Ray Van Dolson wrote:>Hi folks. Periodically a workgroup shows up on our network with an
>inappropriate name. We're trying to find the best way to track this
>down as it's quite intermittent.
>
>We can obviously look for announcement messages (in broadcast packets
>on ports 138/139), but this must be done on each subnet and we have
>enough subnets that this would be rather tedious and at best, a last
>resort.
>
>The workgroup is available to machines in every subnet, so apparently
>its presence is getting relayed back to the domain controllers...
>
>For protocol gurus: is there a particular packet we can look for on the
>domain controllers that could help us narrow down our search to the
>right subnet? A message from the local master browser sending a list
>of workgroups perhaps?
>
>Or a message updating WINS entries?
>
>Any suggestions would be appreciated!
>
>Thanks,
>Ray
Have cron execute a short script every few minutes looking for the
workgroup, and emailing you what it finds:
nmblookup -M MSHOME > /tmp/workgroup.txt
if ! grep -q failed /tmp/workgroup.txt; then
mail -s "Workgroup found" root < /tmp/workgroup.txt
fi
Vista machines tend to announce themselves as workgroups, so if you have
anyone bringing a laptop into your network, or connecting through a VPN
link, you can see this sort of thing.
Moray.
"To err is human.? To purr, feline"