My first reaction is either something is horribly broken, or you are actually seeing Netbios traffic over IP. Most commonly seen in Windows peer to peer communications. IE: IP ports 137 and 138.
You did not say which program you're using to see the traffic. You should be able to see a source MAC address in the trap. If you have a managed switch you should be able to determine the location of the source MAC address. Or, run nmap mysubnet/mask -p 138.
Example: nmap 192.168.1.64/28 -p 138
This will list all the IP and MAC's, as well as all hosts with the netbios port open.
Last edited by Suncoast; 05-28-2009 at 02:40 PM.