* reading your email via tcpdump
@ 2002-03-18 17:20 Mike Galbraith
2002-03-19 11:39 ` Denis Vlasenko
0 siblings, 1 reply; 16+ messages in thread
From: Mike Galbraith @ 2002-03-18 17:20 UTC (permalink / raw)
To: linux-kernel
[-- Attachment #1: Type: text/plain, Size: 341 bytes --]
Greetings,
Kernel version is 2.5.7-pre2 if that matters.
I was reading lkml with a forgotten tcpdump running, when my son turned
on his windows box, blessing me with the usual msjunk. Is the attached
just a tcpdump bug? I had already read that message, and didn't really
expect to see it again.. not in my tcpdump log anyway :)
-Mike
[-- Attachment #2: Type: text/plain, Size: 8150 bytes --]
16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
>>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193 Res2=0x0
SourceName=T1H6I3 NameType=0x00 (Workstation)
DestName=
SMB PACKET: SMBunknown (REQUEST)
SMB Command = 0x43
Error class = 0x46
Error code = 20550
Flags1 = 0x45
Flags2 = 0x4E
Tree ID = 17990
Proc ID = 18000
UID = 16720
MID = 16707
Word Count = 66
SMBError = ERROR: Unknown error (70,20550)
smbvwv[]=
smb_vwv[0]=65280 (0xFF00)
smb_vwv[1]=19795 (0x4D53)
smb_vwv[2]=9538 (0x2542)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=4352 (0x1100)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=39 (0x27)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=0 (0x0)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=0 (0x0)
smb_vwv[24]=0 (0x0)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=39 (0x27)
smb_vwv[29]=86 (0x56)
smb_vwv[30]=3 (0x3)
smb_vwv[31]=1 (0x1)
smb_vwv[32]=1 (0x1)
smb_vwv[33]=2 (0x2)
smb_vwv[34]=56 (0x38)
smb_vwv[35]=19804 (0x4D5C)
smb_vwv[36]=18753 (0x4941)
smb_vwv[37]=21324 (0x534C)
smb_vwv[38]=20300 (0x4F4C)
smb_vwv[39]=23636 (0x5C54)
smb_vwv[40]=21058 (0x5242)
smb_vwv[41]=22351 (0x574F)
smb_vwv[42]=17747 (0x4553)
smb_vwv[43]=3072 (0xC00)
smb_vwv[44]=49152 (0xC000)
smb_vwv[45]=2343 (0x927)
smb_vwv[46]=22272 (0x5700)
smb_vwv[47]=21071 (0x524F)
smb_vwv[48]=18251 (0x474B)
smb_vwv[49]=20306 (0x4F52)
smb_vwv[50]=20565 (0x5055)
smb_vwv[51]=0 (0x0)
smb_vwv[52]=0 (0x0)
smb_vwv[53]=0 (0x0)
smb_vwv[54]=1024 (0x400)
smb_vwv[55]=0 (0x0)
smb_vwv[56]=16416 (0x4020)
smb_vwv[57]=128 (0x80)
smb_vwv[58]=0 (0x0)
smb_vwv[59]=21504 (0x5400)
smb_vwv[60]=18481 (0x4831)
smb_vwv[61]=18742 (0x4936)
smb_vwv[62]=51 (0x33)
smb_vwv[63]=25958 (0x6566)
smb_vwv[64]=24864 (0x6120)
smb_vwv[65]=24935 (0x6167)
smb_bcc=28265
smb_buf[]=
[000] 20 28 41 4C 54 2D 53 79 73 52 71 2D 62 20 61 6C (ALT-Sy sRq-b al
[010] 73 6F 20 77 6F 72 6B 65 64 20 6F 6E 63 65 29 2E so worke d once).
[020] 20 49 27 6D 20 72 75 6E 6E 69 6E 67 20 53 75 53 I'm run ning SuS
[030] 45 27 73 0D 0A 32 2E 34 2E 31 38 2D 33 30 20 6F E's..2.4 .18-30 o
[040] 6E 20 61 20 50 65 6E 74 69 75 6D 20 49 49 49 20 n a Pent ium III
[050] 28 43 6F 70 70 65 72 6D 69 6E 65 29 20 77 69 74 (Copperm ine) wit
[060] 68 20 32 35 36 20 4D 42 20 52 41 4D 20 28 79 65 h 256 MB RAM (ye
[070] 73 2C 20 49 20 73 68 6F 75 6C 64 0D 0A 74 72 79 s, I sho uld..try
[080] 20 76 61 6E 69 6C 6C 61 20 32 2E 34 2E 31 38 2C vanilla 2.4.18,
[090] 20 49 20 77 69 6C 6C 20 2E 2E 2E 29 0D 0A 4E 6F I will ...)..No
[0A0] 20 53 43 53 49 2C 20 61 6C 6C 20 49 44 45 2E 20 SCSI, a ll IDE.
