggy.56121 > 208.151.115.193.netbios-ns: udp 68
05:15:27.610366 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:27.610397 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:27.630452 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:27.630484 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:27.660647 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:27.660678 groggy.60574 > 208.151.115.193.netbios-ns: udp 68
05:15:27.740539 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:27.740570 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:27.760293 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:27.760324 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:27.790324 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:27.790354 groggy.46666 > 208.151.115.193.netbios-ns: udp 68
05:15:27.880365 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:27.880398 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:27.900542 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:27.900573 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:27.920320 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:27.920350 groggy.47168 > 208.151.115.193.netbios-ns: udp 68
05:15:28.000433 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:28.000465 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:28.040310 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:28.040342 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:28.060528 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:28.060559 groggy.34935 > 208.151.115.193.netbios-ns: udp 68
05:15:28.110376 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:28.110407 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:28.180648 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:28.180678 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:28.200341 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:28.200372 groggy.49854 > 208.151.115.193.netbios-ns: udp 68
05:15:28.240503 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:28.240536 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:28.290324 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:28.290354 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:28.320348 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:28.320379 groggy.54822 > 208.151.115.193.netbios-ns: udp 68
05:15:28.370346 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:28.370379 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:28.410348 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:28.410383 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:28.450459 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:28.450492 groggy.37558 > 208.151.115.193.netbios-ns: udp 68
05:15:28.510386 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:28.510418 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:28.540553 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:28.540591 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:28.560323 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:28.560354 groggy.65431 > 208.151.115.193.netbios-ns: udp 68
05:15:28.650387 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:28.650419 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:28.670367 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:28.670399 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:28.690304 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:28.690335 groggy.40410 > 208.151.115.193.netbios-ns: udp 68
05:15:28.780677 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:28.780707 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:28.810328 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:28.810359 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:28.830338 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:28.830370 groggy.49151 > 208.151.115.193.netbios-ns: udp 68
05:15:28.920379 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:28.920411 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:28.950342 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:28.950374 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:28.970345 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:28.970376 groggy.57276 > 208.151.115.193.netbios-ns: udp 68
05:15:29.050367 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:29.050400 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:29.080320 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:29.080350 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:29.100663 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:29.100695 groggy.58519 > 208.151.115.193.netbios-ns: udp 68
05:15:29.170381 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:29.170412 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:29.210314 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:29.210344 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:29.230327 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:29.230359 groggy.37645 > 208.151.115.193.netbios-ns: udp 68
05:15:29.280403 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:29.280434 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:29.350335 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:29.350369 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:29.370329 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:29.370360 groggy.65226 > 208.151.115.193.netbios-ns: udp 68
05:15:29.400402 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:29.400434 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:29.460674 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:29.460707 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:29.490352 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:29.490383 groggy.39500 > 208.151.115.193.netbios-ns: udp 68
05:15:29.540725 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:29.540758 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:29.580676 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:29.580707 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:29.620686 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:29.620718 groggy.55759 > 208.151.115.193.netbios-ns: udp 68
05:15:29.670401 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:29.670433 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:29.710344 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:29.710375 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:29.740682 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:29.740713 groggy.44858 > 208.151.115.193.netbios-ns: udp 68
05:15:29.800410 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:29.800440 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:29.840319 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:29.840352 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:29.860662 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:29.860694 groggy.33520 > 208.151.115.193.netbios-ns: udp 68
05:15:29.910374 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:29.910407 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:29.980547 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:29.980578 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:30.000444 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:30.000475 groggy.50768 > 208.151.115.193.netbios-ns: udp 68
05:15:30.030421 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:30.030452 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:30.110322 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:30.110353 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:30.120341 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:30.120372 groggy.52515 > 208.151.115.193.netbios-ns: udp 68
05:15:30.160390 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:30.160422 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:30.250340 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:30.250372 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:30.270358 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:30.270389 groggy.50235 > 208.151.115.193.netbios-ns: udp 68
05:15:30.290390 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:30.290421 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:30.370365 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:30.370399 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:30.410357 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:30.410387 groggy.60601 > 208.151.115.193.netbios-ns: udp 68
