[snip]

My fear (uneducated on the matter) is that it is not WebTrends but Microsoft's gethostbyaddr() call which would mean that this type of crazy 137/udp WINS resolution traffic is more commonly mis-used than we think.

There's probably something to this; since the advent of '95, I've seen windoze users trying to hit the classful broadcast of the netblock of their IP address. using /16s across sites makes this sort of stuff obvious. I've taken to squashing it at PoP-egress, and not trying to change the customers, as it is undoubtably just some as-shipped default. Joe -- Joe Provo, Network Architect 508.229.8400 x3006 Commercial Internet Services Group Fax 508.229.2375 UltraNet Communications, Inc., an RCN Company <jprovo@ultra.net>