Frame 1 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 01:08:09.525204000 Time delta from previous packet: 0.000000000 seconds Time relative to first packet: 0.000000000 seconds Frame Number: 1 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 219.118.31.42 (219.118.31.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0706 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x20ce (incorrect, should be 0x1729) Source: 219.118.31.42 (219.118.31.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x97db (incorrect, should be 0x8e36) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 07 06 00 00 6f 11 20 ce db 76 1f 2a ac 10 .N....o. ..v.*.. 0020 86 bf 04 01 00 89 00 3a 97 db 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 2 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 01:08:09.525205000 Time delta from previous packet: 0.000001000 seconds Time relative to first packet: 0.000001000 seconds Frame Number: 2 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 219.118.31.42 (219.118.31.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x82e4 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x93f4 (incorrect, should be 0x8a4f) Source: 172.16.134.191 (172.16.134.191) Destination: 219.118.31.42 (219.118.31.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 309 Checksum: 0x7fb8 (incorrect, should be 0x9372) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 82 e4 00 00 7f 11 93 f4 ac 10 86 bf db 76 .I.............v 0020 1f 2a 00 89 04 01 01 35 7f b8 01 00 84 00 00 00 .*.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff 00 8d 94 ff 00 00 00 00 00 00 ................ 0150 00 00 15 02 00 ff 00 ....... Frame 11 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 03:33:12.419783000 Time delta from previous packet: 1952.777889000 seconds Time relative to first packet: 8702.894579000 seconds Frame Number: 11 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 218.163.9.89 (218.163.9.89), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xf3b1 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x47c6 (incorrect, should be 0x3e21) Source: 218.163.9.89 (218.163.9.89) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0xae7f (incorrect, should be 0xa4da) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e f3 b1 00 00 72 11 47 c6 da a3 09 59 ac 10 .N....r.G....Y.. 0020 86 bf 04 01 00 89 00 3a ae 7f 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 12 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 03:33:12.419784000 Time delta from previous packet: 0.000001000 seconds Time relative to first packet: 8702.894580000 seconds Frame Number: 12 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 218.163.9.89 (218.163.9.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x2029 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x0d54 (incorrect, should be 0x03af) Source: 172.16.134.191 (172.16.134.191) Destination: 218.163.9.89 (218.163.9.89) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 309 Checksum: 0x8a17 (incorrect, should be 0x9dd1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 20 29 00 00 7f 11 0d 54 ac 10 86 bf da a3 .I ).....T...... 0020 09 59 00 89 04 01 01 35 8a 17 01 00 84 00 00 00 .Y.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff e0 d1 94 ff 00 00 00 00 00 00 ................ 0150 00 00 6b 00 65 00 72 ..k.e.r Frame 34 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 06:59:32.078668000 Time delta from previous packet: 6021.004819000 seconds Time relative to first packet: 21082.553464000 seconds Frame Number: 34 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.155.126.150 (61.155.126.150), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x6e29 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 47 Protocol: UDP (0x11) Header checksum: 0x381a (incorrect, should be 0x2e75) Source: 61.155.126.150 (61.155.126.150) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0xd649 (incorrect, should be 0xcca4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 6e 29 00 00 2f 11 38 1a 3d 9b 7e 96 ac 10 .Nn)../.8.=.~... 0020 86 bf 04 02 00 89 00 3a d6 49 01 00 00 10 00 01 .......:.I...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 35 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 06:59:32.080296000 Time delta from previous packet: 0.001628000 seconds Time relative to first packet: 21082.555092000 seconds Frame Number: 35 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.155.126.150 (61.155.126.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x9505 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc042 (incorrect, should be 0xb69d) Source: 172.16.134.191 (172.16.134.191) Destination: 61.155.126.150 (61.155.126.150) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 309 Checksum: 0xc0f4 (incorrect, should be 0xd4ae) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 95 05 00 00 7f 11 c0 42 ac 10 86 bf 3d 9b .I.......B....=. 0020 7e 96 00 89 04 02 01 35 c0 f4 01 00 84 00 00 00 ~......5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff 60 bf 93 ff 00 00 00 00 00 00 ......`......... 0150 00 00 37 00 7d 00 00 ..7.}.. Frame 46 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 08:43:42.664104000 Time delta from previous packet: 5006.422702000 seconds Time relative to first packet: 27333.138900000 seconds Frame Number: 46 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 66.190.67.122 (66.190.67.122), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc98e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 118 Protocol: UDP (0x11) Header checksum: 0xcbad (incorrect, should be 0xc208) Source: 66.190.67.122 (66.190.67.122) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x0c41 (incorrect, should be 0x029c) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c9 8e 00 00 76 11 cb ad 42 be 43 7a ac 10 .N....v...B.Cz.. 0020 86 bf 04 04 00 89 00 3a 0c 41 01 00 00 10 00 01 .......:.A...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 47 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 08:43:42.668880000 Time delta from previous packet: 0.004776000 seconds Time relative to first packet: 27333.143676000 seconds Frame Number: 47 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 66.190.67.122 (66.190.67.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x9548 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xf5f8 (incorrect, should be 0xec53) Source: 172.16.134.191 (172.16.134.191) Destination: 66.190.67.122 (66.190.67.122) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 309 Checksum: 0x9515 (incorrect, should be 0xa8cf) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 95 48 00 00 7f 11 f5 f8 ac 10 86 bf 42 be .I.H..........B. 0020 43 7a 00 89 04 04 01 35 95 15 01 00 84 00 00 00 Cz.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff c0 95 9b ff 00 00 00 00 00 00 ................ 0150 00 00 31 00 7d 00 00 ..1.}.. Frame 55 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 09:00:10.420196000 Time delta from previous packet: 987.563980000 seconds Time relative to first packet: 28320.894992000 seconds Frame Number: 55 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 62.127.38.198 (62.127.38.198), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xffeb Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 105 Protocol: UDP (0x11) Header checksum: 0xc343 (incorrect, should be 0xb99e) Source: 62.127.38.198 (62.127.38.198) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x2d36 (incorrect, should be 0x2391) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e ff eb 00 00 69 11 c3 43 3e 7f 26 c6 ac 10 .N....i..C>.&... 0020 86 bf 04 02 00 89 00 3a 2d 36 01 00 00 10 00 01 .......:-6...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 76 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 09:23:39.448982000 Time delta from previous packet: 942.475695000 seconds Time relative to first packet: 29729.923778000 seconds Frame Number: 76 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 141.149.155.249 (141.149.155.249), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xd72c Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0x25b9 (incorrect, should be 0x1c14) Source: 141.149.155.249 (141.149.155.249) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 65060 (65060), Dst Port: netbios-ns (137) Source port: 65060 (65060) Destination port: netbios-ns (137) Length: 58 Checksum: 0x6ec9 (incorrect, should be 0x6524) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e d7 2c 00 00 6b 11 25 b9 8d 95 9b f9 ac 10 .N.,..k.%....... 0020 86 bf fe 24 00 89 00 3a 6e c9 01 00 00 10 00 01 ...$...:n....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 77 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 09:23:39.454345000 Time delta from previous packet: 0.005363000 seconds Time relative to first packet: 29729.929141000 seconds Frame Number: 77 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 141.149.155.249 (141.149.155.249) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0066 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xe796 (incorrect, should be 0xddf1) Source: 172.16.134.191 (172.16.134.191) Destination: 141.149.155.249 (141.149.155.249) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 65060 (65060) Source port: netbios-ns (137) Destination port: 65060 (65060) Length: 291 Checksum: 0x1f22 (incorrect, should be 0x32dc) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 66 00 00 7f 11 e7 96 ac 10 86 bf 8d 95 .7.f............ 0020 9b f9 00 89 fe 24 01 23 1f 22 01 00 84 00 00 00 .....$.#."...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 85 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 11:50:52.466280000 Time delta from previous packet: 8832.440524000 seconds Time relative to first packet: 38562.941076000 seconds Frame Number: 85 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 207.6.77.235 (207.6.77.235), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x9c4f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x6633 (incorrect, should be 0x5c8e) Source: 207.6.77.235 (207.6.77.235) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x7589 (incorrect, should be 0x6be4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 9c 4f 00 00 72 11 66 33 cf 06 4d eb ac 10 .N.O..r.f3..M... 0020 86 bf 04 02 00 89 00 3a 75 89 01 00 00 10 00 01 .......:u....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 86 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 11:50:52.471501000 Time delta from previous packet: 0.005221000 seconds Time relative to first packet: 38562.946297000 seconds Frame Number: 86 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 207.6.77.235 (207.6.77.235) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x00be Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xf3db (incorrect, should be 0xea36) Source: 172.16.134.191 (172.16.134.191) Destination: 207.6.77.235 (207.6.77.235) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x20fe (incorrect, should be 0x34b8) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 be 00 00 7f 11 f3 db ac 10 86 bf cf 06 .7.............. 0020 4d eb 00 89 04 02 01 23 20 fe 01 00 84 00 00 00 M......# ....