RE: IIS weird

On 09-Mar-2000 Jens-S. Voeckler wrote:
> though it is not a Squid problem, it is cache related. On my new
> caches, I am running snoop to see what requests arrive that
> shouldn't go there. I happen to see some weirdness when contacting a
> M$ IIS 4.0: The IIS sends me netbios-ns (137/udp) datagrams in return
> - besides the answer, I guess. Usually three in a row.

It's an MS TCP/IP stack issue. Stupidly, any machine running Window
s doing TCP/IP communications always sends 3*UDP port 137 packets first
*before* it does anything else. As I remember, it's trying to do a
NetBIOS or WINS lookup on the name of the machine first before it goes
for a proper connection.

Again, as I remember, it does this to determine the machine type - if
it's another Windows machine then all sorts of stuff could go on in the
background.

Stupid? Certainly.

Pain in the ass? Absolutely!

Our firewall here stops thousands of these from external clients every
hour of every day. Eventually we stopped logging them to get a better
signal/noise ratio and make the logs easier to process.

You're right - not a squid problem. Just another stupid Microsoft
trick. I wonder how much bandwidth these packets take up?

Graeme

-- 
Graeme Fowler
Network Officer, Infrastructure & Networks Group
Loughborough University Computing Services
+44 1509 228426