I noticed that a NetBSD machine on an ethernet with a lot of traffic
seems to really catch a lot of multicast packets.  Is it perhaps
catching too much?

They are coming in at about 50-100 per second, and are mostly DECnet,
LAT, etc. to addresses I should be caring about:

03:56:33.929310 aa:0:4:0:d0:fc ab:0:0:3:0:0 decnet 46: 
03:56:34.488367 aa:0:4:0:23:fc 9:0:2b:0:0:f lat 84: 
03:56:34.468974 aa:0:4:0:25:fc ab:0:4:1:78:0 6007 114: 
03:57:25.094407 8:0:2b:39:f7:f1 ab:0:0:2:0:0 moprc 46: 

I know nothing about these protocols, but is it possible that someone
can listen (the interface was in nonpromiscious mode when I sampled
the ethernet) in on others' traffic?  If so, then there has to be some
sort of filtering done at a higher level than what is is now.  I can
imagine DEC protocols to be chatty and brag that they exist a lot, but
I don't believe there is all that much DECnet trafic on this subnet...

Thanks,
--Michael

--
Michael Graff <explorer@vorpal.com>       NetBSD is the way to go!
PGP key on a key-server near you!         Rayshade the world!