[0B0] 4C 56 4D 20 61 6E 64 20 65 78 74 33 2E 0D 0A 49 LVM and ext3...I
[0C0] 20 64 6F 6E 27 74 20 67 65 74 20 61 6E 79 20 6F don't g et any o
[0D0] 6F 70 73 65 73 2C 20 6E 6F 20 65 6E 74 72 69 65 opses, n o entrie
[0E0] 73 20 69 6E 20 2F 76 61 72 2F 6C 6F 67 2F 6D 65 s in /va r/log/me
[0F0] 73 73 61 67 65 73 2C 20 6E 6F 74 68 69 6E 67 2E ssages, nothing.
[100] 20 49 0D 0A 6D 6F 75 6E 74 65 64 20 74 68 65 20 I..moun ted the
[110] 65 78 74 33 20 70 61 72 74 69 74 69 6F 6E 73 20 ext3 par titions
[120] 77 69 74 68 20 74 68 65 20 64 65 62 75 67 20 6F with the debug o
[130] 70 74 69 6F 6E 20 62 75 74 20 73 74 69 6C 6C 20 ption bu t still
[140] 6E 6F 20 6D 65 73 73 61 67 65 73 2E 0D 0A 57 68 no messa ges...Wh
[150] 61 74 20 6F 70 74 69 6F 6E 73 20 63 61 6E 20 49 at optio ns can I
[160] 20 74 75 72 6E 20 6F 6E 20 74 6F 20 73 65 61 72 turn on to sear
[170] 63 68 20 66 6F 72 20 74 68 65 20 70 72 6F 62 6C ch for t he probl
[180] 65 6D 3F 20 41 6E 79 20 6B 65 72 6E 65 6C 20 62 em? Any kernel b
[190] 6F 6F 74 0D 0A 6F 70 74 69 6F 6E 73 3F 20 4C 56 oot..opt ions? LV
[1A0] 4D 2F 65 78 74 33 20 6F 70 74 69 6F 6E 73 3F 0D M/ext3 o ptions?.
[1B0] 0A 0D 0A 4D 61 6E 79 20 74 68 61 6E 6B 73 2C 20 ...Many thanks,
[1C0] 52 69 63 68 61 72 64 0D 0A 0D 0A 0D 0A 2D 2D 20 Richard. .....--
[1D0] 0D 0A 20 20 20 52 69 63 68 61 72 64 20 45 6D 73 .. Ric hard Ems
[1E0] 0D 0A 20 20 20 2E 2E 2E 20 65 2D 6D 61 69 6C 3A .. ... e-mail:
[1F0] 20 72 2E 65 6D 73 40 67 6D 78 2E 6E 65 74 0D 0A r.ems@g mx.net..
[200] 20 20 20 2E 2E 2E 20 43 6F 6D 70 75 74 65 72 20 ... C omputer
[210] 53 63 69 65 6E 63 65 2C 20 55 6E 69 76 65 72 73 Science, Univers
[220] 69 74 79 20 6F 66 20 48 61 6D 62 75 72 67 0D 0A ity of H amburg..