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 94 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 13:29:07.208143000 Time delta from previous packet: 5894.205806000 seconds Time relative to first packet: 44457.682939000 seconds Frame Number: 94 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 162.33.189.252 (162.33.189.252), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x865b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x38fb (incorrect, should be 0x2f56) Source: 162.33.189.252 (162.33.189.252) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x325c (incorrect, should be 0x28b7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 86 5b 00 00 72 11 38 fb a2 21 bd fc ac 10 .N.[..r.8..!.... 0020 86 bf 04 03 00 89 00 3a 32 5c 01 00 00 10 00 01 .......:2\...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 95 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 13:29:07.212956000 Time delta from previous packet: 0.004813000 seconds Time relative to first packet: 44457.687752000 seconds Frame Number: 95 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 162.33.189.252 (162.33.189.252) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x00fe Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xb06f (incorrect, should be 0xa6ca) Source: 172.16.134.191 (172.16.134.191) Destination: 162.33.189.252 (162.33.189.252) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xe2b4 (incorrect, should be 0xf66e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 fe 00 00 7f 11 b0 6f ac 10 86 bf a2 21 .7.......o.....! 0020 bd fc 00 89 04 03 01 23 e2 b4 01 00 84 00 00 00 .......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 105 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 19:01:30.338061000 Time delta from previous packet: 12838.867971000 seconds Time relative to first packet: 64400.812857000 seconds Frame Number: 105 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 64.17.250.240 (64.17.250.240), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x46bf Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 109 Protocol: UDP (0x11) Header checksum: 0xa2b3 (incorrect, should be 0x990e) Source: 64.17.250.240 (64.17.250.240) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: netbios-ns (137) Source port: 1029 (1029) Destination port: netbios-ns (137) Length: 58 Checksum: 0x5776 (incorrect, should be 0x4dd1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 46 bf 00 00 6d 11 a2 b3 40 11 fa f0 ac 10 .NF...m...@..... 0020 86 bf 04 05 00 89 00 3a 57 76 01 00 00 10 00 01 .......:Wv...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 106 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 19:01:30.343299000 Time delta from previous packet: 0.005238000 seconds Time relative to first packet: 64400.818095000 seconds Frame Number: 106 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 64.17.250.240 (64.17.250.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x01d2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd4b7 (incorrect, should be 0xcb12) Source: 172.16.134.191 (172.16.134.191) Destination: 64.17.250.240 (64.17.250.240) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1029 (1029) Source port: netbios-ns (137) Destination port: 1029 (1029) Length: 291 Checksum: 0x87d7 (incorrect, should be 0x9b91) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 01 d2 00 00 7f 11 d4 b7 ac 10 86 bf 40 11 .7............@. 0020 fa f0 00 89 04 05 01 23 87 d7 01 00 84 00 00 00 .......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 d9 a0 ff 00 00 00 00 58 d9 a0 ff 58 d9 ..........X...X. 0140 a0 ff 5c 00 53 ..\.S Frame 114 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 21:17:18.440828000 Time delta from previous packet: 8147.669922000 seconds Time relative to first packet: 72548.915624000 seconds Frame Number: 114 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.84.75.42 (213.84.75.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xe049 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x21ac (incorrect, should be 0x1807) Source: 213.84.75.42 (213.84.75.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 10569 (10569), Dst Port: netbios-ns (137) Source port: 10569 (10569) Destination port: netbios-ns (137) Length: 58 Checksum: 0x4cb5 (incorrect, should be 0x4310) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e e0 49 00 00 6f 11 21 ac d5 54 4b 2a ac 10 .N.I..o.!..TK*.. 0020 86 bf 29 49 00 89 00 3a 4c b5 01 00 00 10 00 01 ..)I...:L....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 115 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 21:17:18.447242000 Time delta from previous packet: 0.006414000 seconds Time relative to first packet: 72548.922038000 seconds Frame Number: 115 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.84.75.42 (213.84.75.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0226 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xeee6 (incorrect, should be 0xe541) Source: 172.16.134.191 (172.16.134.191) Destination: 213.84.75.42 (213.84.75.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 10569 (10569) Source port: netbios-ns (137) Destination port: 10569 (10569) Length: 291 Checksum: 0xf829 (incorrect, should be 0x0be4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 26 00 00 7f 11 ee e6 ac 10 86 bf d5 54 .7.&...........T 0020 4b 2a 00 89 29 49 01 23 f8 29 01 00 84 00 00 00 K*..)I.#.)...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 130 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 23:16:43.629885000 Time delta from previous packet: 7139.219292000 seconds Time relative to first packet: 79714.104681000 seconds Frame Number: 130 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 68.152.53.138 (68.152.53.138), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xbc41 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0xec10 (incorrect, should be 0xe26b) Source: 68.152.53.138 (68.152.53.138) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x1857 (incorrect, should be 0x0eb2) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e bc 41 00 00 6f 11 ec 10 44 98 35 8a ac 10 .N.A..o...D.5... 0020 86 bf 04 04 00 89 00 3a 18 57 01 00 00 10 00 01 .......:.W...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 131 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 23:16:43.648090000 Time delta from previous packet: 0.018205000 seconds Time relative to first packet: 79714.122886000 seconds Frame Number: 131 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 68.152.53.138 (68.152.53.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0276 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x94f3 (incorrect, should be 0x8b4e) Source: 172.16.134.191 (172.16.134.191) Destination: 68.152.53.138 (68.152.53.138) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0xc3cb (incorrect, should be 0xd785) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 76 00 00 7f 11 94 f3 ac 10 86 bf 44 98 .7.v..........D. 0020 35 8a 00 89 04 04 01 23 c3 cb 01 00 84 00 00 00 5......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 139 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 23:40:01.725575000 Time delta from previous packet: 1397.716902000 seconds Time relative to first packet: 81112.200371000 seconds Frame Number: 139 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 4.64.221.42 (4.64.221.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc1ee Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x7d1b (incorrect, should be 0x7376) Source: 4.64.221.42 (4.64.221.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 32934 (32934), Dst Port: netbios-ns (137) Source port: 32934 (32934) Destination port: netbios-ns (137) Length: 58 Checksum: 0x346c (incorrect, should be 0x2ac7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c1 ee 00 00 71 11 7d 1b 04 40 dd 2a ac 10 .N....q.}..@.*.. 0020 86 bf 80 a6 00 89 00 3a 34 6c 01 00 00 10 00 01 .......:4l...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 140 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 23:40:01.728237000 Time delta from previous packet: 0.002662000 seconds Time relative to first packet: 81112.203033000 seconds Frame Number: 140 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 4.64.221.42 (4.64.221.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x028a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x2d97 (incorrect, should be 0x23f2) Source: 172.16.134.191 (172.16.134.191) Destination: 4.64.221.42 (4.64.221.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 32934 (32934) Source port: netbios-ns (137) Destination port: 32934 (32934) Length: 291 Checksum: 0xe4c4 (incorrect, should be 0xf87e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 8a 00 00 7f 11 2d 97 ac 10 86 bf 04 40 .7......-......@ 0020 dd 2a 00 89 80 a6 01 23 e4 c4 01 00 84 00 00 00 .*.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 150 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 00:01:58.099615000 Time delta from previous packet: 287.146093000 seconds Time relative to first packet: 82428.574411000 seconds Frame Number: 150 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 66.92.135.108 (66.92.135.108), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x410a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x15a2 (incorrect, should be 0x0bfd) Source: 66.92.135.108 (66.92.135.108) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1043 (1043), Dst Port: netbios-ns (137) Source port: 1043 (1043) Destination port: netbios-ns (137) Length: 58 Checksum: 0xc8a1 (incorrect, should be 0xbefc) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 41 0a 00 00 71 11 15 a2 42 5c 87 6c ac 10 .NA...q...B\.l.. 0020 86 bf 04 13 00 89 00 3a c8 a1 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 151 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 00:01:58.102554000 Time delta from previous packet: 0.002939000 seconds Time relative to first packet: 82428.577350000 seconds Frame Number: 151 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 66.92.135.108 (66.92.135.108) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x029c Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x4527 (incorrect, should be 0x3b82) Source: 172.16.134.191 (172.16.134.191) Destination: 66.92.135.108 (66.92.135.108) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1043 (1043) Source port: netbios-ns (137) Destination port: 1043 (1043) Length: 291 Checksum: 0x78fa (incorrect, should be 0x8cb4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 9c 00 00 7f 11 45 27 ac 10 86 bf 42 5c .7......E'....B\ 0020 87 6c 00 89 04 13 01 23 78 fa 01 00 84 00 00 00 .l.....#x....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 153 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 02:35:07.419445000 Time delta from previous packet: 2073.825045000 seconds Time relative to first packet: 91617.894241000 seconds Frame Number: 153 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 81.202.125.5 (81.202.125.5), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x84c2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0xd2e2 (incorrect, should be 0xc93d) Source: 81.202.125.5 (81.202.125.5) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1062 (1062), Dst Port: netbios-ns (137) Source port: 1062 (1062) Destination port: netbios-ns (137) Length: 58 Checksum: 0xc387 (incorrect, should be 0xb9e2) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 84 c2 00 00 6b 11 d2 e2 51 ca 7d 05 ac 10 .N....k...Q.