I am sorry if this is off topic, if so please send me direct e-mail instead of to the list... I have 3 nets separated by 2 firewalls, let say : 192.168.1.0/24 - net 1 192.168.0.0/24 - net 2 192.168.4.2/24 - net 3 my samba server is in 192.168.4.2 , and my win98 ws is in 192.168.1.100, to testing purpose I leave all two firewall open, and with tcpdump I see, packtes passing trough them, but I can not login in from win98 ws. I alse include here a brieft tcpdump information, with some packet, this came from firewall instalaed in 192.168.1.1 , witch gives access ftom net 3 to net 1. And what does this "negative responde" do anyway ? from net 2 to net 3 every thing works fine. Any help or hint will do .. thanks... 11:23:24.784246 192.168.1.100.1025 > 192.168.4.2.netbios-ssn: . ack 7 win 8755 (DF) 11:23:24.824571 192.168.4.2.netbios-ssn > 192.168.1.100.1025: . ack 74 win 7300 (DF) 11:23:24.844572 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): RELEASE; POSITIVE; RESPONSE; UNICAST 11:23:29.403130 arp who-has 192.168.1.100 tell 192.168.1.1 11:23:29.403264 arp reply 192.168.1.100 is-at 0:1:2:89:1a:16 11:23:36.711841 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:23:46.709145 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:23:52.707876 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:23:56.707112 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:03.400210 192.168.1.100.1028 > fw.concorde.net.domain: 1+ A? oracle.concorde.net. (37) 11:24:03.498496 fw.concorde.net.domain > 192.168.1.100.1028: 1* 1/1/1 A 192.168.4.2 (86) (DF) 11:24:03.508945 192.168.1.100 > 192.168.4.2: icmp: echo request 11:24:03.601499 192.168.4.2 > 192.168.1.100: icmp: echo reply 11:24:04.521447 192.168.1.100 > 192.168.4.2: icmp: echo request 11:24:04.612763 192.168.4.2 > 192.168.1.100: icmp: echo reply 11:24:05.521355 192.168.1.100 > 192.168.4.2: icmp: echo request 11:24:05.612390 192.168.4.2 > 192.168.1.100: icmp: echo reply 11:24:06.526062 192.168.1.100 > 192.168.4.2: icmp: echo request 11:24:06.616669 192.168.4.2 > 192.168.1.100: icmp: echo reply 11:24:06.706055 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:16.704159 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:18.813912 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:19.818587 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:20.823381 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:21.828160 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:22.832945 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; UNICAST 11:24:22.833045 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST 11:24:22.894448 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): REGISTRATION; POSITIVE; RESPONSE; UNICAST 11:24:22.894674 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; UNICAST 11:24:22.905931 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST 11:24:22.906148 192.168.1.100.netbios-dgm > 192.168.4.2.netbios-dgm: NBT UDP PACKET(138) 11:24:22.956653 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): REGISTRATION; POSITIVE; RESPONSE; UNICAST 11:24:22.957010 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:22.957075 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:23.003065 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:23.037111 192.168.4.2.netbios-dgm > 192.168.1.100.netbios-dgm: NBT UDP PACKET(138) 11:24:27.893130 arp who-has 192.168.1.100 tell 192.168.1.1 11:24:27.893255 arp reply 192.168.1.100 is-at 0:1:2:89:1a:16 11:24:38.000076 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:38.000157 192.168.1.100.netbios-dgm > 192.168.4.2.netbios-dgm: NBT UDP PACKET(138) 11:24:38.091479 192.168.4.2.netbios-dgm > 192.168.1.100.netbios-dgm: NBT UDP PACKET(138) 11:24:40.143809 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:43.144205 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:43.144347 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:24:43.144407 192.168.1.100.netbios-dgm > 192.168.4.2.netbios-dgm: NBT UDP PACKET(138) 11:24:43.242335 192.168.4.2.netbios-dgm > 192.168.1.100.netbios-dgm: NBT UDP PACKET(138) 11:24:43.242676 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; UNICAST 11:24:43.242967 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST 11:24:43.307244 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): WACK; POSITIVE; RESPONSE; UNICAST 11:24:43.319875 