[230] 0D 0A 20 20 20 55 6E 69 78 20 49 53 20 75 73 65 .. Uni x IS use
[240] 72 20 66 72 69 65 6E 64 6C 79 2E 20 49 74 27 73 r friend ly. It's
[250] 20 6A 75 73 74 20 73 65 6C 65 63 74 69 76 65 20 just se lective
[260] 61 62 6F 75 74 20 77 68 6F 20 69 74 73 20 66 72 about wh o its fr
[270] 69 65 6E 64 73 20 61 72 65 2E 0D 0A 2D 0D 0A 54 iends ar e...-..T
[280] 6F 20 75 6E 73 75 62 73 63 72 69 62 65 20 66 72 o unsubs cribe fr
[290] 6F 6D 20 74 68 69 73 20 6C 69 73 74 3A 20 73 65 om this list: se
[2A0] 6E 64 20 74 68 65 20 6C 69 6E 65 20 22 75 6E 73 nd the l ine "uns
[2B0] 75 62 73 63 72 69 62 65 20 6C 69 6E 75 78 2D 6B ubscribe linux-k
[2C0] 65 72 6E 65 6C 22 20 69 6E 0D 0A 74 68 65 20 62 ernel" i n..the b
[2D0] 6F 64 79 20 6F 66 20 61 20 6D 65 73 73 61 67 65 ody of a message
[2E0] 20 74 6F 20 6D 61 6A 6F 72 64 6F 6D 6F 40 76 67 to majo rdomo@vg
[2F0] 65 72 2E 6B 65 72 6E 65 6C 2E 6F 72 67 0D 0A 4D er.kerne l.org..M
[300] 6F 72 65 20 6D 61 6A 6F 72 64 6F 6D 6F 20 69 6E ore majo rdomo in
[310] 66 6F 20 61 74 20 20 68 74 74 70 3A 2F 2F 76 67 fo at h ttp://vg
[320] 65 72 2E 6B 65 72 6E 65 6C 2E 6F 72 67 2F 6D 61 er.kerne l.org/ma
[330] 6A 6F 72 64 6F 6D 6F 2D 69 6E 66 6F 2E 68 74 6D jordomo- info.htm
[340] 6C 0D 0A 50 6C 65 61 73 65 20 72 65 61 64 20 74 l..Pleas e read t
[350] 68 65 20 46 41 51 20 61 74 20 20 68 74 74 70 3A he FAQ a t http:
[360] 2F 2F 77 77 77 2E 74 75 78 2E 6F 72 67 2F 6C 6B //www.tu x.org/lk
[370] 6D 6C 2F 0D 0A 0D 0A 2E 0D 0A 70 6C 79 2D 54 6F ml/..... ..ply-To
[380] 3A 20 72 2E 65 6D 73 40 67 6D 78 2E 6E 65 74 0D : r.ems@ gmx.net.
[390] 0A 58 2D 4D 61 69 6C 65 72 3A 20 4D 6F 7A 69 6C .X-Maile r: Mozil
[3A0] 6C 61 20 34 2E 37 39 20 5B 65 6E 5D 20 28 58 31 la 4.79 [en] (X1
[3B0] 31 3B 20 55 3B 20 4C 69 6E 75 78 20 32 2E 34 2E 1; U; Li nux 2.4.
[3C0] 31 38 2D 34 47 42 20 69 36 38 36 29 0D 0A 58 2D 18-4GB i 686)..X-
[3D0] 41 63 63 65 70 74 2D 4C 61 6E 67 75 61 67 65 3A Accept-L anguage:
[3E0] 20 65 6E 2C 20 64 65 2C 20 65 73 0D 0A 4D 49 4D en, de, es..MIM
[3F0] 45 2D 56 65 72 73 69 6F 6E 3A 20 31 2E 30 0D 0A E-Versio n: 1.0..
[400] 54 6F 3A 09 6C 69 6E 75 78 2D 6B 65 72 6E 65 6C To:.linu x-kernel
[410] 40 76 67 65 72 2E 6B 65 72 6E 65 6C 2E 6F 72 67 @vger.ke rnel.org
[420] 0D 0A 53 75 62 6A 65 63 74 3A 20 32 2E 34 2E 31 ..Subjec t: 2.4.1
[430] 38 20 66 72 65 65 7A 65 73 20 6F 6E 20 68 65 61 8 freeze s on hea
[440] 76 79 20 49 4F 0D 0A 43 6F 6E 74 65 6E 74 2D 54 vy IO..C ontent-T
[450] 79 70 65 3A 20 74 65 78 74 2F 70 6C 61 69 6E 3B ype: tex t/plain;
[460] 20 63 68 61 72 73 65 74 3D 75 73 2D 61 73 63 69 charset =us-asci
[470] 69 0D 0A 43 6F 6E 74 65 6E 74 2D 54 72 61 6E 73 i..Conte nt-Trans
[480] 66 65 72 2D 45 6E 63 6F 64 69 6E 67 3A 20 37 62 fer-Enco ding: 7b
[490] 69 74 0D 0A 58 2D 56 69 72 75 73 2D 53 63 61 6E it..X-Vi rus-Scan
[4A0] 6E 65 64 3A 20 62 79 20 41 4D 61 56 69 53 2D 70 ned: by AMaViS-p
[4B0] 65 72 6C 31 31 2D 6D 69 6C 74 65 72 20 28 68 74 erl11-mi lter (ht
[4C0] 74 70 3A 2F 2F 61 6D 61 76 69 73 2E 6F 72 67 2F tp://ama vis.org/
[4D0] 29 0D 0A 53 65 6E 64 65 72 3A 09 6C 69 6E 75 78 )..Sende r:.linux
[4E0] 2D 6B 65 72 6E 65 6C 2D 6F 00 00 00 00 00 00 00 -kernel- o.......
