Strange broadcasts

Jason Opperisano opie at 817west.com
Mon Apr 18 21:25:35 CEST 2005


On Mon, Apr 18, 2005 at 01:30:05PM -0500, Taylor, Grant wrote:
> This looks like some extremely weird traffic.  Normal M$ RPC traffic should 
> not going to the broadcast address (.255 on each respective subnet).

MS RPC uses TCP 135, not UDP 137 or 138.  netbios name (137) and
datagram (138) are most definitely broadcast-based (in the absence of a
WINS server).

-j

--
"Stewie: They're getting nude! I mustn't watch, it's not the proper
 thing to...Wow! I say, nice ones, Janine! And look at Lisa in all of her
 curvaceous glory! Heavens, it appears that my weewee has been stricken
 with rigor mortis!"
        --Family Guy



More information about the netfilter mailing list