[Samba] malformed broadcast packets ?

[Boles, Jason]

Hello All,
  I recently upgraded to Redhat AS3 from an older 7.3 installation.
With samba 3 (3.0.2-6.3E is the rpm version), I've been seeing activity
that wasn't present before.

Every 15 minutes (within a few seconds accuracy), I receive an alert
from our SonicWall (firewall appliance) reporting that a "Malformed IP
packet dropped." where the source was the upgraded server, and the
destination was the subnet (x.y.z.255).  Src & Dest port was 137.

So what is smbd or nmbd (or maybe winbindd) transmitting every 15
minutes ?

There is nothing in the logs corresponding to those timestamps, or to
indicate that there is another source for this.  

(turning off sonicwall alerts is not an option)

all of the samba clients are win2k/XP and on the same subnet as the
server.  It's setup for security = DOMAIN, with another Windows Server
2003 box as the domain controller (also on the same subnet, behind the
same firewall).


thanks ahead of time,
-Jason