[4F0] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 11:39 ` Denis Vlasenko
@ 2002-03-19 9:19 ` Mike Galbraith
2002-03-19 14:20 ` John Jasen
0 siblings, 1 reply; 16+ messages in thread
From: Mike Galbraith @ 2002-03-19 9:19 UTC (permalink / raw)
To: Denis Vlasenko; +Cc: linux-kernel
On Tue, 19 Mar 2002, Denis Vlasenko wrote:
> On 18 March 2002 15:20, Mike Galbraith wrote:
> > Greetings,
> >
> > Kernel version is 2.5.7-pre2 if that matters.
> >
> > I was reading lkml with a forgotten tcpdump running, when my son turned
> > on his windows box, blessing me with the usual msjunk. Is the attached
> > just a tcpdump bug? I had already read that message, and didn't really
> > expect to see it again.. not in my tcpdump log anyway :)
>
> 8-( We need SMB experts here...
> I presume your box is a Linux one.
Yes.
> Is this packet went from your box to win box?
No, it looks to me like tcpdump just gets uncleared pages, makes a
booboo while processing ms packet and spits out old page content.
(security doesn't matter to me, but I figured maybe it shouldn't be
doing that.. worth sending a note just in case)
> What was running on your box? Samba?
> Did you use smbfs?
No samba here. (configured in, but I never found a round-tuit)
>
> 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> bcast from your box to NetBIOS port?
> >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> Res2=0x0
> SourceName=T1H6I3 NameType=0x00 (Workstation)
> ^^^^^^ your hostname?
No, that's my son's winbox.
> DestName=
> SMB PACKET: SMBunknown (REQUEST)
> SMB Command = 0x43
> Error class = 0x46
> Error code = 20550
> Flags1 = 0x45
> Flags2 = 0x4E
> Tree ID = 17990
> Proc ID = 18000
> UID = 16720
> MID = 16707
> Word Count = 66
> SMBError = ERROR: Unknown error (70,20550)
> --
> vda
-Mike
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-18 17:20 reading your email via tcpdump Mike Galbraith
@ 2002-03-19 11:39 ` Denis Vlasenko
2002-03-19 9:19 ` Mike Galbraith
0 siblings, 1 reply; 16+ messages in thread
From: Denis Vlasenko @ 2002-03-19 11:39 UTC (permalink / raw)
To: Mike Galbraith, linux-kernel
On 18 March 2002 15:20, Mike Galbraith wrote:
> Greetings,
>
> Kernel version is 2.5.7-pre2 if that matters.
>
> I was reading lkml with a forgotten tcpdump running, when my son turned
> on his windows box, blessing me with the usual msjunk. Is the attached
> just a tcpdump bug? I had already read that message, and didn't really
> expect to see it again.. not in my tcpdump log anyway :)
8-( We need SMB experts here...
I presume your box is a Linux one.
Is this packet went from your box to win box?
What was running on your box? Samba?
Did you use smbfs?
16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
bcast from your box to NetBIOS port?
>>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
Res2=0x0
SourceName=T1H6I3 NameType=0x00 (Workstation)
^^^^^^ your hostname?
DestName=
SMB PACKET: SMBunknown (REQUEST)
SMB Command = 0x43
Error class = 0x46
Error code = 20550
Flags1 = 0x45
Flags2 = 0x4E
Tree ID = 17990
Proc ID = 18000
UID = 16720
MID = 16707
Word Count = 66
SMBError = ERROR: Unknown error (70,20550)
--
vda
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 9:19 ` Mike Galbraith
@ 2002-03-19 14:20 ` John Jasen
2002-03-19 14:58 ` Mike Galbraith
2002-03-19 18:11 ` Mike Fedyk
0 siblings, 2 replies; 16+ messages in thread
From: John Jasen @ 2002-03-19 14:20 UTC (permalink / raw)
To: Mike Galbraith; +Cc: Denis Vlasenko, linux-kernel
Sorry, I lost track of attributions. Need more coffee,
> > 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> > Res2=0x0
> > SourceName=T1H6I3 NameType=0x00 (Workstation)
> > DestName=
> > SMB PACKET: SMBunknown (REQUEST)
> > SMB Command = 0x43
> > Error class = 0x46
> > Error code = 20550
> > Flags1 = 0x45
> > Flags2 = 0x4E
> > Tree ID = 17990
> > Proc ID = 18000
> > UID = 16720
> > MID = 16707
> > Word Count = 66
> > SMBError = ERROR: Unknown error (70,20550)
This looks like standard SMB garbage. It probably repeats on a regular
basis. From what I remember, I think it is a Windows box browsing
the network trying to discover other SMB boxes, finding a 'master
browser', and other such stuff.
