Some uneducated guesses here...
I've seen NT machines doing this before, maybe the most oddball case
I've seen is dual-homed MS Proxy machines trying to connect to
the Internet from their internal NIC - which oddly enough gets routed
to the outside.
My initial thought was that if the public nic/address was experiencing
high load, it falls back to the next adapter but this might be way
wrong. It might just be a spurious bug for all I know ;-)
Also, NetBIOS tries to connect to new machines through each
local IP sequentially, even though the "first" IP is "farther
away" (according to route metrics) from the destination than the
"second" IP. I'm particularily seeing this at home where I have a
local network and connect to another network via modem. It takes
30-60 seconds to connect to remote shares (even though I attach
via numeric IP: \\1.2.3.4\share) since it tries my local adapter
first. Blah.
It might be that your machine is doing NetBIOS-NS queries from
your private IP, and that gets caught by your ISP's inside-out
anti-spoofers.
Your might want to try a sniffer (WinDump?) on your own
computer or connected to your LAN wire.
Eric wrote:
>
> I have come across something rather unusual. I have a computer at home
> with Windows NT Server connected to the internet via a cable modem and
> I maintain a nearly 24 hour pptp connection to a computer at my office
> (600 miles away). Thus, I have two different ip addresses, one assigned
> with DHCP for the cable modem and the other from the virtual private
> network connection.
>
> Every few minutes, the router at the office logs an ICMP message of 3/13
> from a server on my local cable network addressed to the ip address from
> the vpn connection. Thus, it appears that my computer is broadcasting
> some local tcp/ip traffic using the vpn connection ip address.
>
> Does anyone have any idea what kind of traffic I might be transmitting
> that is being administratively prohibited by the local network?
>
> Eric Johnson
> -
> [To unsubscribe, send mail to [EMAIL PROTECTED] with
> "unsubscribe firewalls" in the body of the message.]
--
Mikael Olsson, EnterNet Sweden AB, Box 393, S-891 28 �RNSK�LDSVIK
Phone: +46-(0)660-105 50 Fax: +46-(0)660-122 50
Mobile: +46-(0)70-248 00 33
WWW: http://www.enternet.se E-mail: [EMAIL PROTECTED]
-
[To unsubscribe, send mail to [EMAIL PROTECTED] with
"unsubscribe firewalls" in the body of the message.]
