samba - Jul 2004 - malformed broadcast packets ?

Hello All,
  I recently upgraded to Redhat AS3 from an older 7.3 installation.
With samba 3 (3.0.2-6.3E is the rpm version), I've been seeing activity
that wasn't present before.

Every 15 minutes (within a few seconds accuracy), I receive an alert
from our SonicWall (firewall appliance) reporting that a "Malformed IP
packet dropped." where the source was the upgraded server, and the
destination was the subnet (x.y.z.255).  Src & Dest port was 137.

So what is smbd or nmbd (or maybe winbindd) transmitting every 15
minutes ?

There is nothing in the logs corresponding to those timestamps, or to
indicate that there is another source for this.  

(turning off sonicwall alerts is not an option)

all of the samba clients are win2k/XP and on the same subnet as the
server.  It's setup for security = DOMAIN, with another Windows Server
2003 box as the domain controller (also on the same subnet, behind the
same firewall).


thanks ahead of time,
-Jason

I just tried adding this setting now, but the malformed packets are
still coming, and still in 15 minute intervals.  The default "lm
interval" is 60 seconds according to the smb.conf man page, so this must
be something different than lm announce packets.

(yes, I did restart the smb and nmbd daemons after making the change...)

any other suggestions ?
-Jason

> -----Original Message-----
> From: Mark Lidstone [mailto:mlidstone@bmtseatech.co.uk] 
> Sent: Monday, July 05, 2004 3:34 AM
> To: Boles, Jason
> Subject: RE: [Samba] malformed broadcast packets ?
> 
> 
> Hi Jason,
> 
> Try putting "lm announce = no" into your samba.conf.  
> "LanManager Announce" packets are only really needed in OS/2 
> environments.
> 
> I hope this helps,
> 
> Mark Lidstone
> IT and Network Support Administrator
> 
> BMT SeaTech Ltd
> Grove House, Meridians Cross, 7 Ocean Way
> Ocean Village, Southampton.  SO14 3TJ. UK
> Tel: +44 (0)23 8063 5122         
> Fax: +44 (0)23 8063 5144
> 
> E-Mail:  mailto:mark.lidstone@bmtseatech.co.uk
> Website: www.bmtseatech.co.uk 
> =============================================================>
=========> => Confidentiality Notice and Disclaimer:
> The contents of this e-mail and any attachments are intended 
> only for the use of the e-mail addressee(s) shown. If you are 
> not that person, or one of those persons, you are not allowed 
> to take any action based upon it or to copy it, forward, 
> distribute or disclose the contents of it and you should 
> please delete it from your system. BMT SeaTech Limited does 
> not accept liability for any errors or omissions in the 
> context of this e-mail or its attachments which arise as a 
> result of Internet transmission, nor accept liability for 
> statements which are those of the author and not clearly made 
> on behalf of BMT SeaTech Limited. 
> =============================================================>
=========> =>
> 
> -----Original Message-----
> From: Boles, Jason [mailto:jBoles@engr.pitt.edu] 
> Sent: 03 July 2004 00:29
> To: samba@lists.samba.org
> Subject: [Samba] malformed broadcast packets ?
> 
> 
> 
> Hello All,
>   I recently upgraded to Redhat AS3 from an older 7.3 
> installation. With samba 3 (3.0.2-6.3E is the rpm version), 
> I've been seeing activity that wasn't present before.
> 
> Every 15 minutes (within a few seconds accuracy), I receive 
> an alert from our SonicWall (firewall appliance) reporting 
> that a "Malformed IP packet dropped." where the source was 
> the upgraded server, and the destination was the subnet 
> (x.y.z.255).  Src & Dest port was 137.
> 
> So what is smbd or nmbd (or maybe winbindd) transmitting 
> every 15 minutes ?
> 
> There is nothing in the logs corresponding to those 
> timestamps, or to indicate that there is another source for this.  
> 
> (turning off sonicwall alerts is not an option)
> 
> all of the samba clients are win2k/XP and on the same subnet 
> as the server.  It's setup for security = DOMAIN, with 
> another Windows Server 2003 box as the domain controller 
> (also on the same subnet, behind the same firewall).
> 
> 
> thanks ahead of time,
> -Jason 
> -- 
> To unsubscribe from this list go to the following URL and read the
> instructions:  http://lists.samba.org/mailman/listinfo/samba
> 
>