[snip]
My fear (uneducated on the matter) is that it is not WebTrends but
Microsoft's gethostbyaddr() call which would mean that this type of
crazy 137/udp WINS resolution traffic is more commonly mis-used than
we think.
There's probably something to this; since the advent of '95, I've seen
windoze users trying to hit the classful broadcast of the netblock of
their IP address. using /16s across sites makes this sort of stuff
obvious. I've taken to squashing it at PoP-egress, and not trying to
change the customers, as it is undoubtably just some as-shipped default.
Joe