eigen server co-located

[DPLuS]

Ik heb een vraagje over mijn incoming traffic op mijn server.
Zoals je op het plaatje ziet (gegenereerd door MRTG op ETH0) komt er de hele tijd standaard rond de 3 Kb/s binnen. Is dat normaal?
Ik ben de enige user, en het enige dat normaal binnenkomt aan data is mail.

[RupS]

Nee, dat is niet normaal ...

Als ik jou was zou ik even kijken met een tool waar dat verkeer vandaan komt...
ik gebruik als ik even snel moeten kijken naar openstaande connecties: trafshow

Heb je een firewall op de server draaien?

[DPLuS]

nee, maar ik draai wel een eigen DNS server, miscchien dat dat iets uitmaakt?

[ Voor 93% gewijzigd door DPLuS op 10-02-2003 15:19 ]

[RupS]

DPLuS schreef op 10 February 2003 @ 15:18:
nee, maar ik draai wel een eigen DNS server, miscchien dat dat iets uitmaakt?

Ik draai ook een eigen DNS server en verschillende websites plus mail voor verschillende domeinen plus een irc server, maar ik heb geen constante stream van 3,5kB... ik zou echt even met een progje als trafshow kijken waar dat verkeer vandaan komt ...
Nu blijft het natuurlijk gissen

[Weppel]

Misschien heel stom, maar misschien ben je gehacked. Kijk eens goed of er geen verdachte processen draaien, en ga eens door je logfiles heen lezen, misschien heeft er 1 of andere onverlaat een IRC client geinstalleerd, of iets in die richting..
Suc6!

[chromeeh]

Weppel schreef op 10 February 2003 @ 15:22:
Misschien heel stom, maar misschien ben je gehacked. Kijk eens goed of er geen verdachte processen draaien, en ga eens door je logfiles heen lezen, misschien heeft er 1 of andere onverlaat een IRC client geinstalleerd, of iets in die richting..
Suc6!

En je firewall eens aanzetten

[Verwijderd]

netstat

[Le Mol]

gewoon ff een tijdje met een sniffer (Snort bijvoorbeeld) de lijn in de gaten houden, kun je zo zien wat voor traffic het is en waar het vandaan komt.

Ik had ook zo iets (bij een andere provider) en dat bleek een behoorlijk stroom broadcasts te zijn van div andere bakken in dat subnet, een eigen vlan voor mijn bak was daarbij de oplossing

[ Voor 3% gewijzigd door Le Mol op 10-02-2003 18:06 ]

[DPLuS]

Ik heb al mijn services (mysql/httpd/snmpd/etc) uitgezet, en toen bleek dat zij niet verantwoordelijk waren voor het inkomend dataverkeer.
Toen had ik hier het eea gelezen over broadcast en arp storms, en volgens mij is dat bij mij het geval.

Ik heb tethereal gestart om het e.e.a. te capturen:

# tethereal -a duration:60 -i eth0

en dit was de output:

code:

  0.000000 213.112.3.40 -> 213.75.58.129 TCP ssh > 1473 [PSH, ACK] Seq=2722460873 Ack=3690755991 Win=17280 Len=64
  0.071372 213.75.58.129 -> 213.112.3.40 TCP 1473 > ssh [ACK] Seq=3690755991 Ack=2722460937 Win=8744 Len=0
  0.156273 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  0.336715 Cisco_91:87:42 -> CDP/VTP      LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x2004
  0.337324 Cisco_91:87:42 -> CDP/VTP      LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x2004
  0.345210 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
  0.628501 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.215?  Tell 213.196.47.1
  0.656993 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  0.786423 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
  1.156768 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  1.589085 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
  1.657024 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  1.743118 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
  2.157321 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  2.201825 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
  2.345455 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
  2.657546 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  2.787827 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
  3.157747 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  3.658030 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  3.744159 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
  4.158255 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  4.346391 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
  4.658970 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  4.660271 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
  4.664987 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
  4.788818 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
  5.158736 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  5.659008 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  5.745059 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
  5.855261 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.183?  Tell 213.196.3.1
  5.916132 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
  6.155529 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
  6.159241 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  6.347325 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
  6.634327 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.215?  Tell 213.196.47.1
  6.659489 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  6.789811 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
  7.159726 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  7.660005 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  7.746035 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
  8.096037 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
  8.160222 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  8.348262 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
  8.660924 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  8.793875 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
  9.160739 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  9.612091 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
  9.661002 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
  9.747030 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
  9.810982 Cobalt_M_03:34:9d -> Broadcast    ARP Who has 213.196.47.88?  Tell 213.196.47.4
 10.161214 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 10.223385 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 10.349889 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 10.661475 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 10.783783 American_66:ec:cb -> Broadcast    ARP Who has 213.196.3.1?  Tell 213.196.3.26
 10.795348 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 11.161703 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 11.661975 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 11.747979 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 12.162237 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 12.350135 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 12.609047 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 12.662949 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 12.796771 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 12.956068 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 13.162716 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 13.277983 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.31.146?  Tell 213.196.31.129
 13.662966 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 13.737388 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.60?  Tell 213.196.47.1
 13.748958 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 14.163215 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 14.351123 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 14.435724 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 14.518356 American_64:f5:00 -> Broadcast    ARP Who has 213.196.37.1?  Tell 213.196.37.206
 14.663463 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 14.797791 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 15.163682 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 15.663957 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 15.749936 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 16.164199 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 16.274216 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.31.146?  Tell 213.196.31.129
 16.352006 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 16.664907 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 16.798753 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 16.863955 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.140?  Tell 213.196.3.1
 17.139674 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 17.164675 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 17.664933 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 17.679775 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 17.750904 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 18.165164 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 18.352939 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 18.583211 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 18.665470 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 18.799740 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 19.165686 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 19.665957 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 19.751877 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 20.166200 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 20.181207 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 20.354557 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 20.666901 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 20.678100 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 20.804285 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 20.874730 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.140?  Tell 213.196.3.1
 21.166669 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 21.603202 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 21.666961 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 21.752845 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 21.876647 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.140?  Tell 213.196.3.1
 21.936267 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 22.167172 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 22.313233 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.31.146?  Tell 213.196.31.129
 22.354812 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 22.667416 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 22.805699 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 23.094060 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.46?  Tell 213.196.37.1
 23.112453 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 23.167660 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 23.253549 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.47?  Tell 213.196.37.1
 23.382638 213.196.3.47 -> 213.196.3.255 NBNS Name query NB ORIENT<1b>
 23.402231 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.48?  Tell 213.196.37.1
 23.667931 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 23.753825 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 24.017206 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.52?  Tell 213.196.37.1
 24.063938 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 24.132868 213.196.3.47 -> 213.196.3.255 NBNS Name query NB ORIENT<1b>
 24.157309 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.53?  Tell 213.196.37.1
 24.168158 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 24.308860 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.54?  Tell 213.196.37.1
 24.355768 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 24.380934 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 24.614508 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.56?  Tell 213.196.37.1
 24.668864 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 24.761673 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.57?  Tell 213.196.37.1
 24.806687 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 24.883650 213.196.3.47 -> 213.196.3.255 NBNS Name query NB ORIENT<1b>
 24.910116 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.58?  Tell 213.196.37.1
 25.168628 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 25.246694 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.59?  Tell 213.196.37.1
 25.342371 213.196.37.1 -> 224.0.0.1    IGMP V2 Membership Query
 25.342474  213.196.3.1 -> 224.0.0.1    IGMP V2 Membership Query
 25.342570 213.196.47.1 -> 224.0.0.1    IGMP V2 Membership Query
 25.342665 213.196.31.129 -> 224.0.0.1    IGMP V2 Membership Query
