Here is the packet trace - ICMP seems to be coming from my SAMBA Server -
see frame 3
Does the netstat output look correct in my first request for help?
Joel Morrow
jiram@aol.com
TRACE
Frame 1 (92 on wire, 92 captured)
Arrival Time: Dec 22, 2001 09:36:08.333676000
Time delta from previous packet: 1.999444000 seconds
Time relative to first packet: 2.000088000 seconds
Frame Number: 6
Packet Length: 92 bytes
Capture Length: 92 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:80:ad:75:3c:2f (Telebit_75:3c:2f)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.102 (192.168.1.102), Dst Addr:
192.168.1.255 (192.168.1.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xb5e9 (correct)
Source: 192.168.1.102 (192.168.1.102)
Destination: 192.168.1.255 (192.168.1.255)
User Datagram Protocol, Src Port: nbname (137), Dst Port: nbname (137)
Source port: nbname (137)
Destination port: nbname (137)
Length: 58
Checksum: 0xe683 (correct)
NetBIOS Name Service
Transaction ID: 0x10ba
Flags: 0x0110 (Name query)
0... .... .... .... = Query
.000 0... .... .... = Name query
.... ..0. .... .... = Message is not truncated
.... ...1 .... .... = Do query recursively
.... .... ...1 .... = Broadcast packet
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
HOMENET <1d>: type NB, class inet
Name: HOMENET <1d> (Local Master Browser)
Type: NB
Class: inet
Frame 2 (104 on wire, 104 captured)
Arrival Time: Dec 22, 2001 09:36:08.333786000
Time delta from previous packet: 0.000110000 seconds
Time relative to first packet: 2.000198000 seconds
Frame Number: 7
Packet Length: 104 bytes
Capture Length: 104 bytes
Ethernet II
Destination: 00:80:ad:75:3c:2f (Telebit_75:3c:2f)
Source: 00:b0:d0:16:d8:c7 (JOEL)
Type: IP (0x0800)
Internet Protocol, Src Addr: JOEL (192.168.1.99), Dst Addr: 192.168.1.102
(192.168.1.102)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 90
Identification: 0x00e4
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0xb595 (correct)
Source: JOEL (192.168.1.99)
Destination: 192.168.1.102 (192.168.1.102)
User Datagram Protocol, Src Port: nbname (137), Dst Port: nbname (137)
Source port: nbname (137)
Destination port: nbname (137)
Length: 70
Checksum: 0x0d21 (correct)
NetBIOS Name Service
Transaction ID: 0x10ba
Flags: 0x8500 (Name query response, No error)
1... .... .... .... = Response
.000 0... .... .... = Name query
.... .1.. .... .... = Server is an authority for domain
.... ..0. .... .... = Message is not truncated
.... ...1 .... .... = Do query recursively
.... .... 0... .... = Server can't do recursive queries
.... .... ...0 .... = Not a broadcast packet
.... .... .... 0000 = No error
Questions: 0
Answer RRs: 1
Authority RRs: 0
Additional RRs: 0
Answers
HOMENET <1d>: type NB, class inet
Name: HOMENET <1d> (Local Master Browser)
Type: NB
Class: inet
Time to live: 3 days, 11 hours, 20 minutes
Data length: 6
Flags: 0x0 (B-node, unique)
0... .... .... .... = Unique name
.00. .... .... .... = B-node
Addr: 192.168.1.99
Frame 3 (132 on wire, 132 captured)
Arrival Time: Dec 22, 2001 09:36:08.334081000
Time delta from previous packet: 0.000295000 seconds
Time relative to first packet: 2.000493000 seconds
Frame Number: 8
Packet Length: 132 bytes
Capture Length: 132 bytes
Ethernet II
Destination: 00:b0:d0:16:d8:c7 (JOEL)
Source: 00:80:ad:75:3c:2f (Telebit_75:3c:2f)<---- MAC ADDRESS of SAMBA
SERVER-jm
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.1.102 (192.168.1.102), Dst Addr: JOEL
(192.168.1.99)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN:
0x00)
1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 118
Identification: 0x0500
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 255
Protocol: ICMP (0x01)
Header checksum: 0xf1ac (correct)
Source: 192.168.1.102 (192.168.1.102)
Destination: JOEL (192.168.1.99)
Internet Control Message Protocol
Type: 3 (Destination unreachable)
Code: 3 (Port unreachable)
Checksum: 0x816e (correct)
Internet Protocol, Src Addr: JOEL (192.168.1.99), Dst Addr: 192.168.1.102
(192.168.1.102)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 90
Identification: 0x00e4
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0xb595 (correct)
Source: JOEL (192.168.1.99)
Destination: 192.168.1.102 (192.168.1.102)
User Datagram Protocol, Src Port: nbname (137), Dst Port: nbname (137)
Source port: nbname (137)
Destination port: nbname (137)
Length: 70
Checksum: 0x0d21 (correct)
NetBIOS Name Service
Transaction ID: 0x10ba
Flags: 0x8500 (Name query response, No error)
1... .... .... .... = Response
.000 0... .... .... = Name query
.... .1.. .... .... = Server is an authority for domain
.... ..0. .... .... = Message is not truncated
.... ...1 .... .... = Do query recursively
.... .... 0... .... = Server can't do recursive queries
.... .... ...0 .... = Not a broadcast packet
.... .... .... 0000 = No error
Questions: 0
Answer RRs: 1
Authority RRs: 0
Additional RRs: 0
Answers
HOMENET <1d>: type NB, class inet
Name: HOMENET <1d> (Local Master Browser)
Type: NB
Class: inet
Time to live: 3 days, 11 hours, 20 minutes
Data length: 6
Flags: 0x0 (B-node, unique)
0... .... .... .... = Unique name
.00. .... .... .... = B-node
Addr: 192.168.1.99
-------------- next part --------------
HTML attachment scrubbed and removed