I see it all the time when there are Windows machines about, and I'm
running tcpdump.
I imagine that someone who knows better, such as the Samba guys, would be
able to tell you exactly whats going on, and maybe some other interesting
tidbits of information.
(I hate SMB ... its really chatty ...)
--
-- John E. Jasen (jjasen1@umbc.edu)
-- User Error #2361: Please insert coffee and try again.
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 14:20 ` John Jasen
@ 2002-03-19 14:58 ` Mike Galbraith
2002-03-19 18:11 ` Mike Fedyk
1 sibling, 0 replies; 16+ messages in thread
From: Mike Galbraith @ 2002-03-19 14:58 UTC (permalink / raw)
To: John Jasen; +Cc: Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, John Jasen wrote:
> Sorry, I lost track of attributions. Need more coffee,
>
>
> > > 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> > > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> > > Res2=0x0
> > > SourceName=T1H6I3 NameType=0x00 (Workstation)
> > > DestName=
> > > SMB PACKET: SMBunknown (REQUEST)
> > > SMB Command = 0x43
> > > Error class = 0x46
> > > Error code = 20550
> > > Flags1 = 0x45
> > > Flags2 = 0x4E
> > > Tree ID = 17990
> > > Proc ID = 18000
> > > UID = 16720
> > > MID = 16707
> > > Word Count = 66
> > > SMBError = ERROR: Unknown error (70,20550)
>
> This looks like standard SMB garbage. It probably repeats on a regular
> basis. From what I remember, I think it is a Windows box browsing
> the network trying to discover other SMB boxes, finding a 'master
> browser', and other such stuff.
Yeah, this part is normal loking junk. The abby-normal looking
bit got snipped :)
-Mike
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 18:11 ` Mike Fedyk
@ 2002-03-19 15:47 ` Andreas Dilger
2002-03-19 20:02 ` Mike Fedyk
` (2 more replies)
2002-03-19 18:56 ` Mike Galbraith
1 sibling, 3 replies; 16+ messages in thread
From: Andreas Dilger @ 2002-03-19 15:47 UTC (permalink / raw)
To: John Jasen, Mike Galbraith, Denis Vlasenko, linux-kernel
On Mar 19, 2002 10:11 -0800, Mike Fedyk wrote:
> That's not the problem part of the tcpdump output. The problem is that part
> of an email previously read on the linux box (with no samba runing. (also,
> no smbfs MikeG?)) showed up in the tcpdump output...
I haven't been following the whole thread, but it is _possible_ that the
email data was written to the end of a data block which was later re-used
for a file exported via SMB. Depending on how the SMB code works, is it
possible that it is sending a whole block of data to the client and/or
not zeroing out new blocks?
Of course (not having looked at the original tcpdump output), is it
possible that the email was captured by tcpdump because it arrived on
the host via the network?
Cheers, Andreas
--
Andreas Dilger \ "If a man ate a pound of pasta and a pound of antipasto,
\ would they cancel out, leaving him still hungry?"
http://www-mddsp.enel.ucalgary.ca/People/adilger/ -- Dogbert
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 14:20 ` John Jasen
2002-03-19 14:58 ` Mike Galbraith
@ 2002-03-19 18:11 ` Mike Fedyk
2002-03-19 15:47 ` Andreas Dilger
2002-03-19 18:56 ` Mike Galbraith
1 sibling, 2 replies; 16+ messages in thread
From: Mike Fedyk @ 2002-03-19 18:11 UTC (permalink / raw)
To: John Jasen; +Cc: Mike Galbraith, Denis Vlasenko, linux-kernel
On Tue, Mar 19, 2002 at 09:20:25AM -0500, John Jasen wrote:
> > > 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> > > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> > > Res2=0x0
> > > SourceName=T1H6I3 NameType=0x00 (Workstation)
> > > DestName=
> > > SMB PACKET: SMBunknown (REQUEST)
> > > SMB Command = 0x43
> > > Error class = 0x46
> > > Error code = 20550
> > > Flags1 = 0x45
> > > Flags2 = 0x4E
> > > Tree ID = 17990
> > > Proc ID = 18000
> > > UID = 16720
> > > MID = 16707
> > > Word Count = 66
> > > SMBError = ERROR: Unknown error (70,20550)
>
> This looks like standard SMB garbage. It probably repeats on a regular
> basis. From what I remember, I think it is a Windows box browsing
> the network trying to discover other SMB boxes, finding a 'master
> browser', and other such stuff.
