Re: [Bulk] Network traffic log analysis

DanyJ <dan062@yahoo.com.au> writes:

I have run tshark and downloaded the capture file. I am reading the capture file using wireshark. I see a lot of the following showing:

18 1.047790 111.67.22.211 111.67.23.255 DB-LSP-DISC 153 Dropbox LAN sync Discovery Protocol

What are these? There is not Dropbox on the server. Any one can help please?

From context, I'm guessing that dropbox spams the LAN to find other dropbox users. Thus, someone else on your LAN is running dropbox.

IIRC dropbox showed up in my squid logs attempting to do crazy made-up HTTP verbs, too. I get the impression they're pretty cowboy.