 25.668888 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 25.754816 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 25.929223 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 25.939614 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.183?  Tell 213.196.3.1
 26.021218 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 26.169142 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 26.356681 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 26.480151 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.67?  Tell 213.196.37.1
 26.633533 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.68?  Tell 213.196.37.1
 26.669405 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 26.783265 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.69?  Tell 213.196.37.1
 26.807678 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 27.072420 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 27.117621 213.196.3.115 -> 239.255.255.250 IGMP V2 Membership Report
 27.169635 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 27.251180 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.72?  Tell 213.196.37.1
 27.269249 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 27.388224 Cobalt_M_02:32:e3 -> Broadcast    ARP Who has 213.196.37.35?  Tell 213.196.37.4
 27.399835 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.73?  Tell 213.196.37.1
 27.658974 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 27.669892 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 27.755764 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 28.085033 213.196.37.114 -> 224.0.0.2    IGMP V2 Membership Report
 28.170121 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 28.358788 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 28.400342 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 28.659544 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.81?  Tell 213.196.37.1
 28.670837 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 28.802387 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.82?  Tell 213.196.37.1
 28.808666 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 28.961926 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.83?  Tell 213.196.37.1
 28.979096 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 29.125749 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.84?  Tell 213.196.37.1
 29.170620 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 29.279776 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.85?  Tell 213.196.37.1
 29.428260 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.86?  Tell 213.196.37.1
 29.589864 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.87?  Tell 213.196.37.1
 29.670901 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 29.703521 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 29.730299 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.88?  Tell 213.196.37.1
 29.756739 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 29.887062 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.89?  Tell 213.196.37.1
 30.171185 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 30.361808 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.92?  Tell 213.196.37.1
 30.361979 Cisco_91:87:42 -> CDP/VTP      LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x2004
 30.362793 Cisco_91:87:42 -> CDP/VTP      LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x2004
 30.366678 Cisco_91:87:42 -> CDP/VTP      CDP Cisco Discovery Protocol
 30.369259 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 30.410237 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 30.508363 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.93?  Tell 213.196.37.1
 30.671387 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 30.809678 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 30.812186 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.95?  Tell 213.196.37.1
 30.960677 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.96?  Tell 213.196.37.1
 31.114487 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.97?  Tell 213.196.37.1
 31.171600 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 31.265510 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.98?  Tell 213.196.37.1
 31.416541 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.99?  Tell 213.196.37.1
 31.567948 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.100?  Tell 213.196.37.1
 31.671880 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 31.720299 3com_Eur_43:86:58 -> Broadcast    ARP Who has 213.196.37.1?  Tell 213.196.37.101
 31.757730 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 31.870499 213.196.3.115 -> 213.196.3.255 BROWSER Domain/Workgroup Announcement WORKGROUP, NT Workstation, Domain Enum
 32.172090 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 32.367670 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 32.672806 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 32.709238 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 32.742053 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.107?  Tell 213.196.37.1
 32.760392 Cobalt_M_01:e1:09 -> Broadcast    ARP Who has 213.196.37.50?  Tell 213.196.37.40
 32.810645 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 32.893540 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.108?  Tell 213.196.37.1
 33.052894 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.109?  Tell 213.196.37.1
 33.069571 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 33.172594 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 33.357755 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.111?  Tell 213.196.37.1
 33.672914 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 33.758673 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 33.871102 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.150?  Tell 213.196.47.1
 34.173105 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 34.198897 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 34.300175 American_64:81:a9 -> Broadcast    ARP Who has 213.196.3.1?  Tell 213.196.3.50
 34.368604 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 34.673362 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 34.811635 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 34.839586 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.119?  Tell 213.196.37.1
 34.871750 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.150?  Tell 213.196.47.1
 34.947776 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 35.173581 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 35.282106 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.122?  Tell 213.196.37.1
 35.673868 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 35.759680 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 35.785441 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 35.905869 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.126?  Tell 213.196.37.1
 35.932053 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.150?  Tell 213.196.47.1
 36.174074 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 36.293892 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 36.363751 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.129?  Tell 213.196.37.1
 36.369563 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 36.528284 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.130?  Tell 213.196.37.1
 36.659700 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 36.674786 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 36.812622 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 36.901969 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.150?  Tell 213.196.47.1
 37.174604 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 37.674851 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 37.760633 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 37.761471 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.138?  Tell 213.196.37.1
 38.140337 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 38.175058 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 38.370472 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 38.548701 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.143?  Tell 213.196.37.1
 38.675365 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 38.799437 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 38.813610 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 38.995644 Network__00:9e:75 -> Broadcast    ARP Who has 213.196.37.80?  Tell 213.196.37.90
 39.175568 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 39.344251 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.148?  Tell 213.196.37.1
 39.675834 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 39.761598 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 40.149953 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.153?  Tell 213.196.37.1
 40.176052 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 40.283135 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.157?  Tell 213.196.47.1
 40.372940 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 40.442012 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.155?  Tell 213.196.37.1
 40.597751 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.156?  Tell 213.196.37.1
 40.676776 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 40.814623 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 40.918710 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.158?  Tell 213.196.37.1
 40.924242 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 41.176557 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 41.226568 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.160?  Tell 213.196.37.1
 41.371655 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.161?  Tell 213.196.37.1
 41.408856 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 41.409191 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 41.525391 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.162?  Tell 213.196.37.1