}... 0020 86 bf 04 26 00 89 00 3a c3 87 01 00 00 10 00 01 ...&...:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 154 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 02:35:07.421124000 Time delta from previous packet: 0.001679000 seconds Time relative to first packet: 91617.895920000 seconds Frame Number: 154 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 81.202.125.5 (81.202.125.5) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x030a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x3fb2 (incorrect, should be 0x360d) Source: 172.16.134.191 (172.16.134.191) Destination: 81.202.125.5 (81.202.125.5) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1062 (1062) Source port: netbios-ns (137) Destination port: 1062 (1062) Length: 291 Checksum: 0xf675 (incorrect, should be 0x0a30) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 0a 00 00 7f 11 3f b2 ac 10 86 bf 51 ca .7......?.....Q. 0020 7d 05 00 89 04 26 01 23 f6 75 01 00 84 00 00 00 }....&.#.u...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 ff 9f ff 00 00 00 00 d8 ff 9f ff d8 ff ................ 0140 9f ff 5c 00 53 ..\.S Frame 164 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 05:03:20.194674000 Time delta from previous packet: 2305.012469000 seconds Time relative to first packet: 100510.669470000 seconds Frame Number: 164 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 218.237.70.119 (218.237.70.119), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x62b7 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x9c58 (incorrect, should be 0x92b3) Source: 218.237.70.119 (218.237.70.119) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x7114 (incorrect, should be 0x676f) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 62 b7 00 00 71 11 9c 58 da ed 46 77 ac 10 .Nb...q..X..Fw.. 0020 86 bf 04 04 00 89 00 3a 71 14 01 00 00 10 00 01 .......:q....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 165 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 05:03:20.197363000 Time delta from previous packet: 0.002689000 seconds Time relative to first packet: 100510.672159000 seconds Frame Number: 165 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 218.237.70.119 (218.237.70.119) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x035a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xeccc (incorrect, should be 0xe327) Source: 172.16.134.191 (172.16.134.191) Destination: 218.237.70.119 (218.237.70.119) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0x1c89 (incorrect, should be 0x3043) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 5a 00 00 7f 11 ec cc ac 10 86 bf da ed .7.Z............ 0020 46 77 00 89 04 04 01 23 1c 89 01 00 84 00 00 00 Fw.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 173 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 05:23:53.871334000 Time delta from previous packet: 1232.935502000 seconds Time relative to first packet: 101744.346130000 seconds Frame Number: 173 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.107.105.72 (213.107.105.72), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0056 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0xe76a (incorrect, should be 0xddc5) Source: 213.107.105.72 (213.107.105.72) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x53c8 (incorrect, should be 0x4a23) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 00 56 00 00 6b 11 e7 6a d5 6b 69 48 ac 10 .N.V..k..j.kiH.. 0020 86 bf 04 01 00 89 00 3a 53 c8 01 00 00 10 00 01 .......:S....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 174 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 05:23:53.874028000 Time delta from previous packet: 0.002694000 seconds Time relative to first packet: 101744.348824000 seconds Frame Number: 174 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.107.105.72 (213.107.105.72) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x036c Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xcf6b (incorrect, should be 0xc5c6) Source: 172.16.134.191 (172.16.134.191) Destination: 213.107.105.72 (213.107.105.72) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0xff3c (incorrect, should be 0x12f7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 6c 00 00 7f 11 cf 6b ac 10 86 bf d5 6b .7.l.....k.....k 0020 69 48 00 89 04 01 01 23 ff 3c 01 00 84 00 00 00 iH.....#.<...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 182 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 05:55:21.519823000 Time delta from previous packet: 1887.134974000 seconds Time relative to first packet: 103631.994619000 seconds Frame Number: 182 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.44.104.92 (213.44.104.92), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x9267 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 108 Protocol: UDP (0x11) Header checksum: 0x5584 (incorrect, should be 0x4bdf) Source: 213.44.104.92 (213.44.104.92) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x54f1 (incorrect, should be 0x4b4c) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 92 67 00 00 6c 11 55 84 d5 2c 68 5c ac 10 .N.g..l.U..,h\.. 0020 86 bf 04 03 00 89 00 3a 54 f1 01 00 00 10 00 01 .......:T....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 183 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 05:55:21.522561000 Time delta from previous packet: 0.002738000 seconds Time relative to first packet: 103631.997357000 seconds Frame Number: 183 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.44.104.92 (213.44.104.92) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0383 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd07f (incorrect, should be 0xc6da) Source: 172.16.134.191 (172.16.134.191) Destination: 213.44.104.92 (213.44.104.92) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0x87df (incorrect, should be 0x9b99) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 83 00 00 7f 11 d0 7f ac 10 86 bf d5 2c .7............., 0020 68 5c 00 89 04 03 01 23 87 df 01 00 84 00 00 00 h\.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 ff 9f ff 00 00 00 00 d8 ff 9f ff d8 ff ................ 0140 9f ff 5c 00 53 ..\.S Frame 193 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 08:33:59.633329000 Time delta from previous packet: 6441.476253000 seconds Time relative to first packet: 113150.108125000 seconds Frame Number: 193 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 68.154.11.82 (68.154.11.82), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x206a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 110 Protocol: UDP (0x11) Header checksum: 0xb31e (incorrect, should be 0xa979) Source: 68.154.11.82 (68.154.11.82) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 57101 (57101), Dst Port: netbios-ns (137) Source port: 57101 (57101) Destination port: netbios-ns (137) Length: 58 Checksum: 0x6783 (incorrect, should be 0x5dde) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 20 6a 00 00 6e 11 b3 1e 44 9a 0b 52 ac 10 .N j..n...D..R.. 0020 86 bf df 0d 00 89 00 3a 67 83 01 00 00 10 00 01 .......:g....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 194 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 08:33:59.639330000 Time delta from previous packet: 0.006001000 seconds Time relative to first packet: 113150.114126000 seconds Frame Number: 194 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 68.154.11.82 (68.154.11.82) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x03e5 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xbdba (incorrect, should be 0xb415) Source: 172.16.134.191 (172.16.134.191) Destination: 68.154.11.82 (68.154.11.82) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 57101 (57101) Source port: netbios-ns (137) Destination port: 57101 (57101) Length: 291 Checksum: 0x4a50 (incorrect, should be 0x5e0a) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 e5 00 00 7f 11 bd ba ac 10 86 bf 44 9a .7............D. 0020 0b 52 00 89 df 0d 01 23 4a 50 01 00 84 00 00 00 .R.....#JP...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ 0140 00 00 60 1f 32 ..`.2 Frame 202 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 08:51:57.723308000 Time delta from previous packet: 1077.767513000 seconds Time relative to first packet: 114228.198104000 seconds Frame Number: 202 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 81.50.177.167 (81.50.177.167), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x2fdd Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 108 Protocol: UDP (0x11) Header checksum: 0xf2bd (incorrect, should be 0xe918) Source: 81.50.177.167 (81.50.177.167) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 59004 (59004), Dst Port: netbios-ns (137) Source port: 59004 (59004) Destination port: netbios-ns (137) Length: 58 Checksum: 0xad26 (incorrect, should be 0xa381) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 2f dd 00 00 6c 11 f2 bd 51 32 b1 a7 ac 10 .N/...l...Q2.... 0020 86 bf e6 7c 00 89 00 3a ad 26 01 00 00 10 00 01 ...|...:.&...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 203 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 08:51:57.729304000 Time delta from previous packet: 0.005996000 seconds Time relative to first packet: 114228.204100000 seconds Frame Number: 203 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 81.50.177.167 (81.50.177.167) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x03f4 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x0abe (incorrect, should be 0x0119) Source: 172.16.134.191 (172.16.134.191) Destination: 81.50.177.167 (81.50.177.167) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 59004 (59004) Source port: netbios-ns (137) Destination port: 59004 (59004) Length: 291 Checksum: 0xe014 (incorrect, should be 0xf3ce) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 03 f4 00 00 7f 11 0a be ac 10 86 bf 51 32 .7............Q2 0020 b1 a7 00 89 e6 7c 01 23 e0 14 01 00 84 00 00 00 .....|.#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 ff 9f ff 00 00 00 00 d8 ff 9f ff d8 ff ................ 0140 9f ff 5c 00 53 ..\.S Frame 213 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 10:43:54.812850000 Time delta from previous packet: 6704.190392000 seconds Time relative to first packet: 120945.287646000 seconds Frame Number: 213 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 208.186.61.2 (208.186.61.2), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xe193 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x3324 (incorrect, should be 0x297f) Source: 208.186.61.2 (208.186.61.2) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x84bd (incorrect, should be 0x7b18) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e e1 93 00 00 6f 11 33 24 d0 ba 3d 02 ac 10 .N....o.3$..=... 0020 86 bf 04 03 00 89 00 3a 84 bd 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 214 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 10:43:54.820548000 Time delta from previous packet: 0.007698000 seconds Time relative to first packet: 120945.295344000 seconds Frame Number: 214 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 208.186.61.2 (208.186.61.2) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0445 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xff89 (incorrect, should be 0xf5e4) Source: 172.16.134.191 (172.16.134.191) Destination: 208.186.61.2 (208.186.61.2) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xa19f (incorrect, should be 0xb559) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 04 45 00 00 7f 11 ff 89 ac 10 86 bf d0 ba .7.E............ 0020 3d 02 00 89 04 03 01 23 a1 9f 01 00 84 00 00 00 =......