samba - Feb 2004 - Printing vs. iptables

Recently, Windows 2000 SP4 clients have developed a problem when using a
network printer connected to a Samba print share.

Some applications are OK.  But take, well, notepad, for example.  Selecting
a local printer is normal, but there is a two minute delay (!) in selecting
a network printer.  Once selected, all is well.  All smb operations are
frozen until the selection happens.  This is disconcerting to users who are
sure there has been an outright crash.

If iptables has all rules flushed, printer selection is normal.

This appears to have been some change made by Microsoft recently, as this
installation was working normally and blew up recently with a Microsoft
security patch.  I'm not sure which patch broke this.

My firewall rules already account for normal and unicast traffic on ports
135-139 and 445.  And these rules have been successful until about three
weeks ago.

Has Microsoft recently begun using the XP UPnP ports with Win2K?  If not,
just what have they done?  This is driving me nuts.

Does Win2k SP4 introduce the webclient service? There has been quite a
few problems lately with XP, the webclient service and Samba.

Does your firewall see any traffic on port 80 when the users are
connecting to the printer? We had a similar problem with network shares
timing out for 3 minutes exactly - turning off webclient, (or not quite
so good - enabling port 80 on the firewall) solves the problem. Though
I'll say again, that was XP.

 John Snowdon - IT Support Specialist
-==========================================-
 Faculty of Medical Sciences Computing Dept
 School of Medical Education Development
 University of Newcastle
>-----Original Message-----
>From: Ken Tindle [mailto:ktindle@uky.edu] 
>Sent: 17 February 2004 18:08
>To: samba@lists.samba.org
>Subject: [Samba] Printing vs. iptables
>
>
>Recently, Windows 2000 SP4 clients have developed a problem 
>when using a
>network printer connected to a Samba print share.
>
>Some applications are OK.  But take, well, notepad, for 
>example.  Selecting
>a local printer is normal, but there is a two minute delay (!) 
>in selecting
>a network printer.  Once selected, all is well.  All smb operations are
>frozen until the selection happens.  This is disconcerting to 
>users who are
>sure there has been an outright crash.
>
>If iptables has all rules flushed, printer selection is normal.
>
>This appears to have been some change made by Microsoft 
>recently, as this
>installation was working normally and blew up recently with a Microsoft
>security patch.  I'm not sure which patch broke this.
>
>My firewall rules already account for normal and unicast 
>traffic on ports
>135-139 and 445.  And these rules have been successful until 
>about three
>weeks ago.
>
>Has Microsoft recently begun using the XP UPnP ports with 
>Win2K?  If not,
>just what have they done?  This is driving me nuts.
>
>
>
>-- 
>To unsubscribe from this list go to the following URL and read the
>instructions:  http://lists.samba.org/mailman/listinfo/samba
>

No, it does not appear to be webclient.  There seems to be no such service
on even the latest Win2K.

It appears there is some kind of anti-worm change in the MS-RPC code
contained in the latest security patches.

Samba 2.2.8a will hang for about a minute.  Samba 3.0.2a will hang for
about three minutes.