 41.676810 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 41.684530 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.163?  Tell 213.196.37.1
 41.762577 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 42.127752 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.166?  Tell 213.196.37.1
 42.177051 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 42.206213 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.157?  Tell 213.196.47.1
 42.278892 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.167?  Tell 213.196.37.1
 42.372348 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 42.632388 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.168?  Tell 213.196.37.1
 42.654560 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 42.677308 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 42.761471 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.169?  Tell 213.196.37.1
 42.815590 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 42.936891 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.170?  Tell 213.196.37.1
 43.177546 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 43.364705 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 43.364967 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 43.677794 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 43.681271 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 43.763547 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 43.953305 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 44.178043 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 44.258430 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.157?  Tell 213.196.47.1
 44.373277 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 44.400690 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.103?  Tell 213.196.47.1
 44.400812 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.10?  Tell 213.196.37.1
 44.400888 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.112?  Tell 213.196.3.1
 44.401154 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.37?  Tell 213.196.3.1
 44.401231 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.75?  Tell 213.196.47.1
 44.602693 Cobalt_M_02:3f:b6 -> Broadcast    ARP Who has 213.196.37.249?  Tell 213.196.37.55
 44.678749 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 44.816585 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 44.838077 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.164?  Tell 213.196.3.1
 44.954248 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.183?  Tell 213.196.37.1
 44.996749 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 45.105210 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.184?  Tell 213.196.37.1
 45.178524 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 45.314705 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.185?  Tell 213.196.37.1
 45.457270 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.186?  Tell 213.196.37.1
 45.616867 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.187?  Tell 213.196.37.1
 45.678804 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 45.759562 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.188?  Tell 213.196.37.1
 45.764493 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 45.916424 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.189?  Tell 213.196.37.1
 46.023396 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.183?  Tell 213.196.3.1
 46.179034 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 46.220625 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.157?  Tell 213.196.47.1
 46.374215 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 46.438707 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 46.544674 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 46.679303 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 46.817569 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 47.179541 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 47.679804 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 47.732804 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 47.765494 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 48.180003 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 48.227245 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.47.157?  Tell 213.196.47.1
 48.375184 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 48.680722 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 48.768968 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.208?  Tell 213.196.37.1
 48.818558 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 48.888309 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.140?  Tell 213.196.3.1
 49.180506 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 49.219748 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 49.670093 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.214?  Tell 213.196.37.1
 49.680763 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 49.766471 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 50.122182 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.217?  Tell 213.196.37.1
 50.180992 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 50.377579 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 50.420985 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.219?  Tell 213.196.37.1
 50.681278 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 50.819567 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 51.181500 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 51.310738 213.196.37.216 -> 213.196.37.255 UDP Source port: 8196  Destination port: 8197
 51.648261 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.225?  Tell 213.196.37.1
 51.681765 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 51.683505 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 51.767440 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 52.181978 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 52.319908 213.196.3.115 -> 213.196.3.255 NBNS Name query NB WORKGROUP<1c>
 52.322023 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 52.377021 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 52.417514 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.230?  Tell 213.196.37.1
 52.682693 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 52.820535 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 53.067353 213.196.3.115 -> 213.196.3.255 NBNS Name query NB WORKGROUP<1c>
 53.182487 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 53.682761 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 53.736682 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 53.768401 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 53.803605 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.239?  Tell 213.196.37.1
 53.817725 213.196.3.115 -> 213.196.3.255 NBNS Name query NB WORKGROUP<1c>
 54.182977 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 54.377958 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 54.581862 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.244?  Tell 213.196.37.1
 54.683250 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 54.777675 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.151?  Tell 213.196.3.1
 54.814584 Idot_Com_09:00:42 -> Broadcast    ARP Who has 213.196.37.40?  Tell 213.196.37.181
 54.821522 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 55.183465 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 55.683736 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 55.769390 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 55.819100 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.252?  Tell 213.196.37.1
 55.951310 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 55.961610 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.253?  Tell 213.196.37.1
 56.112755 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.254?  Tell 213.196.37.1
 56.183974 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 56.378891 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 56.684681 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 56.822602 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 57.184453 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 57.425734 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 57.426240 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 57.459673 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.57?  Tell 213.196.37.1
 57.684712 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 57.770390 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 57.869672 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.151?  Tell 213.196.3.1
 58.184964 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 58.263786 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.132?  Tell 213.196.3.1
 58.379831 Cisco_91:87:42 -> Spanning-tree-(for-bridges)_00 STP Conf. Root = 32769/00:0b:5f:91:87:40  Cost = 0  Port = 0x8002
 58.685214 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 58.823499 Cisco_77:2e:82 -> 01:00:0c:cc:cc:cd LLC U, func = UI; SNAP, OUI 0x00000C (Cisco), PID 0x010B
 59.110526 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 59.110825 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 59.185439 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 59.474560 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.48?  Tell 213.196.37.1
 59.685727 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II
 59.709847 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.60?  Tell 213.196.3.1
 59.771326 213.196.37.112 -> 224.2.232.10 UDP Source port: 1028  Destination port: 29462
 59.789621 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.151?  Tell 213.196.3.1
 59.966077 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.37.57?  Tell 213.196.37.1
 59.980818 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 59.981084 Extreme__12:15:50 -> Broadcast    ARP Who has 213.196.3.61?  Tell 213.196.3.1
 60.185927 02:01:00:00:00:00 -> Broadcast    0x886f Ethernet II