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 38 04 08 00 24 00 49 00 33 00 30 00 ....8...$.I.3.0. 0140 00 00 40 05 08 ..@.. Frame 222 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 12:09:49.026113000 Time delta from previous packet: 5153.823540000 seconds Time relative to first packet: 126099.500909000 seconds Frame Number: 222 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 62.194.4.114 (62.194.4.114), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x9a61 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0x48df (incorrect, should be 0x3f3a) Source: 62.194.4.114 (62.194.4.114) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x4f46 (incorrect, should be 0x45a1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 9a 61 00 00 6b 11 48 df 3e c2 04 72 ac 10 .N.a..k.H.>..r.. 0020 86 bf 04 03 00 89 00 3a 4f 46 01 00 00 10 00 01 .......:OF...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 223 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 12:09:49.032436000 Time delta from previous packet: 0.006323000 seconds Time relative to first packet: 126099.507232000 seconds Frame Number: 223 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 62.194.4.114 (62.194.4.114) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0484 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc9d3 (incorrect, should be 0xc02e) Source: 172.16.134.191 (172.16.134.191) Destination: 62.194.4.114 (62.194.4.114) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xcbd8 (incorrect, should be 0xdf92) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 04 84 00 00 7f 11 c9 d3 ac 10 86 bf 3e c2 .7............>. 0020 04 72 00 89 04 03 01 23 cb d8 01 00 84 00 00 00 .r.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 1f 32 fe 00 00 00 00 d8 1f 32 fe d8 1f ....2.......2... 0140 32 fe 5c 00 53 2.\.S Frame 249 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 20:44:41.335417000 Time delta from previous packet: 4064.327951000 seconds Time relative to first packet: 156991.810213000 seconds Frame Number: 249 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.11.11.54 (61.11.11.54), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xeb26 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0xef0c (incorrect, should be 0xe567) Source: 61.11.11.54 (61.11.11.54) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 10145 (10145), Dst Port: netbios-ns (137) Source port: 10145 (10145) Destination port: netbios-ns (137) Length: 58 Checksum: 0x269b (incorrect, should be 0x1cf6) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e eb 26 00 00 6f 11 ef 0c 3d 0b 0b 36 ac 10 .N.&..o...=..6.. 0020 86 bf 27 a1 00 89 00 3a 26 9b 01 00 00 10 00 01 ..'....:&....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 250 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 20:44:41.344600000 Time delta from previous packet: 0.009183000 seconds Time relative to first packet: 156991.819396000 seconds Frame Number: 250 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.11.11.54 (61.11.11.54) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x05bf Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc38b (incorrect, should be 0xb9e6) Source: 172.16.134.191 (172.16.134.191) Destination: 61.11.11.54 (61.11.11.54) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 10145 (10145) Source port: netbios-ns (137) Destination port: 10145 (10145) Length: 291 Checksum: 0x437d (incorrect, should be 0x5737) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 05 bf 00 00 7f 11 c3 8b ac 10 86 bf 3d 0b .7............=. 0020 0b 36 00 89 27 a1 01 23 43 7d 01 00 84 00 00 00 .6..'..#C}...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 38 04 08 00 24 00 49 00 33 00 30 00 ....8...$.I.3.0. 0140 00 00 40 05 08 ..@.. Frame 251 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 21:00:10.285353000 Time delta from previous packet: 928.940753000 seconds Time relative to first packet: 157920.760149000 seconds Frame Number: 251 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 68.115.33.110 (68.115.33.110), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x7733 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 116 Protocol: UDP (0x11) Header checksum: 0x4060 (incorrect, should be 0x36bb) Source: 68.115.33.110 (68.115.33.110) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x2c99 (incorrect, should be 0x22f4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 77 33 00 00 74 11 40 60 44 73 21 6e ac 10 .Nw3..t.@`Ds!n.. 0020 86 bf 04 03 00 89 00 3a 2c 99 01 00 00 10 00 01 .......:,....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 252 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 21:00:10.287510000 Time delta from previous packet: 0.002157000 seconds Time relative to first packet: 157920.762306000 seconds Frame Number: 252 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 68.115.33.110 (68.115.33.110) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x05cb Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xa5df (incorrect, should be 0x9c3a) Source: 172.16.134.191 (172.16.134.191) Destination: 68.115.33.110 (68.115.33.110) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0x497b (incorrect, should be 0x5d35) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 05 cb 00 00 7f 11 a5 df ac 10 86 bf 44 73 .7............Ds 0020 21 6e 00 89 04 03 01 23 49 7b 01 00 84 00 00 00 !n.....#I{...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 38 04 08 00 24 00 49 00 33 00 30 00 ....8...$.I.3.0. 0140 00 00 40 05 08 ..@.. Frame 262 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 21:51:56.654414000 Time delta from previous packet: 991.720543000 seconds Time relative to first packet: 161027.129210000 seconds Frame Number: 262 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 144.134.109.25 (144.134.109.25), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x2714 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 104 Protocol: UDP (0x11) Header checksum: 0x04c1 (incorrect, should be 0xfb1b) Source: 144.134.109.25 (144.134.109.25) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x94da (incorrect, should be 0x8b35) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 27 14 00 00 68 11 04 c1 90 86 6d 19 ac 10 .N'...h.....m... 0020 86 bf 04 03 00 89 00 3a 94 da 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 263 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 2, 2003 21:51:56.659518000 Time delta from previous packet: 0.005104000 seconds Time relative to first packet: 161027.134314000 seconds Frame Number: 263 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 144.134.109.25 (144.134.109.25) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x05ee Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x0dfe (incorrect, should be 0x0459) Source: 172.16.134.191 (172.16.134.191) Destination: 144.134.109.25 (144.134.109.25) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xb1bc (incorrect, should be 0xc576) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 05 ee 00 00 7f 11 0d fe ac 10 86 bf 90 86 .7.............. 0020 6d 19 00 89 04 03 01 23 b1 bc 01 00 84 00 00 00 m......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 38 04 08 00 24 00 49 00 33 00 30 00 ....8...$.I.3.0. 0140 00 00 40 05 08 ..@.. Frame 423 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 3, 2003 19:35:37.923696000 Time delta from previous packet: 2343.066671000 seconds Time relative to first packet: 239248.398492000 seconds Frame Number: 423 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 210.12.211.121 (210.12.211.121), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc74a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 110 Protocol: UDP (0x11) Header checksum: 0xb6a3 (incorrect, should be 0xacfe) Source: 210.12.211.121 (210.12.211.121) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0xecf5 (incorrect, should be 0xe350) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c7 4a 00 00 6e 11 b6 a3 d2 0c d3 79 ac 10 .N.J..n......y.. 0020 86 bf 04 01 00 89 00 3a ec f5 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 424 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 3, 2003 19:35:37.926602000 Time delta from previous packet: 0.002906000 seconds Time relative to first packet: 239248.401398000 seconds Frame Number: 424 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 210.12.211.121 (210.12.211.121) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x675b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x04aa (incorrect, should be 0xfb04) Source: 172.16.134.191 (172.16.134.191) Destination: 210.12.211.121 (210.12.211.121) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0xd5d6 (incorrect, should be 0xe990) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 67 5b 00 00 7f 11 04 aa ac 10 86 bf d2 0c .7g[............ 0020 d3 79 00 89 04 01 01 23 d5 d6 01 00 84 00 00 00 .y.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 40 05 08 00 24 00 49 00 33 00 30 00 ....@...$.I.3.0. 0140 00 00 6c 05 08 ..l.. Frame 432 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 3, 2003 19:47:47.445352000 Time delta from previous packet: 728.640692000 seconds Time relative to first packet: 239977.920148000 seconds Frame Number: 432 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 202.63.162.34 (202.63.162.34), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x216d Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0x93a5 (incorrect, should be 0x8a00) Source: 202.63.162.34 (202.63.162.34) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x2617 (incorrect, should be 0x1c72) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 21 6d 00 00 70 11 93 a5 ca 3f a2 22 ac 10 .N!m..p....?.".. 0020 86 bf 04 04 00 89 00 3a 26 17 01 00 00 10 00 01 .......:&....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 433 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 3, 2003 19:47:47.451483000 Time delta from previous packet: 0.006131000 seconds Time relative to first packet: 239977.926279000 seconds Frame Number: 433 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 202.63.162.34 (202.63.162.34) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x686e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x3cbb (incorrect, should be 0x3316) Source: 172.16.134.191 (172.16.134.191) Destination: 202.63.162.34 (202.63.162.34) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0x0ef8 (incorrect, should be 0x22b2) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 68 6e 00 00 7f 11 3c bb ac 10 86 bf ca 3f .7hn....<......? 0020 a2 22 00 89 04 04 01 23 0e f8 01 00 84 00 00 00 .".....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 40 05 08 00 24 00 49 00 33 00 30 00 ....@...$.I.3.0. 