malformed broadcast packets?

[Jason Boles]

Hello All,
(I sent this to the samba list last week, but it remains unresolved)

  I recently upgraded to Redhat AS3 from an older 7.3 installation.
With samba 3 (3.0.2-6.3E is the rpm version), I've been seeing
activity that wasn't present before.

Every 15 minutes (within a few seconds accuracy), I receive an alert
from our SonicWall (firewall appliance) reporting that a "Malformed IP
packet dropped." where the source was the upgraded server, and the
destination was the subnet (x.y.z.255).  Src & Dest port was 137.

So what is smbd or nmbd (or maybe winbindd) transmitting every 15 minutes ?

There is nothing in the logs corresponding to those timestamps, or to
indicate that there is another source for this.

(turning off sonicwall alerts is not an option)

all of the samba clients are win2k/XP and on the same subnet as the
server.  It's setup for security = DOMAIN, with another Windows Server
2003 box as the domain controller (also on the same subnet, behind the
same firewall).

---
one reply suggested to set "lm announce = no".  I tried this and it
did not help.
---

I also searched the archives and found that someone asked this
question previously, but it was not resolved back then either.

Thanks ahead of time,
-Jason