Andrew

I believe that Matthew is on the right track in identifying this as Windows box attempting to access some service. But he gets it backwards about who is the client and who is the "supposed" server. The request is from 192.168.246.13 (the client) and the destination is 192.168.246.128. The real reason that the message is repeated is that it makes the first attempt and it recieves this response:

IP 192.168.246.128 > 192.168.246.13: ICMP 192.168.246.128 udp port 137 unreachable, length 86

this says that the port unreachable and means that the attempt to access the service failed, and so the devices tries again, and fails again. And then tries a third time.

UDP port 137 is a port used for Windows services. The first device is attempting to communicate with the second device on that port. But the second device is rejecting the attempt to communicate for that service.

HTH

Rick

Thanks Mat and Rick. its still a little fuzzy to me, i know UDP port 137 refers to NETBIOS, but what does the different lenghts mean? example, ureachable lenght 50

unreachable lenght 50?

thanks for your assistance.

Hello again,

Yeah, I might have it backwards since I don't use TCPDump that often. Can you capture the full packets instead of just the headers? That will show you what's in there. Use Wireshark and it will decode the packets and tell you what is happening. I think length is just the length of the entire packet in bytes.

Matt

oh, i dint think of wire shark.

I believe length 50 refers to the length of the IP packets.