0140 00 00 6c 05 08 ..l.. Frame 444 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 3, 2003 21:57:00.471379000 Time delta from previous packet: 822.227900000 seconds Time relative to first packet: 247730.946175000 seconds Frame Number: 444 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 210.214.49.227 (210.214.49.227), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x26e8 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 110 Protocol: UDP (0x11) Header checksum: 0xf7d2 (incorrect, should be 0xee2d) Source: 210.214.49.227 (210.214.49.227) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: netbios-ns (137) Source port: 1029 (1029) Destination port: netbios-ns (137) Length: 58 Checksum: 0x8dbe (incorrect, should be 0x8419) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 26 e8 00 00 6e 11 f7 d2 d2 d6 31 e3 ac 10 .N&...n.....1... 0020 86 bf 04 05 00 89 00 3a 8d be 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 445 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 3, 2003 21:57:00.476440000 Time delta from previous packet: 0.005061000 seconds Time relative to first packet: 247730.951236000 seconds Frame Number: 445 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 210.214.49.227 (210.214.49.227) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x73c8 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x9909 (incorrect, should be 0x8f64) Source: 172.16.134.191 (172.16.134.191) Destination: 210.214.49.227 (210.214.49.227) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1029 (1029) Source port: netbios-ns (137) Destination port: 1029 (1029) Length: 291 Checksum: 0x02ab (incorrect, should be 0x1665) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 73 c8 00 00 7f 11 99 09 ac 10 86 bf d2 d6 .7s............. 0020 31 e3 00 89 04 05 01 23 02 ab 01 00 84 00 00 00 1......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 775 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 03:22:14.103483000 Time delta from previous packet: 4577.892655000 seconds Time relative to first packet: 267244.578279000 seconds Frame Number: 775 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 195.67.251.197 (195.67.251.197), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xb3d9 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0xaf91 (incorrect, should be 0xa5ec) Source: 195.67.251.197 (195.67.251.197) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0xd372 (incorrect, should be 0xc9cd) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e b3 d9 00 00 6f 11 af 91 c3 43 fb c5 ac 10 .N....o....C.... 0020 86 bf 04 01 00 89 00 3a d3 72 01 00 00 10 00 01 .......:.r...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 776 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 03:22:14.105239000 Time delta from previous packet: 0.001756000 seconds Time relative to first packet: 267244.580035000 seconds Frame Number: 776 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 195.67.251.197 (195.67.251.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x90b2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc1cf (incorrect, should be 0xb82a) Source: 172.16.134.191 (172.16.134.191) Destination: 195.67.251.197 (195.67.251.197) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x0459 (incorrect, should be 0x1813) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 90 b2 00 00 7f 11 c1 cf ac 10 86 bf c3 43 .7.............C 0020 fb c5 00 89 04 01 01 23 04 59 01 00 84 00 00 00 .......#.Y...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 784 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 03:25:19.584643000 Time delta from previous packet: 183.958720000 seconds Time relative to first packet: 267430.059439000 seconds Frame Number: 784 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 217.222.201.82 (217.222.201.82), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xbae7 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 102 Protocol: UDP (0x11) Header checksum: 0xcd5b (incorrect, should be 0xc3b6) Source: 217.222.201.82 (217.222.201.82) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 52051 (52051), Dst Port: netbios-ns (137) Source port: 52051 (52051) Destination port: netbios-ns (137) Length: 58 Checksum: 0x27f8 (incorrect, should be 0x1e53) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e ba e7 00 00 66 11 cd 5b d9 de c9 52 ac 10 .N....f..[...R.. 0020 86 bf cb 53 00 89 00 3a 27 f8 01 00 00 10 00 01 ...S...:'....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 785 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 03:25:19.590673000 Time delta from previous packet: 0.006030000 seconds Time relative to first packet: 267430.065469000 seconds Frame Number: 785 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 217.222.201.82 (217.222.201.82) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x90f8 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xdd61 (incorrect, should be 0xd3bc) Source: 172.16.134.191 (172.16.134.191) Destination: 217.222.201.82 (217.222.201.82) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 52051 (52051) Source port: netbios-ns (137) Destination port: 52051 (52051) Length: 291 Checksum: 0x58de (incorrect, should be 0x6c98) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 90 f8 00 00 7f 11 dd 61 ac 10 86 bf d9 de .7.......a...... 0020 c9 52 00 89 cb 53 01 23 58 de 01 00 84 00 00 00 .R...S.#X....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 799 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 06:03:52.676478000 Time delta from previous packet: 6546.609376000 seconds Time relative to first packet: 276943.151274000 seconds Frame Number: 799 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 168.226.98.61 (168.226.98.61), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x7bce Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 106 Protocol: UDP (0x11) Header checksum: 0xa086 (incorrect, should be 0x96e1) Source: 168.226.98.61 (168.226.98.61) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1031 (1031), Dst Port: netbios-ns (137) Source port: 1031 (1031) Destination port: netbios-ns (137) Length: 58 Checksum: 0x8756 (incorrect, should be 0x7db1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 7b ce 00 00 6a 11 a0 86 a8 e2 62 3d ac 10 .N{...j.....b=.. 0020 86 bf 04 07 00 89 00 3a 87 56 01 00 00 10 00 01 .......:.V...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 800 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 06:03:52.680282000 Time delta from previous packet: 0.003804000 seconds Time relative to first packet: 276943.155078000 seconds Frame Number: 800 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 168.226.98.61 (168.226.98.61) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x9ee0 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x678b (incorrect, should be 0x5de6) Source: 172.16.134.191 (172.16.134.191) Destination: 168.226.98.61 (168.226.98.61) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1031 (1031) Source port: netbios-ns (137) Destination port: 1031 (1031) Length: 291 Checksum: 0xfc42 (incorrect, should be 0x0ffd) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 9e e0 00 00 7f 11 67 8b ac 10 86 bf a8 e2 .7......g....... 0020 62 3d 00 89 04 07 01 23 fc 42 01 00 84 00 00 00 b=.....#.B...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 808 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 06:12:13.082337000 Time delta from previous packet: 499.318970000 seconds Time relative to first packet: 277443.557133000 seconds Frame Number: 808 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 217.227.98.82 (217.227.98.82), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xde89 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x04b5 (incorrect, should be 0xfb0f) Source: 217.227.98.82 (217.227.98.82) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x5646 (incorrect, should be 0x4ca1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e de 89 00 00 72 11 04 b5 d9 e3 62 52 ac 10 .N....r.....bR.. 0020 86 bf 04 01 00 89 00 3a 56 46 01 00 00 10 00 01 .......:VF...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 809 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 06:12:13.088348000 Time delta from previous packet: 0.006011000 seconds Time relative to first packet: 277443.563144000 seconds Frame Number: 809 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 217.227.98.82 (217.227.98.82) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x9f9d Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x35b8 (incorrect, should be 0x2c13) Source: 172.16.134.191 (172.16.134.191) Destination: 217.227.98.82 (217.227.98.82) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0xcb32 (incorrect, should be 0xdeec) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 9f 9d 00 00 7f 11 35 b8 ac 10 86 bf d9 e3 .7......5....... 0020 62 52 00 89 04 01 01 23 cb 32 01 00 84 00 00 00 bR.....#.2...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 817 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 06:19:45.090836000 Time delta from previous packet: 451.257040000 seconds Time relative to first packet: 277895.565632000 seconds Frame Number: 817 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 62.201.96.159 (62.201.96.159), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xb62e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0xcbdd (incorrect, should be 0xc238) Source: 62.201.96.159 (62.201.96.159) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 62909 (62909), Dst Port: netbios-ns (137) Source port: 62909 (62909) Destination port: netbios-ns (137) Length: 58 Checksum: 0x0157 (incorrect, should be 0xf7b1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e b6 2e 00 00 70 11 cb dd 3e c9 60 9f ac 10 .N....p...>.`... 0020 86 bf f5 bd 00 89 00 3a 01 57 01 00 00 10 00 01 .......:.W...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 818 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 06:19:45.094626000 Time delta from previous packet: 0.003790000 seconds Time relative to first packet: 277895.569422000 seconds Frame Number: 818 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 62.201.96.159 (62.201.96.159) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xa04a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd1d8 (incorrect, should be 0xc833) Source: 172.16.134.191 (172.16.134.191) Destination: 62.201.96.159 (62.201.96.159) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 62909 (62909) Source port: netbios-ns (137) Destination port: 62909 (62909) Length: 291 Checksum: 0x323d (incorrect, should be 0x45f7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 a0 4a 00 00 7f 11 d1 d8 ac 10 86 bf 3e c9 .7.J..........>. 0020 60 9f 00 89 f5 bd 01 23 32 3d 01 00 84 00 00 00 `......#2=...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 827 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 09:18:33.282861000 Time delta from previous packet: 9725.538501000 seconds Time relative to first packet: 288623.757657000 seconds Frame Number: 827 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 210.203.189.77 (210.203.189.77), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x1a1e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 118 Protocol: UDP (0x11) Header checksum: 0x713d (incorrect, should be 0x6798) Source: 210.203.189.77 (210.203.189.77) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1031 (1031), Dst Port: netbios-ns (137) Source port: 1031 (1031) Destination port: netbios-ns (137) Length: 58 Checksum: 0x025d (incorrect, should be 0xf8b7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 1a 1e 00 00 76 11 71 3d d2 cb bd 4d ac 10 .N....v.q=...M.. 0020 86 bf 04 07 00 89 00 3a 02 5d 01 00 00 10 00 01 .......:.]