How do I detect which process is stealing focus?

Question

Every 5 minutes at :4 and :9, some process steals keyboard focus, and then gives it back to the application in the foreground.  This disrupts my work because it takes my cursor out of the text box I was typing in, and puts it in the browser generally, and I must re-click in the text box to get focus back.   It's maddening.
If I reboot my computer, it stops doing that for awhile, until I do some sort of activity which lights off this thing, but I don't know what it is. 
How can I use diagnostic tools to see which application is doing this?  I have access to "dtrace"  but not quite sure how to ask it for focus changes.  Are there other diagnostic tools that would do better? 
Here's what dtrace says right around the time it happened.   I was in Camino at the time. 
$ sudo dtrace -n 'syscall::open*:entry { printf("%s %s",execname,copyinstr(arg0)); }'
Coming up on it...
  1  17728                       open:entry Safari /Users/harpwolf/Library/Keychains/Microsoft_Intermediate_Certificates
  1  17728                       open:entry Safari /Users/harpwolf/Library/Application Support/Adobe/AIR/ELS/com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1/ PrivateEncryptedDatak
  1  18514              open_nocancel:entry DirectoryServic /etc/resolver
BOOM IT JUST DID IT NOW
  1  17728                       open:entry ATSServer /.vol/234881026/8073/Courier.dfont
OK it's over
Is that at all useful?  I checked seconds later, there is no process "17728" and that's not even near the number of the processes being handed out at the time.
$ ps -aef | grep 17728
  501 91064 91011   0   0:00.00 ttys001    0:00.00 grep 17728
Thank you for any possible help.  This is driving me nutz.

Answer 1

Gotcha.
Sep 15 20:55:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 20:56:25: --- last message repeated 2 times ---
Sep 15 21:01:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:02:25: --- last message repeated 2 times ---
Sep 15 21:07:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:08:25: --- last message repeated 2 times ---
Sep 15 21:13:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:14:25: --- last message repeated 2 times ---
Sep 15 21:19:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:20:25: --- last message repeated 2 times ---
Sep 15 21:25:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:26:25: --- last message repeated 2 times ---
Sep 15 21:31:55 mymac Firewall[40]: Deny nmblookup data in from 192.168.1.1:137 uid = 0 proto=17
Sep 15 21:32:25: --- last message repeated 2 times ---
Now, what on earth is it???