I have two boxes running Mandrake 9.1. They are not networked to each other, but they are on the same subnet.

My logs are always full of traffic; most of it is Microsoft NETBIOS traffic on my subnet. I have my firewalls set to DROP everything. I have NMAP'ed both of my boxes, and both show only: 135 closed, 138 closed.

However I'm noticing that one of the boxes is sending packets on port 513 to the other box. Is this just more network traffic that is getting bounced around on my subnet, or is something fishy going on? I don't know much about networking. Are those packets starting somewhere else, being sent to my first box, then getting transferred to my other box? Since I have the firewall set to drop all that seems unlikely.

Thanks.

I grepped /etc/services for 513 and I saw this port assigned to login (tcp) and who (udp).

Doing a little googling indicates that it is typical for unix type systems to share with each other who is logged into their systems via this port.

That's interesting, thanks.

I checked the services on the box and 'rwhod' was running. I switched it off and it *seems* that this behavior has stopped. We'll see after a few days.

Thanks.