> All the machines are on the same subnet.
Are they all on a single switch?
> Source of 192.168.53.238 and a destination of 192.168.53.8 Protocol-UDP source port: 1346 Destination port: 1347. (This is a working client.)
This is the normal status back-and-forth chatter, 192.168.53.8 being your server. Port 1347 is the port the server uses for receiving client requests, port 1346 is the one the clients use for just about everything.
To get to this point, the client has to have discovered that 192.168.53.8 is the server's current IP somehow (generally, either by WINS - which has two modes of operation depending on whether you have a WINS server or not - or by sending a multicast query). What you see next is a machine which hasn't succeeded at that discovery.
> Dynamic client source 192.168.53.161 and a destination of 229.55.150.208 protocol is UDP source port: 1346 Destination port: 1345
In this case, port 1345 is one used on the server side for discovery requests from clients. This should not be the only discovery traffic; the clients should also be trying WINS as a fallback for situations where people deliberately configure their switches/routers/firewalls to disable IP multicast. You should also be seeing those queries being periodically emitted by the clients (WINS is also often called the NetBIOS Name Service and you might see Ethereal classify that traffic as NBNS as a result).
> We never did have a WINS server.
WINS, as I said, has two modes. If you have a server, machines wishing to register a name send their registrations to that specific server, and queries work the same way (this, having a WINS server reduces the broadcast traffic, and it also allows name registrations to be propagated between IP subnets by sharing a server.
If you don't configure one at all, WINS works by sending broadcasts; name registrations are broadcast out to look for conflicts, and queries are broadcast so that machine(s) having matching registrations can tell the querier that they have a registrations. By and large, the broadcasts used are classic non-routable IP 255.255.255.255 broadcasts.
> My question is where does the destination ip of 229.55.150.208 come from and how do I change that?
229.55.150.208 is an IP multicast group address - GSS Servers and clients use that multicast group to be able to find each other. Ghost has for many, many years made heavy use of IP multicast in order to distribute image data in a network-friendly way.
There's a nice overview of IP multicast at Cisco's site:
http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/mcst_sol/mcst_ovr.htmThere isn't currently a way of letting you change this, but then you really don't
need to be able to change it. If this query isn't working, because multicasting is disabled or blocked somewhere (perhaps at a firewall), the question is why the WINS fallback isn't working either.
Have you also got local broadcasting disabled, and/or do you have NBNS traffic firewalled?