Strange logs

[Devdas Bhagat <[EMAIL PROTECTED]>]

I am getting UDP packets from port 137 on various machines to port 53
on my secondary nameserver. 

Jan  1 19:00:02 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote ip:137 my_ip:53 L=61 S=0x00 I=62548 F=0x0000 T=222 (#21) 

Jan  1 19:00:03 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote_ip:137 my_ip:53 L=61 S=0x00 I=56959 F=0x0000 T=127 (#21)  

Jan 1 19:00:04 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip2:137 my_ip:53 L=61 S=0x00 I=62804 F=0x0000 T=222 (#21)  

Jan  1 19:00:04 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote_ip:137 my_ip:53 L=61 S=0x00 I=58239 F=0x0000 T=127 (#21)

Jan  1 19:00:05 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip2:137 my_ip:53 L=61 S=0x00 I=63060 F=0x0000 T=222 (#21)  

Jan  1 19:00:07 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote_ip:137 my_ip:53 L=61 S=0x00 I=60799 F=0x0000 T=127 (#21)  

Jan  1 19:00:08 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip3:137 my_ip:53 L=61 S=0x00 I=58702 F=0x0000 T=126 (#21)  

Jan  1 19:00:09 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote_ip:137 my_ip:53 L=61 S=0x00 I=61311 F=0x0000 T=127 (#21)  

Jan  1 19:00:10 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip3:137 my_ip:53 L=61 S=0x00 I=62286 F=0x0000 T=126 (#21)  

Jan  1 19:00:10 ns2 kernel: Packet log: input DENY eth0 PROTO=17
remote_ip:137 my_ip:53 L=61 S=0x00 I=61823 F=0x0000 T=127 (#21)  

Jan  1 19:00:11 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip2:137 my_ip:53 L=60 S=0x00 I=64340 F=0x0000 T=222 (#21)  

Jan  1 19:00:11 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip3:137 my_ip:53 L=61 S=0x00 I=64334 F=0x0000 T=126 (#21)  

Jan  1 19:00:13 ns2 kernel: Packet log: input DENY eth0 PROTO=17
rem_ip2:137 my_ip:53 L=60 S=0x00 I=64596 F=0x0000 T=222 (#21) 


These have been coming continuously since morning (about 9 hrs now), and
currently form half my logfile (rotated on Sunday at 4 am). No such
traces on the primary nameserver, and I use the same rules on both. Any
explanations of what this could be?
An attempted exploit or just a misconfigured File and Print share
(given the originating port)?

Devdas Bhagat 
--
Age, n.:
	That period of life in which we compound for the vices that we
	still cherish by reviling those that we no longer have the enterprise
	to commit.
		-- Ambrose Bierce