Lee Baker
2005-Feb-08 11:09 UTC
[Samba] NetBIOS wildcard queries repeated by wireless access points
I am trying to resolve a problem with NetBIOS wildcard broadcast queries
being relayed/repeated by around 50 US Robotics wireless access points.
The APs only re-broadcast wildcard queries from our samba3 server - our
numerous windows 2003 servers do not appear to use wildcard broadcast
queries (if they do, they are not causing the same problems).
Any help would be appreciate as this problem is causes massive network
problems as all our winxp clients repeatedly reply to each repeated
query.
Kind regards
Lee Baker
The initial NetBIOS packet from the samba server: (192.168.5.200 is the
samba server, 192.168.2.185 is a USR Access Point)
########################################################################
####################################################################
No. Time Source Destination Protocol
Info
3143 200.215902 192.168.5.200 192.168.5.255 NBNS
Name query NB
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
Frame 3143 (92 bytes on wire, 92 bytes captured)
Arrival Time: Feb 7, 2005 18:23:30.407103000
Time delta from previous packet: 91.745643000 seconds
Time since reference or first frame: 200.215902000 seconds
Frame Number: 3143
Packet Length: 92 bytes
Capture Length: 92 bytes
Ethernet II, Src: 00:0b:db:90:9f:0b, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (Broadcast)
Source: 00:0b:db:90:9f:0b (192.168.5.200)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.5.200 (192.168.5.200), Dst Addr:
192.168.5.255 (192.168.5.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0xad87 (correct)
Source: 192.168.5.200 (192.168.5.200)
Destination: 192.168.5.255 (192.168.5.255)
User Datagram Protocol, Src Port: 33175 (33175), Dst Port: netbios-ns
(137)
Source port: 33175 (33175)
Destination port: netbios-ns (137)
Length: 58
Checksum: 0x4190 (correct)
NetBIOS Name Service
Transaction ID: 0x6f69
Flags: 0x0110 (Name query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Name query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... ...1 .... = Broadcast: Broadcast packet
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>:
type NB, class inet
Name:
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
(Workstation/Redirector)
Type: NB
Class: inet
########################################################################
############################################################
The packet relayed by A US Robotics Access Point:
No. Time Source Destination Protocol
Info
3151 200.216628 192.168.5.200 192.168.5.255 NBNS
Name query NB
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
Frame 3151 (92 bytes on wire, 92 bytes captured)
Arrival Time: Feb 7, 2005 18:23:30.407829000
Time delta from previous packet: 0.000667000 seconds
Time since reference or first frame: 200.216628000 seconds
Frame Number: 3151
Packet Length: 92 bytes
Capture Length: 92 bytes
Ethernet II, Src: 00:c0:49:a9:b8:b4, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (Broadcast)
Source: 00:c0:49:a9:b8:b4 (192.168.2.185)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.5.200 (192.168.5.200), Dst Addr:
192.168.5.255 (192.168.5.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 78
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 63
Protocol: UDP (0x11)
Header checksum: 0xae87 (correct)
Source: 192.168.5.200 (192.168.5.200)
Destination: 192.168.5.255 (192.168.5.255)
User Datagram Protocol, Src Port: 33175 (33175), Dst Port: netbios-ns
(137)
Source port: 33175 (33175)
Destination port: netbios-ns (137)
Length: 58
Checksum: 0x4190 (correct)
NetBIOS Name Service
Transaction ID: 0x6f69
Flags: 0x0110 (Name query)
0... .... .... .... = Response: Message is a query
.000 0... .... .... = Opcode: Name query (0)
.... ..0. .... .... = Truncated: Message is not truncated
.... ...1 .... .... = Recursion desired: Do query recursively
.... .... ...1 .... = Broadcast: Broadcast packet
Questions: 1
Answer RRs: 0
Authority RRs: 0
Additional RRs: 0
Queries
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>:
type NB, class inet
Name:
*<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
(Workstation/Redirector)
Type: NB
Class: inet
Apparently Analagous Threads
Wisdom of the Ancients