>
> I see it all the time when there are Windows machines about, and I'm
> running tcpdump.
>
> I imagine that someone who knows better, such as the Samba guys, would be
> able to tell you exactly whats going on, and maybe some other interesting
> tidbits of information.
>
> (I hate SMB ... its really chatty ...)
That's not the problem part of the tcpdump output. The problem is that part
of an email previously read on the linux box (with no samba runing. (also,
no smbfs MikeG?)) showed up in the tcpdump output...
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 18:56 ` Mike Galbraith
@ 2002-03-19 18:52 ` Mike Fedyk
2002-03-19 19:16 ` Mike Galbraith
0 siblings, 1 reply; 16+ messages in thread
From: Mike Fedyk @ 2002-03-19 18:52 UTC (permalink / raw)
To: Mike Galbraith; +Cc: John Jasen, Denis Vlasenko, linux-kernel
On Tue, Mar 19, 2002 at 07:56:27PM +0100, Mike Galbraith wrote:
> On Tue, 19 Mar 2002, Mike Fedyk wrote:
> > That's not the problem part of the tcpdump output. The problem is that part
> > of an email previously read on the linux box (with no samba runing. (also,
> > no smbfs MikeG?)) showed up in the tcpdump output...
>
> Yes. That's exactly what worried me. (no clue as to security issues)
What computer is 10.0.0.101?
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 18:11 ` Mike Fedyk
2002-03-19 15:47 ` Andreas Dilger
@ 2002-03-19 18:56 ` Mike Galbraith
2002-03-19 18:52 ` Mike Fedyk
1 sibling, 1 reply; 16+ messages in thread
From: Mike Galbraith @ 2002-03-19 18:56 UTC (permalink / raw)
To: Mike Fedyk; +Cc: John Jasen, Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, Mike Fedyk wrote:
> On Tue, Mar 19, 2002 at 09:20:25AM -0500, John Jasen wrote:
> > > > 16:42:49.412862 10.0.0.101.netbios-dgm > 10.255.255.255.netbios-dgm:
> > > > >>> NBT UDP PACKET(138) Res=0x1102 ID=0x54 IP=10.0.0.101 Port=138 Length=193
> > > > Res2=0x0
> > > > SourceName=T1H6I3 NameType=0x00 (Workstation)
> > > > DestName=
> > > > SMB PACKET: SMBunknown (REQUEST)
> > > > SMB Command = 0x43
> > > > Error class = 0x46
> > > > Error code = 20550
> > > > Flags1 = 0x45
> > > > Flags2 = 0x4E
> > > > Tree ID = 17990
> > > > Proc ID = 18000
> > > > UID = 16720
> > > > MID = 16707
> > > > Word Count = 66
> > > > SMBError = ERROR: Unknown error (70,20550)
> >
> > This looks like standard SMB garbage. It probably repeats on a regular
> > basis. From what I remember, I think it is a Windows box browsing
> > the network trying to discover other SMB boxes, finding a 'master
> > browser', and other such stuff.
> >
> > I see it all the time when there are Windows machines about, and I'm
> > running tcpdump.
> >
> > I imagine that someone who knows better, such as the Samba guys, would be
> > able to tell you exactly whats going on, and maybe some other interesting
> > tidbits of information.
> >
> > (I hate SMB ... its really chatty ...)
>
> That's not the problem part of the tcpdump output. The problem is that part
> of an email previously read on the linux box (with no samba runing. (also,
> no smbfs MikeG?)) showed up in the tcpdump output...
Yes. That's exactly what worried me. (no clue as to security issues)
-Mike
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 18:52 ` Mike Fedyk
@ 2002-03-19 19:16 ` Mike Galbraith
0 siblings, 0 replies; 16+ messages in thread
From: Mike Galbraith @ 2002-03-19 19:16 UTC (permalink / raw)
To: Mike Fedyk; +Cc: John Jasen, Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, Mike Fedyk wrote:
> On Tue, Mar 19, 2002 at 07:56:27PM +0100, Mike Galbraith wrote:
> > On Tue, 19 Mar 2002, Mike Fedyk wrote:
> > > That's not the problem part of the tcpdump output. The problem is that part
> > > of an email previously read on the linux box (with no samba runing. (also,
> > > no smbfs MikeG?)) showed up in the tcpdump output...