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): REGISTRATION; NEGATIVE; RESPONSE; UNICAST 11:24:43.331613 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST 11:24:43.331752 192.168.1.100.1029 > 192.168.4.2.netbios-ssn: S 131097:131097(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 11:24:43.421020 192.168.4.2.netbios-ssn > 192.168.1.100.1029: S 1075101442:1075101442(0) ack 131098 win 7300 <mss 1460,nop,nop,sackOK> (DF) 11:24:43.421139 192.168.1.100.1029 > 192.168.4.2.netbios-ssn: . ack 1 win 8760 (DF) 11:24:43.421150 192.168.1.100.1029 > 192.168.4.2.netbios-ssn: P 1:73(72) ack 1 win 8760NBT Packet (DF) 11:24:43.485576 192.168.4.2.netbios-ssn > 192.168.1.100.1029: . ack 73 win 7300 (DF) 11:24:43.492481 192.168.4.2.netbios-ssn > 192.168.1.100.1029: P 1:6(5) ack 73 win 7300NBT Packet (DF) 11:24:43.492580 192.168.1.100.1029 > 192.168.4.2.netbios-ssn: F 73:73(0) ack 6 win 8755 (DF) 11:24:43.492783 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): RELEASE; REQUEST; UNICAST 11:24:43.501661 192.168.4.2.netbios-ssn > 192.168.1.100.1029: F 6:6(0) ack 73 win 7300 (DF) 11:24:43.501863 192.168.1.100.1029 > 192.168.4.2.netbios-ssn: . ack 7 win 8755 (DF) 11:24:43.542235 192.168.4.2.netbios-ssn > 192.168.1.100.1029: . ack 74 win 7300 (DF) 11:24:43.561011 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): RELEASE; NEGATIVE; RESPONSE; UNICAST 11:24:52.997223 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:25:22.991425 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138) 11:25:22.991499 192.168.1.100.netbios-dgm > 192.168.4.2.netbios-dgm: NBT UDP PACKET(138) 11:25:23.042147 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST 11:25:23.081558 192.168.4.2.netbios-dgm > 192.168.1.100.netbios-dgm: NBT UDP PACKET(138) 11:25:23.101475 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST 11:25:23.101610 192.168.1.100.1030 > 192.168.4.2.netbios-ssn: S 170875:170875(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 11:25:23.190203 192.168.4.2.netbios-ssn > 192.168.1.100.1030: S 1128775196:1128775196(0) ack 170876 win 7300 <mss 1460,nop,nop,sackOK> (DF) 11:25:23.190325 192.168.1.100.1030 > 192.168.4.2.netbios-ssn: . ack 1 win 8760 (DF) 11:25:23.190336 192.168.1.100.1030 > 192.168.4.2.netbios-ssn: P 1:73(72) ack 1 win 8760NBT Packet (DF) 11:25:23.253031 192.168.4.2.netbios-ssn > 192.168.1.100.1030: . ack 73 win 7300 (DF) 11:25:23.259747 192.168.4.2.netbios-ssn > 192.168.1.100.1030: P 1:6(5) ack 73 win 7300NBT Packet (DF) 11:25:23.259849 192.168.1.100.1030 > 192.168.4.2.netbios-ssn: F 73:73(0) ack 6 win 8755 (DF) 11:25:23.260132 192.168.1.100.netbios-ns > 192.168.4.2.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; UNICAST 11:25:23.266494 192.168.4.2.netbios-ssn > 192.168.1.100.1030: F 6:6(0) ack 73 win 7300 (DF) 11:25:23.266577 192.168.1.100.1030 > 192.168.4.2.netbios-ssn: . ack 7 win 8755 (DF) 11:25:23.307087 192.168.4.2.netbios-ssn > 192.168.1.100.1030: . ack 74 win 7300 (DF) 11:25:23.325176 192.168.4.2.netbios-ns > 192.168.1.100.netbios-ns: NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST 11:25:23.325290 192.168.1.100.1031 > 192.168.4.2.netbios-ssn: S 171098:171098(0) win 8192 <mss 1460,nop,nop,sackOK> (DF) 11:25:23.414326 192.168.4.2.netbios-ssn > 192.168.1.100.1031: S 1130370054:1130370054(0) ack 171099 win 7300 <mss 1460,nop,nop,sackOK> (DF) 11:25:23.414422 192.168.1.100.1031 > 192.168.4.2.netbios-ssn: . ack 1 win 8760 (DF) 11:25:23.414433 192.168.1.100.1031 > 192.168.4.2.netbios-ssn: P 1:73(72) ack 1 win 8760NBT Packet (DF) 11:25:23.477235 192.168.4.2.netbios-ssn > 192.168.1.100.1031: . ack 73 win 7300 (DF) 11:25:23.483969 192.168.4.2.netbios-ssn > 192.168.1.100.1031: P 1:6(5) ack 73 win 7300NBT Packet (DF) 11:25:23.484054 192.168.1.100.1031 > 192.168.4.2.netbios-ssn: F 73:73(0) ack 6 win 8755 (DF) 11:25:23.484182 192.168.1.100.netbios-dgm > 192.168.4.2.netbios-dgm: NBT UDP PACKET(138) 11:25:23.490817 192.168.4.2.netbios-ssn > 192.168.1.100.1031: F 6:6(0) ack 73 win 7300 (DF) 11:25:23.490891 192.168.1.100.1031 > 192.168.4.2.netbios-ssn: . ack 7 win 8755 (DF) 11:25:23.531623 192.168.4.2.netbios-ssn > 192.168.1.100.1031: . ack 74 win 7300 (DF) 11:25:28.073127 arp who-has 192.168.1.100 tell 192.168.1.1 11:25:28.073224 arp reply 192.168.1.100 is-at 0:1:2:89:1a:16 11:25:52.985753 192.168.1.100.netbios-dgm > 192.168.1.255.netbios-dgm: NBT UDP PACKET(138)