Ik heb er niet veel verstand van, maar die broadcasts zijn toch niet normaal of wel?
Wat zou ik kunnen doen om dit op te lossen?

[kieskes]

naar je colocate boer gaan en vragen of ze fatsoenlijke vhosts kunnen maken !

[DPLuS]

Wat houden die broadcasts nu eigenlijk in?
En kan ik die blocken met een firewall zodat dit verkeer niet bij mij op mijn eth0 terechtkomt?

[WouterG]

DPLuS schreef op 11 February 2003 @ 17:05:
Wat houden die broadcasts nu eigenlijk in?
En kan ik die blocken met een firewall zodat dit verkeer niet bij mij op mijn eth0 terechtkomt?

Blocken kun je wel, maar die zooi blijf je toch ontvangen. Je moet de gegevens eerst ontvangen voor je kunt blokken uiteraard. Verder weet ik niet wat broadcasts zijn.

[[Yellow]]

Ik weet dat het een beetje aan de late kant is, maare ik kan het toch niet laten

Die ARP broadcasts zijn toch wel vrij normaal, alleen de hoeveelheid lijkt een beetje aan de hoge kant. De routers van je provider staan gewoon een beetje slecht ingesteld.

Ik heb hetzelfde gehad bij @Home. Ze hebben me 2 weken terug op een andere node in hun netwerk gezet en toen was het over Eerst kreeg ik continu 6Kb/s aan zooi binnen, nu bijna niets.