...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 828 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 09:18:33.288920000 Time delta from previous packet: 0.006059000 seconds Time relative to first packet: 288623.763716000 seconds Frame Number: 828 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 210.203.189.77 (210.203.189.77) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xafe9 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd188 (incorrect, should be 0xc7e3) Source: 172.16.134.191 (172.16.134.191) Destination: 210.203.189.77 (210.203.189.77) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1031 (1031) Source port: netbios-ns (137) Destination port: 1031 (1031) Length: 291 Checksum: 0x3343 (incorrect, should be 0x46fd) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 af e9 00 00 7f 11 d1 88 ac 10 86 bf d2 cb .7.............. 0020 bd 4d 00 89 04 07 01 23 33 43 01 00 84 00 00 00 .M.....#3C...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 836 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 10:37:47.931261000 Time delta from previous packet: 4751.888789000 seconds Time relative to first packet: 293378.406057000 seconds Frame Number: 836 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 24.107.117.237 (24.107.117.237), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xa241 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 116 Protocol: UDP (0x11) Header checksum: 0xecda (incorrect, should be 0xe335) Source: 24.107.117.237 (24.107.117.237) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1172 (1172), Dst Port: netbios-ns (137) Source port: 1172 (1172) Destination port: netbios-ns (137) Length: 58 Checksum: 0x0391 (incorrect, should be 0xf9eb) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e a2 41 00 00 74 11 ec da 18 6b 75 ed ac 10 .N.A..t....ku... 0020 86 bf 04 94 00 89 00 3a 03 91 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 837 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 10:37:47.951353000 Time delta from previous packet: 0.020092000 seconds Time relative to first packet: 293378.426149000 seconds Frame Number: 837 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 24.107.117.237 (24.107.117.237) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xb6d7 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xcc5b (incorrect, should be 0xc2b6) Source: 172.16.134.191 (172.16.134.191) Destination: 24.107.117.237 (24.107.117.237) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1172 (1172) Source port: netbios-ns (137) Destination port: 1172 (1172) Length: 291 Checksum: 0x3477 (incorrect, should be 0x4831) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 b6 d7 00 00 7f 11 cc 5b ac 10 86 bf 18 6b .7.......[.....k 0020 75 ed 00 89 04 94 01 23 34 77 01 00 84 00 00 00 u......#4w...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 839 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 11:23:02.815168000 Time delta from previous packet: 1338.890183000 seconds Time relative to first packet: 296093.289964000 seconds Frame Number: 839 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.116.166.126 (213.116.166.126), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xfcea Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 106 Protocol: UDP (0x11) Header checksum: 0xae96 (incorrect, should be 0xa4f1) Source: 213.116.166.126 (213.116.166.126) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x1689 (incorrect, should be 0x0ce4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e fc ea 00 00 6a 11 ae 96 d5 74 a6 7e ac 10 .N....j....t.~.. 0020 86 bf 04 01 00 89 00 3a 16 89 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 840 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 11:23:02.821284000 Time delta from previous packet: 0.006116000 seconds Time relative to first packet: 296093.296080000 seconds Frame Number: 840 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.116.166.126 (213.116.166.126) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xbacf Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xdac8 (incorrect, should be 0xd123) Source: 172.16.134.191 (172.16.134.191) Destination: 213.116.166.126 (213.116.166.126) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x476f (incorrect, should be 0x5b29) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 ba cf 00 00 7f 11 da c8 ac 10 86 bf d5 74 .7.............t 0020 a6 7e 00 89 04 01 01 23 47 6f 01 00 84 00 00 00 .~.....#Go...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 849 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 13:16:12.100632000 Time delta from previous packet: 2574.565895000 seconds Time relative to first packet: 302882.575428000 seconds Frame Number: 849 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.7.60.57 (213.7.60.57), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x8b1d Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 108 Protocol: UDP (0x11) Header checksum: 0x8916 (incorrect, should be 0x7f71) Source: 213.7.60.57 (213.7.60.57) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x813a (incorrect, should be 0x7795) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 8b 1d 00 00 6c 11 89 16 d5 07 3c 39 ac 10 .N....l.....<9.. 0020 86 bf 04 02 00 89 00 3a 81 3a 01 00 00 10 00 01 .......:.:...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 850 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 13:16:12.111873000 Time delta from previous packet: 0.011241000 seconds Time relative to first packet: 302882.586669000 seconds Frame Number: 850 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.7.60.57 (213.7.60.57) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xc4bb Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x3b8f (incorrect, should be 0x31ea) Source: 172.16.134.191 (172.16.134.191) Destination: 213.7.60.57 (213.7.60.57) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0xf626 (incorrect, should be 0x09e1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 c4 bb 00 00 7f 11 3b 8f ac 10 86 bf d5 07 .7......;....... 0020 3c 39 00 89 04 02 01 23 f6 26 01 00 84 00 00 00 <9.....#.&...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 858 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 13:19:03.697028000 Time delta from previous packet: 170.622692000 seconds Time relative to first packet: 303054.171824000 seconds Frame Number: 858 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 64.254.203.68 (64.254.203.68), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x3ab4 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0xda7d (incorrect, should be 0xd0d8) Source: 64.254.203.68 (64.254.203.68) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x8636 (incorrect, should be 0x7c91) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 3a b4 00 00 70 11 da 7d 40 fe cb 44 ac 10 .N:...p..}@..D.. 0020 86 bf 04 04 00 89 00 3a 86 36 01 00 00 10 00 01 .......:.6...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 859 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 13:19:03.703967000 Time delta from previous packet: 0.006939000 seconds Time relative to first packet: 303054.178763000 seconds Frame Number: 859 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 64.254.203.68 (64.254.203.68) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xc4fe Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x404a (incorrect, should be 0x36a5) Source: 172.16.134.191 (172.16.134.191) Destination: 64.254.203.68 (64.254.203.68) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0xb71c (incorrect, should be 0xcad6) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 c4 fe 00 00 7f 11 40 4a ac 10 86 bf 40 fe .7......@J....@. 0020 cb 44 00 89 04 04 01 23 b7 1c 01 00 84 00 00 00 .D.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 873 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 13:43:30.861602000 Time delta from previous packet: 3.002456000 seconds Time relative to first packet: 304521.336398000 seconds Frame Number: 873 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 216.170.214.226 (216.170.214.226), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xa0be Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0xd128 (incorrect, should be 0xc783) Source: 216.170.214.226 (216.170.214.226) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137) Source port: netbios-ns (137) Destination port: netbios-ns (137) Length: 58 Checksum: 0xd9c4 (incorrect, should be 0xd01f) NetBIOS Name Service Transaction ID: 0x0da2 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e a0 be 00 00 70 11 d1 28 d8 aa d6 e2 ac 10 .N....p..(...... 0020 86 bf 00 89 00 89 00 3a d9 c4 0d a2 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 874 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 13:43:30.866435000 Time delta from previous packet: 0.004833000 seconds Time relative to first packet: 304521.341231000 seconds Frame Number: 874 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 216.170.214.226 (216.170.214.226) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xc728 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x9ad5 (incorrect, should be 0x9130) Source: 172.16.134.191 (172.16.134.191) Destination: 216.170.214.226 (216.170.214.226) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137) Source port: netbios-ns (137) Destination port: netbios-ns (137) Length: 291 Checksum: 0x4eb1 (incorrect, should be 0x626b) NetBIOS Name Service Transaction ID: 0x0da2 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 c7 28 00 00 7f 11 9a d5 ac 10 86 bf d8 aa .7.(............ 0020 d6 e2 00 89 00 89 01 23 4e b1 0d a2 84 00 00 00 .......#N....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 890 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 16:06:57.197799000 Time delta from previous packet: 503.053417000 seconds Time relative to first packet: 313127.672595000 seconds Frame Number: 890 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 210.58.0.25 (210.58.0.25), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc7e9 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x8837 (incorrect, should be 0x7e92) Source: 210.58.0.25 (210.58.0.25) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 64268 (64268), Dst Port: netbios-ns (137) Source port: 64268 (64268) Destination port: netbios-ns (137) Length: 58 Checksum: 0xc91c (incorrect, should be 0xbf77) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c7 e9 00 00 6f 11 88 37 d2 3a 00 19 ac 10 .N....o..7.:.... 0020 86 bf fb 0c 00 89 00 3a c9 1c 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 891 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 16:06:57.199792000 Time delta from previous packet: 0.001993000 seconds Time relative to first packet: 313127.674588000 seconds Frame Number: 891 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 210.58.0.25 (210.58.0.25) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xd3a2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x6b95 (incorrect, should be 0x61f0) Source: 172.16.134.191 (172.16.134.191) Destination: 210.58.0.25 (210.58.0.25) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 64268 (64268) Source port: netbios-ns (137) Destination port: 64268 (64268) Length: 291 Checksum: 0x3e09 (incorrect, should be 0x51c3) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 d3 a2 00 00 7f 11 6b 95 ac 10 86 bf d2 3a .7......k......: 0020 00 19 00 89 fb 0c 01 23 3e 09 01 00 84 00 00 00 .......