Re: reading your email via tcpdump

[John Jasen]

Sorry, I lost track of attributions. Need more coffee,

> > 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> > Res2=0x0
> > SourceName=T1H6I3          NameType=0x00 (Workstation)
> > DestName=
> > SMB PACKET: SMBunknown (REQUEST)
> > SMB Command   =  0x43
> > Error class   =  0x46
> > Error code    =  20550
> > Flags1        =  0x45
> > Flags2        =  0x4E
> > Tree ID       =  17990
> > Proc ID       =  18000
> > UID           =  16720
> > MID           =  16707
> > Word Count    =  66
> > SMBError = ERROR: Unknown error (70,20550)

This looks like standard SMB garbage. It probably repeats on a regular
basis. From what I remember, I think it is a Windows box browsing
the network trying to discover other SMB boxes, finding a 'master
browser', and other such stuff.

I see it all the time when there are Windows machines about, and I'm
running tcpdump.

I imagine that someone who knows better, such as the Samba guys, would be
able to tell you exactly whats going on, and maybe some other interesting
tidbits of information.

(I hate SMB ... its really chatty ...)

--
-- John E. Jasen ([e-mail])
-- User Error #2361: Please insert coffee and try again.