On 12/03/2014 05:05 PM, g wrote: > John, > thank you for replying. > > On 12/03/2014 03:21 PM, John R Pierce wrote: >> On 12/3/2014 12:47 PM, g wrote: >>> wireshark text file loaded at; >>> >>> http://pastebin.com/rCU0CC10 >> some device on your network has the MAC address 00:0f:fe:8f:8f:23 >> which Wireshark is calling PartedMagic for unknown reasons. > see my new paste at; > > http://pastebin.com/8vBxnUSf > > since [zep at nemesis ~]$ nslookup secure.informaction.com Server: 192.168.10.22 Address: 192.168.10.22#53 Non-authoritative answer: Name: secure.informaction.com Address: 82.103.140.42 Name: secure.informaction.com Address: 82.103.140.40 Name: secure.informaction.com Address: 69.195.141.178 Name: secure.informaction.com Address: 69.195.141.179 and going to www.informaction.com lists off things like noscript and a few other browser add on sorts of things, I'd tend to think that you [perhaps the plural 'you', meaning possibly some other individual] installed one of their extensions [or some other piece of FOSS] and it's doing a call home to check for updates or do some sort of comparison, like adblock's blacklist. no idea where the wonky name comes from. -- public gpg key id: AE60F64C