#>....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 899 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 16:58:09.562378000 Time delta from previous packet: 3071.731459000 seconds Time relative to first packet: 316200.037174000 seconds Frame Number: 899 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 148.235.82.146 (148.235.82.146), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xa6fe Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x93f8 (incorrect, should be 0x8a53) Source: 148.235.82.146 (148.235.82.146) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0xaafd (incorrect, should be 0xa158) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e a6 fe 00 00 6f 11 93 f8 94 eb 52 92 ac 10 .N....o.....R... 0020 86 bf 04 02 00 89 00 3a aa fd 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 900 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 16:58:09.566347000 Time delta from previous packet: 0.003969000 seconds Time relative to first packet: 316200.041143000 seconds Frame Number: 900 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 148.235.82.146 (148.235.82.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xd821 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x51ec (incorrect, should be 0x4847) Source: 172.16.134.191 (172.16.134.191) Destination: 148.235.82.146 (148.235.82.146) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x1fea (incorrect, should be 0x33a4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 d8 21 00 00 7f 11 51 ec ac 10 86 bf 94 eb .7.!....Q....... 0020 52 92 00 89 04 02 01 23 1f ea 01 00 84 00 00 00 R......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 2043 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 18:41:27.393542000 Time delta from previous packet: 40.112917000 seconds Time relative to first packet: 322397.868338000 seconds Frame Number: 2043 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 200.78.103.67 (200.78.103.67), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xac67 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x447b (incorrect, should be 0x3ad6) Source: 200.78.103.67 (200.78.103.67) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x62e8 (incorrect, should be 0x5943) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e ac 67 00 00 71 11 44 7b c8 4e 67 43 ac 10 .N.g..q.D{.NgC.. 0020 86 bf 04 03 00 89 00 3a 62 e8 01 00 00 10 00 01 .......:b....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 2044 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 18:41:27.398266000 Time delta from previous packet: 0.004724000 seconds Time relative to first packet: 322397.873062000 seconds Frame Number: 2044 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 200.78.103.67 (200.78.103.67) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xe341 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xfeb7 (incorrect, should be 0xf512) Source: 172.16.134.191 (172.16.134.191) Destination: 200.78.103.67 (200.78.103.67) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0x93ce (incorrect, should be 0xa788) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 e3 41 00 00 7f 11 fe b7 ac 10 86 bf c8 4e .7.A...........N 0020 67 43 00 89 04 03 01 23 93 ce 01 00 84 00 00 00 gC.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 53 42 4d 1 ...SBM 00c0 20 20 20 20 20 20 20 20 20 20 20 20 1d 04 00 01 .... 00d0 02 5f 5f 4d 53 42 52 4f 57 53 45 5f 5f 02 01 84 .__MSBROWSE__... 00e0 00 49 4e 65 74 7e 53 65 72 76 69 63 65 73 20 20 .INet~Services 00f0 1c 84 00 49 53 7e 50 43 30 31 39 31 00 00 00 00 ...IS~PC0191.... 0100 00 00 00 04 00 00 05 69 00 01 56 00 00 00 00 00 .......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 6c 05 08 00 24 00 49 00 33 00 30 00 ....l...$.I.3.0. 0140 00 00 00 00 00 ..... Frame 20903 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 22:27:36.860015000 Time delta from previous packet: 80.473179000 seconds Time relative to first packet: 335967.334811000 seconds Frame Number: 20903 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 211.149.57.197 (211.149.57.197), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x1b45 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0xf8d4 (incorrect, should be 0xef2f) Source: 211.149.57.197 (211.149.57.197) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x8520 (incorrect, should be 0x7b7b) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 1b 45 00 00 70 11 f8 d4 d3 95 39 c5 ac 10 .N.E..p.....9... 0020 86 bf 04 02 00 89 00 3a 85 20 01 00 00 10 00 01 .......:. ...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20904 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 22:27:36.874879000 Time delta from previous packet: 0.014864000 seconds Time relative to first packet: 335967.349675000 seconds Frame Number: 20904 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 211.149.57.197 (211.149.57.197) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x2af8 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd938 (incorrect, should be 0xcf93) Source: 172.16.134.191 (172.16.134.191) Destination: 211.149.57.197 (211.149.57.197) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x912e (incorrect, should be 0xa4e8) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 2a f8 00 00 7f 11 d9 38 ac 10 86 bf d3 95 .7*......8...... 0020 39 c5 00 89 04 02 01 23 91 2e 01 00 84 00 00 00 9......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ 0140 00 00 40 b2 49 ..@.I Frame 20906 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 22:34:47.007452000 Time delta from previous packet: 225.202182000 seconds Time relative to first packet: 336397.482248000 seconds Frame Number: 20906 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.217.55.243 (213.217.55.243), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc597 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0x5310 (incorrect, should be 0x496b) Source: 213.217.55.243 (213.217.55.243) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x84ae (incorrect, should be 0x7b09) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c5 97 00 00 6b 11 53 10 d5 d9 37 f3 ac 10 .N....k.S...7... 0020 86 bf 04 02 00 89 00 3a 84 ae 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20907 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 22:34:47.012843000 Time delta from previous packet: 0.005391000 seconds Time relative to first packet: 336397.487639000 seconds Frame Number: 20907 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.217.55.243 (213.217.55.243) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x55cf Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xadef (incorrect, should be 0xa44a) Source: 172.16.134.191 (172.16.134.191) Destination: 213.217.55.243 (213.217.55.243) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0xd0c9 (incorrect, should be 0xe483) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 55 cf 00 00 7f 11 ad ef ac 10 86 bf d5 d9 .7U............. 0020 37 f3 00 89 04 02 01 23 d0 c9 01 00 84 00 00 00 7......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 25 48 80 00 00 00 00 00 00 00 00 00 00 ...%H........... 0140 00 00 01 00 00 ..... Frame 20915 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 22:43:40.482567000 Time delta from previous packet: 530.792904000 seconds Time relative to first packet: 336930.957363000 seconds Frame Number: 20915 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 219.65.37.37 (219.65.37.37), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xa629 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x78e4 (incorrect, should be 0x6f3f) Source: 219.65.37.37 (219.65.37.37) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1035 (1035), Dst Port: netbios-ns (137) Source port: 1035 (1035) Destination port: netbios-ns (137) Length: 58 Checksum: 0x920b (incorrect, should be 0x8866) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e a6 29 00 00 72 11 78 e4 db 41 25 25 ac 10 .N.)..r.x..A%%.. 0020 86 bf 04 0b 00 89 00 3a 92 0b 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20916 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 22:43:40.503014000 Time delta from previous packet: 0.020447000 seconds Time relative to first packet: 336930.977810000 seconds Frame Number: 20916 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 219.65.37.37 (219.65.37.37) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x8b6b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x85b9 (incorrect, should be 0x7c14) Source: 172.16.134.191 (172.16.134.191) Destination: 219.65.37.37 (219.65.37.37) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1035 (1035) Source port: netbios-ns (137) Destination port: 1035 (1035) Length: 291 Checksum: 0xfbf7 (incorrect, should be 0x0fb2) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 8b 6b 00 00 7f 11 85 b9 ac 10 86 bf db 41 .7.k...........A 0020 25 25 00 89 04 0b 01 23 fb f7 01 00 84 00 00 00 %%.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 48 43 fe 00 00 00 00 58 48 43 fe 58 48 ...HC.....XHC.XH 0140 43 fe 5c 00 53 C.\.S Frame 20917 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 4, 2003 23:53:34.637544000 Time delta from previous packet: 4194.134530000 seconds Time relative to first packet: 341125.112340000 seconds Frame Number: 20917 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 66.73.160.240 (66.73.160.240), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x6668 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0xd6d2 (incorrect, should be 0xcd2d) Source: 66.73.160.240 (66.73.160.240) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0xaf42 (incorrect, should be 0xa59d) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 66 68 00 00 71 11 d6 d2 42 49 a0 f0 ac 10 .Nfh..q...BI.... 0020 86 bf 04 01 00 89 00 3a af 42 01 00 00 10 00 01 .......:.B...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20918 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 4, 2003 23:53:34.653095000 Time delta from previous packet: 0.015551000 seconds Time relative to first packet: 341125.127891000 seconds Frame Number: 20918 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 66.73.160.240 (66.73.160.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x2f1b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xff36 (incorrect, should be 0xf591) Source: 172.16.134.191 (172.16.134.191) Destination: 66.73.160.240 (66.73.160.240) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x192f (incorrect, should be 0x2ce9) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 2f 1b 00 00 7f 11 ff 36 ac 10 86 bf 42 49 .7/......6....BI 0020 a0 f0 00 89 04 01 01 23 19 2f 01 00 84 00 00 00 .......#./...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 48 43 fe 00 00 00 00 58 48 43 fe 58 48 ...HC.....XHC.XH 0140 43 fe 5c 00 53 C.