all, this technically isn't a cisco question, but i've been a long-time reader and this is a puzzle eluding solution thus far so i thought i would try. i also find it somewhat intriguing.
we're connected to our upstream provider via a t-1 (we're a software house). per mrtg we use around 400kbps inbound and half that outbound. the external router runs at very low cpu utilization ( 80 [SYN] Seq=1649310639 Ack=0 Win=16384 Len=0 486 7.445579 10.3.107.219 207.68.172.254 TCP 1416 > 80 [SYN] Seq=1649310639 Ack=0 Win=16384 Len=0 496 7.529725 207.68.172.254 10.3.107.219 TCP 80 > 1416 [SYN, ACK] Seq=392139821 Ack=1649310640 Win=17520 Len=0 497 7.530401 207.68.172.254 10.3.107.219 TCP 80 > 1416 [SYN, ACK] Seq=392139821 Ack=1649310640 Win=17520 Len=0 and here the unsuccessful one: No. Time Source Destination Protocol Info 152 3.329276 10.3.107.219 10.3.1.4 NBNS Name query NB WWW.MSN.COM 153 3.329642 10.3.1.4 10.3.107.219 NBNS Name query response 154 3.329709 10.3.107.219 10.3.1.2 NBNS Name query NB WWW.MSN.COM 155 3.330041 10.3.1.2 10.3.107.219 NBNS Name query response 157 3.333270 10.3.107.219 10.3.255.255 NBNS Name query NB WWW.MSN.COM 193 4.084392 10.3.107.219 10.3.255.255 NBNS Name query NB WWW.MSN.COM 246 4.835467 10.3.107.219 10.3.255.255 NBNS Name query NB WWW.MSN.COM 1019 11.505372 10.3.107.219 10.3.55.16 TCP 1354 > 1541 [PSH, ACK] Seq=3806101123 Ack=882030577 Win=16240 Len=68 1020 11.505846 10.3.55.16 10.3.107.219 TCP 1541 > 1354 [PSH, ACK] Seq=882030577 Ack=3806101191 Win=8364 Len=32 1038 11.665308 10.3.107.219 10.3.55.16 TCP 1354 > 1541 [ACK] Seq=3806101191 Ack=882030609 Win=16208 Len=0 notice the successful one does a dns lookup and the unsuccessful one a nbns. curious. here is how the workstation is presently config'd: Microsoft Windows 2000 [Version 5.00.2195] (C) Copyright 1985-1999 Microsoft Corp. C:\>netstat Active Connections Proto Local Address Foreign Address State TCP gallen:1037 hrnexch2:1047 ESTABLISHED TCP gallen:1041 hrnexch2:1063 ESTABLISHED TCP gallen:1044 hrnexch2:1047 ESTABLISHED TCP gallen:1048 hrnexch2:1063 ESTABLISHED TCP gallen:1065 HRNPRINT:netbios-ssn ESTABLISHED TCP gallen:1437 go.msn.com:http TIME_WAIT C:\>ipconfig Windows 2000 IP Configuration Ethernet adapter Local Area Connection: Connection-specific DNS Suffix . : ser.com IP Address. . . . . . . . . . . . : 10.3.107.219 Subnet Mask . . . . . . . . . . . : 255.255.0.0 Default Gateway . . . . . . . . . : 10.3.0.1 C:\>nbtstat -n Local Area Connection: Node IpAddress: [10.3.107.219] Scope Id: [] NetBIOS Local Name Table Name Type Status --------------------------------------------- GALLEN UNIQUE Registered HERNDON GROUP Registered GALLEN UNIQUE Registered GALLEN UNIQUE Registered HERNDON GROUP Registered INet~Services GROUP Registered IS~GALLEN...... UNIQUE Registered C:\>arp -a Interface: 10.3.107.219 on Interface 0x1000003 Internet Address Physical Address Type 10.3.0.10 08-00-20-ac-27-1d dynamic 10.3.1.2 00-50-8b-ec-7c-14 dynamic 10.3.1.4 00-50-8b-ec-88-64 dynamic 10.3.1.5 00-50-8b-bd-30-1b dynamic 10.3.1.10 00-a0-c9-82-47-4b dynamic 10.3.1.24 00-08-c7-91-83-9e dynamic thanks in advance for your comments. Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=45820&t=45820 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]