здравствуйте
имеется сеть 192.168.0.0/16
router 192.168.1.1
адреса в сети статические и прописаны в фаерволе
имеется злоумышленник с адресом 192.168.109.27
делаем так:

tcpdump -i eth0 src 192.168.109.27
13:53:57.659449 IP (tos 0x0, ttl 1, id 1168, offset 0, flags [none], proto IGMP (2), length 40, options (RA)) 192.168.109.27 > IGMP.MCAST.NET: igmp v3 report, 1 group record(s) [gaddr 234.0.0.1 to_in { }]
13:53:58.364540 IP (tos 0x0, ttl 128, id 1169, offset 0, flags [none], proto UDP (17), length 78) 192.168.109.27.netbios-ns > 192.168.255.255.netbios-ns: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

TrnID=0x80B6
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=WORK            NameType=0x1B (Domain Controller)
QuestionType=0x20
QuestionClass=0x1

13:54:01.114386 IP (tos 0x0, ttl 128, id 1170, offset 0, flags [none], proto UDP (17), length 78) 192.168.109.27.netbios-ns > 192.168.255.255.netbios-ns: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

TrnID=0x80B8
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=WORK            NameType=0x1E (Browser Server)
QuestionType=0x20
QuestionClass=0x1

13:54:01.864308 IP (tos 0x0, ttl 128, id 1171, offset 0, flags [none], proto UDP (17), length 78) 192.168.109.27.netbios-ns > 192.168.255.255.netbios-ns: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

TrnID=0x80B8
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=WORK            NameType=0x1E (Browser Server)
QuestionType=0x20
QuestionClass=0x1

13:54:02.614259 IP (tos 0x0, ttl 128, id 1172, offset 0, flags [none], proto UDP (17), length 78) 192.168.109.27.netbios-ns > 192.168.255.255.netbios-ns: [udp sum ok]
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST

TrnID=0x80B8
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=WORK            NameType=0x1E (Browser Server)
QuestionType=0x20
QuestionClass=0x1

а теперь объясните что он пытается сделать?