05:15:30.430413 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:30.430445 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:30.490327 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:30.490358 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:30.550375 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:30.550418 groggy.54072 > 208.151.115.193.netbios-ns: udp 68
05:15:30.570419 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:30.570450 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:30.610346 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:30.610377 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:30.660691 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:30.660724 groggy.65290 > 208.151.115.193.netbios-ns: udp 68
05:15:30.690419 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:30.690450 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:30.740672 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:30.740703 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:30.780575 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:30.780606 groggy.54938 > 208.151.115.193.netbios-ns: udp 68
05:15:30.820776 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:30.820808 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:30.880344 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:30.880375 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:30.910375 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:30.910406 groggy.37527 > 208.151.115.193.netbios-ns: udp 68
05:15:30.950412 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:30.950442 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:31.010369 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:31.010401 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:31.040363 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:31.040394 groggy.42651 > 208.151.115.193.netbios-ns: udp 68
05:15:31.070426 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:31.070458 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:31.150336 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:31.150367 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:31.180694 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:31.180725 groggy.65342 > 208.151.115.193.netbios-ns: udp 68
05:15:31.200424 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:31.200456 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:31.280344 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:31.280375 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:31.287202 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:31.287232 groggy.59417 > 208.151.115.193.netbios-ns: udp 68
05:15:31.330551 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:31.330587 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:31.410382 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:31.410412 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:31.430499 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:31.430538 groggy.33236 > 208.151.115.193.netbios-ns: udp 68
05:15:31.450430 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:31.450462 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:31.540882 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:31.540917 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:31.570360 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:31.570392 groggy.60380 > 208.151.115.193.netbios-ns: udp 68
05:15:31.577363 groggy.49409 > 208.151.115.193.netbios-ns: udp 68
05:15:31.577395 groggy.49409 > 208.151.115.193.netbios-ns: udp 68 [ttl 1]
05:15:31.650363 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:31.650395 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:31.700720 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:31.700749 groggy.40548 > 208.151.115.193.netbios-ns: udp 68
05:15:31.720356 enh-1.anc.ptialaska.net > groggy: icmp: time exceeded in-transit
05:15:31.780697 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:31.780729 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:31.830370 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:31.830403 groggy.47637 > 208.151.115.193.netbios-ns: udp 68
05:15:31.900547 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:31.900578 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:31.950382 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:31.950414 groggy.62547 > 208.151.115.193.netbios-ns: udp 68
05:15:32.020768 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:32.020801 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:32.080354 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:32.080385 groggy.57634 > 208.151.115.193.netbios-ns: udp 68
05:15:32.130363 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:32.130393 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:32.200386 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:32.200417 groggy.36923 > 208.151.115.193.netbios-ns: udp 68
05:15:32.250380 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:32.250412 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:32.320390 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:32.320421 groggy.34570 > 208.151.115.193.netbios-ns: udp 68
05:15:32.380555 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:32.380585 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:32.430371 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:32.430408 groggy.35457 > 208.151.115.193.netbios-ns: udp 68
05:15:32.500722 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:32.500753 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:32.550388 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:32.550420 groggy.36818 > 208.151.115.193.netbios-ns: udp 68
05:15:32.610359 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:32.610390 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:32.670389 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:32.670421 groggy.42212 > 208.151.115.193.netbios-ns: udp 68
05:15:32.730377 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:32.730409 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:32.800392 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:32.800423 groggy.51840 > 208.151.115.193.netbios-ns: udp 68
05:15:32.860553 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:32.860585 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:32.910366 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:32.910397 groggy.61327 > 208.151.115.193.netbios-ns: udp 68
05:15:32.980706 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:32.980736 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:33.030395 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:33.030427 groggy.35196 > 208.151.115.193.netbios-ns: udp 68
05:15:33.100717 groggy.49409 > 208.151.115.193.netbios-ns: udp 68
05:15:33.100747 groggy.49409 > 208.151.115.193.netbios-ns: udp 68 [ttl 1]
05:15:33.150395 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:33.150425 groggy.56717 > 208.151.115.193.netbios-ns: udp 68
05:15:33.220725 enh-1.anc.ptialaska.net > groggy: icmp: time exceeded in-transit
05:15:33.280364 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:33.280395 groggy.61017 > 208.151.115.193.netbios-ns: udp 68
05:15:33.400419 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:33.400456 groggy.41928 > 208.151.115.193.netbios-ns: udp 68
05:15:33.520496 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:33.520538 groggy.46941 > 208.151.115.193.netbios-ns: udp 68
05:15:33.620757 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:33.620788 groggy.40340 > 208.151.115.193.netbios-ns: udp 68
05:15:33.730390 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:33.730421 groggy.42681 > 208.151.115.193.netbios-ns: udp 68
05:15:33.830394 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:33.830425 groggy.64941 > 208.151.115.193.netbios-ns: udp 68
05:15:33.950404 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:33.950434 groggy.60087 > 208.151.115.193.netbios-ns: udp 68
05:15:34.070418 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:34.070452 groggy.60148 > 208.151.115.193.netbios-ns: udp 68
05:15:34.200388 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:34.200420 groggy.60007 > 208.151.115.193.netbios-ns: udp 68
05:15:34.320400 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:34.320432 groggy.48623 > 208.151.115.193.netbios-ns: udp 68
05:15:34.430390 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:34.430423 groggy.59903 > 208.151.115.193.netbios-ns: udp 68
05:15:34.560418 groggy.49409 > 208.151.115.193.netbios-ns: udp 68
05:15:34.560459 groggy.49409 > 208.151.115.193.netbios-ns: udp 68 [ttl 1]
05:15:34.670363 enh-1.anc.ptialaska.net > groggy: icmp: time exceeded in-transit
-------------------------------------------------
To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200009030608.GAA02427>