On 27/01/2006, at 12:25 AM, sai wrote:
> I have
> 10:16:00.273735 rl0 @0:10 b 169.254.15.77,138 -> 169.254.255.255,138
> PR udp len 20 236 IN
> showing up on the logs.
> Now rl0 is my LAN and the ip addresses are 192.168.10.1/24 so this
> shouldn't be coming from the LAN.
> There is nothing with 169..x.x.x in the arp tables. Is this packet
> from the LAN or what? If it is on my LAN then how do I track down
> which computer is doing this using m0n0?
This is an auto-configuration address, so yes it would most likely be
a LAN address.
Port 138 is a part of the original NetBIOS trio, so more than likely
it's a lost windows box.