> >
> > Yes. That's exactly what worried me. (no clue as to security issues)
>
> What computer is 10.0.0.101?
My son's win98 box. I'm ~positive that the message did _not_ propagate
to my son's box and come back via net.. local data exposed probably via
page return.
-Mike
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 15:47 ` Andreas Dilger
@ 2002-03-19 20:02 ` Mike Fedyk
2002-03-19 20:19 ` Richard B. Johnson
2002-03-19 21:04 ` Urban Widmark
2 siblings, 0 replies; 16+ messages in thread
From: Mike Fedyk @ 2002-03-19 20:02 UTC (permalink / raw)
To: John Jasen, Mike Galbraith, Denis Vlasenko, linux-kernel
On Tue, Mar 19, 2002 at 08:47:34AM -0700, Andreas Dilger wrote:
> On Mar 19, 2002 10:11 -0800, Mike Fedyk wrote:
> > That's not the problem part of the tcpdump output. The problem is that part
> > of an email previously read on the linux box (with no samba runing. (also,
> > no smbfs MikeG?)) showed up in the tcpdump output...
>
> I haven't been following the whole thread, but it is _possible_ that the
> email data was written to the end of a data block which was later re-used
> for a file exported via SMB. Depending on how the SMB code works, is it
> possible that it is sending a whole block of data to the client and/or
> not zeroing out new blocks?
>
> Of course (not having looked at the original tcpdump output), is it
> possible that the email was captured by tcpdump because it arrived on
> the host via the network?
>
I'm still waiting to find out what computer 10.0.0.101 is for MikeG...
But, he's not running samba or smbfs, and the email was encoded within a smb
packet...
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 15:47 ` Andreas Dilger
2002-03-19 20:02 ` Mike Fedyk
@ 2002-03-19 20:19 ` Richard B. Johnson
2002-03-20 0:34 ` Alan Cox
2002-03-19 21:04 ` Urban Widmark
2 siblings, 1 reply; 16+ messages in thread
From: Richard B. Johnson @ 2002-03-19 20:19 UTC (permalink / raw)
To: Andreas Dilger; +Cc: John Jasen, Mike Galbraith, Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, Andreas Dilger wrote:
> On Mar 19, 2002 10:11 -0800, Mike Fedyk wrote:
> > That's not the problem part of the tcpdump output. The problem is that part
> > of an email previously read on the linux box (with no samba runing. (also,
> > no smbfs MikeG?)) showed up in the tcpdump output...
>
The data sent/received on the network is precious. You will not have
any 'extra' data on its end except for possibly a single byte if the
data didn't have an even length. Note that these things are checksummed
and also CRCed in the hardware.
If you got part of somebody's email, I think you should look at
the `tcpdump` source. It may be the culprit...
Cheers,
Dick Johnson
Penguin : Linux version 2.4.18 on an i686 machine (797.90 BogoMips).
Windows-2000/Professional isn't.
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 15:47 ` Andreas Dilger
2002-03-19 20:02 ` Mike Fedyk
2002-03-19 20:19 ` Richard B. Johnson
@ 2002-03-19 21:04 ` Urban Widmark
2002-03-20 7:46 ` Mike Galbraith
2 siblings, 1 reply; 16+ messages in thread
From: Urban Widmark @ 2002-03-19 21:04 UTC (permalink / raw)
To: Andreas Dilger; +Cc: John Jasen, Mike Galbraith, Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, Andreas Dilger wrote:
> On Mar 19, 2002 10:11 -0800, Mike Fedyk wrote:
> > That's not the problem part of the tcpdump output. The problem is that part
> > of an email previously read on the linux box (with no samba runing. (also,
> > no smbfs MikeG?)) showed up in the tcpdump output...
>
> I haven't been following the whole thread, but it is _possible_ that the
> email data was written to the end of a data block which was later re-used
> for a file exported via SMB. Depending on how the SMB code works, is it
> possible that it is sending a whole block of data to the client and/or
> not zeroing out new blocks?
There was no SMB involved on the box that errors and as I understand it
the email never touched the windows box involved. I think this is just
tcpdump misbehaving.
I'm guessing that Mike ran tcpdump with no -s parameter. The tcpdump
decoder (for SMB and probably others) doesn't seem to look at how much
data is valid when it decodes. At least I believe that I have seen it
do that before and/or when playing with some decode to ascii patch.
The SMB part that is decoded is ridiculous. word count of 66 (10-15 yes,
lots of those but 66?). The Flags do not match what any server I know of
returns.
Further, when there is a smb error return normally the rest of the packet
is empty. And the (known) error classes are 0, 1, 2, 3, not 0x46. Some of
the "parameter words" (smb_vwv) looks suspicously like ascii data.
Like you say, if the tcpdump was running while the email was received on
Mike's box it is possible that it had that data in some buffer. When it
later got this message (in another buffer) and tried to decode it, it
decoded the length the message said it had and simply spewed out random
bytes from memory.
Someone that feels like doing some hex to ascii conversion can find work
here:
http://www.lib.uaa.alaska.edu/linux-kernel/archive/2002-Week-11/att-x_
/Urban
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 20:19 ` Richard B. Johnson
@ 2002-03-20 0:34 ` Alan Cox
2002-03-20 1:00 ` Petko Manolov
0 siblings, 1 reply; 16+ messages in thread
From: Alan Cox @ 2002-03-20 0:34 UTC (permalink / raw)
To: root
Cc: Andreas Dilger, John Jasen, Mike Galbraith, Denis Vlasenko, linux-kernel
> The data sent/received on the network is precious. You will not have
> any 'extra' data on its end except for possibly a single byte if the
> data didn't have an even length. Note that these things are checksummed
> and also CRCed in the hardware.
Wrong for ethernet. Ethernet has a minimum frame size
Alan
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-20 0:34 ` Alan Cox
@ 2002-03-20 1:00 ` Petko Manolov
0 siblings, 0 replies; 16+ messages in thread
From: Petko Manolov @ 2002-03-20 1:00 UTC (permalink / raw)
To: Alan Cox
Cc: root, Andreas Dilger, John Jasen, Mike Galbraith, Denis Vlasenko,
linux-kernel
Alan Cox wrote:
>>The data sent/received on the network is precious. You will not have
>>any 'extra' data on its end except for possibly a single byte if the
You will have padding if the ethernet packet is less than 60 bytes and
if necessary it will be more than a single byte. I am not sure what is
the value of the paddin bythes though. May be zero..
Petko
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: reading your email via tcpdump
2002-03-19 21:04 ` Urban Widmark
@ 2002-03-20 7:46 ` Mike Galbraith
0 siblings, 0 replies; 16+ messages in thread
From: Mike Galbraith @ 2002-03-20 7:46 UTC (permalink / raw)
To: Urban Widmark; +Cc: Andreas Dilger, John Jasen, Denis Vlasenko, linux-kernel
On Tue, 19 Mar 2002, Urban Widmark wrote:
> I'm guessing that Mike ran tcpdump with no -s parameter. The tcpdump
Correct.
> Like you say, if the tcpdump was running while the email was received on
> Mike's box it is possible that it had that data in some buffer. When it
> later got this message (in another buffer) and tried to decode it, it
> decoded the length the message said it had and simply spewed out random
> bytes from memory.
Hmm. There were other 'packets' containing binary data and ascii which I'm
pretty sure was not part of any network traffic.
I'll repeat this, and post a follow-up if I see anything which is definitely
not received data. For now, I'll assume that it's a harmless tcpdump booboo.
Thanks,
-Mike
^ permalink raw reply [flat|nested] 16+ messages in thread
end of thread, other threads:[~2002-03-20 7:34 UTC | newest]
Thread overview: 16+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2002-03-18 17:20 reading your email via tcpdump Mike Galbraith
2002-03-19 11:39 ` Denis Vlasenko
2002-03-19 9:19 ` Mike Galbraith
2002-03-19 14:20 ` John Jasen
2002-03-19 14:58 ` Mike Galbraith
2002-03-19 18:11 ` Mike Fedyk
2002-03-19 15:47 ` Andreas Dilger
2002-03-19 20:02 ` Mike Fedyk
2002-03-19 20:19 ` Richard B. Johnson
2002-03-20 0:34 ` Alan Cox
2002-03-20 1:00 ` Petko Manolov
2002-03-19 21:04 ` Urban Widmark
2002-03-20 7:46 ` Mike Galbraith
2002-03-19 18:56 ` Mike Galbraith
2002-03-19 18:52 ` Mike Fedyk
2002-03-19 19:16 ` Mike Galbraith
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).