\.S Frame 20926 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 00:08:48.657519000 Time delta from previous packet: 913.748650000 seconds Time relative to first packet: 342039.132315000 seconds Frame Number: 20926 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.177.154.228 (61.177.154.228), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x8bd2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0xc20c (incorrect, should be 0xb867) Source: 61.177.154.228 (61.177.154.228) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0xb9e3 (incorrect, should be 0xb03e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 8b d2 00 00 6b 11 c2 0c 3d b1 9a e4 ac 10 .N....k...=..... 0020 86 bf 04 04 00 89 00 3a b9 e3 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20927 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 00:08:48.658252000 Time delta from previous packet: 0.000733000 seconds Time relative to first packet: 342039.133048000 seconds Frame Number: 20927 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.177.154.228 (61.177.154.228) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x8a65 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xae90 (incorrect, should be 0xa4eb) Source: 172.16.134.191 (172.16.134.191) Destination: 61.177.154.228 (61.177.154.228) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0x2c5c (incorrect, should be 0x4016) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 8a 65 00 00 7f 11 ae 90 ac 10 86 bf 3d b1 .7.e..........=. 0020 9a e4 00 89 04 04 01 23 2c 5c 01 00 84 00 00 00 .......#,\...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ 0140 00 00 e0 47 43 ...GC Frame 20936 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 00:53:48.941830000 Time delta from previous packet: 2151.644514000 seconds Time relative to first packet: 344739.416626000 seconds Frame Number: 20936 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 217.1.35.169 (217.1.35.169), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x2ccd Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0xf6fc (incorrect, should be 0xed57) Source: 217.1.35.169 (217.1.35.169) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x95cf (incorrect, should be 0x8c2a) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 2c cd 00 00 71 11 f6 fc d9 01 23 a9 ac 10 .N,...q.....#... 0020 86 bf 04 03 00 89 00 3a 95 cf 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 20937 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 00:53:48.941832000 Time delta from previous packet: 0.000002000 seconds Time relative to first packet: 344739.416628000 seconds Frame Number: 20937 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 217.1.35.169 (217.1.35.169) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0xd433 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x40ad (incorrect, should be 0x3708) Source: 172.16.134.191 (172.16.134.191) Destination: 217.1.35.169 (217.1.35.169) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xffbb (incorrect, should be 0x1376) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 d4 33 00 00 7f 11 40 ad ac 10 86 bf d9 01 .7.3....@....... 0020 23 a9 00 89 04 03 01 23 ff bb 01 00 84 00 00 00 #......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 48 43 fe 00 00 00 00 58 48 43 fe 58 48 ...HC.....XHC.XH 0140 43 fe 5c 00 53 C.\.S Frame 21307 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 02:46:01.310569000 Time delta from previous packet: 0.951678000 seconds Time relative to first packet: 351471.785365000 seconds Frame Number: 21307 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 24.197.194.106 (24.197.194.106), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x39ca Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x0a7b (incorrect, should be 0x00d6) Source: 24.197.194.106 (24.197.194.106) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 12406 (12406), Dst Port: netbios-ns (137) Source port: 12406 (12406) Destination port: netbios-ns (137) Length: 58 Checksum: 0x7b57 (incorrect, should be 0x71b2) NetBIOS Name Service Transaction ID: 0x1080 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 39 ca 00 00 72 11 0a 7b 18 c5 c2 6a ac 10 .N9...r..{...j.. 0020 86 bf 30 76 00 89 00 3a 7b 57 10 80 00 10 00 01 ..0v...:{W...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 21308 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 02:46:01.310570000 Time delta from previous packet: 0.000001000 seconds Time relative to first packet: 351471.785366000 seconds Frame Number: 21308 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 24.197.194.106 (24.197.194.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x1a6c Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x1bf0 (incorrect, should be 0x124b) Source: 172.16.134.191 (172.16.134.191) Destination: 24.197.194.106 (24.197.194.106) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 12406 (12406) Source port: netbios-ns (137) Destination port: 12406 (12406) Length: 291 Checksum: 0xe543 (incorrect, should be 0xf8fd) NetBIOS Name Service Transaction ID: 0x1080 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 1a 6c 00 00 7f 11 1b f0 ac 10 86 bf 18 c5 .7.l............ 0020 c2 6a 00 89 30 76 01 23 e5 43 10 80 84 00 00 00 .j..0v.#.C...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 48 43 fe 00 00 00 00 58 48 43 fe 58 48 ...HC.....XHC.XH 0140 43 fe 5c 00 53 C.\.S Frame 21330 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 02:47:45.066367000 Time delta from previous packet: 4.200035000 seconds Time relative to first packet: 351575.541163000 seconds Frame Number: 21330 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 24.197.194.106 (24.197.194.106), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x4d70 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0xf6d4 (incorrect, should be 0xed2f) Source: 24.197.194.106 (24.197.194.106) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137) Source port: netbios-ns (137) Destination port: netbios-ns (137) Length: 58 Checksum: 0x95bc (incorrect, should be 0x8c17) NetBIOS Name Service Transaction ID: 0x2608 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 4d 70 00 00 72 11 f6 d4 18 c5 c2 6a ac 10 .NMp..r......j.. 0020 86 bf 00 89 00 89 00 3a 95 bc 26 08 00 10 00 01 .......:..&..... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 21331 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 02:47:45.066371000 Time delta from previous packet: 0.000004000 seconds Time relative to first packet: 351575.541167000 seconds Frame Number: 21331 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 24.197.194.106 (24.197.194.106) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x1ab6 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x1ba6 (incorrect, should be 0x1201) Source: 172.16.134.191 (172.16.134.191) Destination: 24.197.194.106 (24.197.194.106) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: netbios-ns (137) Source port: netbios-ns (137) Destination port: netbios-ns (137) Length: 291 Checksum: 0x7e04 (incorrect, should be 0x91be) NetBIOS Name Service Transaction ID: 0x2608 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 1a b6 00 00 7f 11 1b a6 ac 10 86 bf 18 c5 .7.............. 0020 c2 6a 00 89 00 89 01 23 7e 04 26 08 84 00 00 00 .j.....#~.&..... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 28 99 ff 00 00 00 00 98 28 99 ff 98 28 ...(.......(...( 0140 99 ff 5c 00 53 ..\.S Frame 30297 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 03:05:08.455354000 Time delta from previous packet: 3.451720000 seconds Time relative to first packet: 352618.930150000 seconds Frame Number: 30297 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 218.87.178.167 (218.87.178.167), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xdf6f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0xb305 (incorrect, should be 0xa960) Source: 218.87.178.167 (218.87.178.167) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x057d (incorrect, should be 0xfbd7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e df 6f 00 00 72 11 b3 05 da 57 b2 a7 ac 10 .N.o..r....W.... 0020 86 bf 04 01 00 89 00 3a 05 7d 01 00 00 10 00 01 .......:.}...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 30298 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 03:05:08.461191000 Time delta from previous packet: 0.005837000 seconds Time relative to first packet: 352618.935987000 seconds Frame Number: 30298 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 218.87.178.167 (218.87.178.167) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x2faa Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x54e2 (incorrect, should be 0x4b3d) Source: 172.16.134.191 (172.16.134.191) Destination: 218.87.178.167 (218.87.178.167) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x923d (incorrect, should be 0xa5f7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 2f aa 00 00 7f 11 54 e2 ac 10 86 bf da 57 .7/.....T......W 0020 b2 a7 00 89 04 01 01 23 92 3d 01 00 84 00 00 00 .......#.=...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 09 00 00 ..... Frame 32783 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 03:56:19.901745000 Time delta from previous packet: 52.357401000 seconds Time relative to first packet: 355690.376541000 seconds Frame Number: 32783 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.55.71.169 (61.55.71.169), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x6e57 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x2d3d (incorrect, should be 0x2398) Source: 61.55.71.169 (61.55.71.169) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x0d9b (incorrect, should be 0x03f6) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 6e 57 00 00 71 11 2d 3d 3d 37 47 a9 ac 10 .NnW..q.-==7G... 0020 86 bf 04 02 00 89 00 3a 0d 9b 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32784 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 03:56:19.902138000 Time delta from previous packet: 0.000393000 seconds Time relative to first packet: 355690.376934000 seconds Frame Number: 32784 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.55.71.169 (61.55.71.169) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x3b52 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x5159 (incorrect, should be 0x47b4) Source: 172.16.134.191 (172.16.134.191) Destination: 61.55.71.169 (61.55.71.169) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x9a5b (incorrect, should be 0xae15) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 3b 52 00 00 7f 11 51 59 ac 10 86 bf 3d 37 .7;R....QY....=7 0020 47 a9 00 89 04 02 01 23 9a 5b 01 00 84 00 00 00 G......#.[...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 09 00 00 ..... Frame 32793 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 04:49:33.242812000 Time delta from previous packet: 271.033033000 seconds Time relative to first packet: 358883.717608000 seconds Frame Number: 32793 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 62.251.129.118 (62.251.129.118), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x6742 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 108 Protocol: UDP (0x11) Header checksum: 0xfdc0 (incorrect, should be 0xf41b) Source: 62.251.129.118 (62.251.129.118) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0xd209 (incorrect, should be 0xc864) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 67 42 00 00 6c 11 fd c0 3e fb 81 76 ac 10 .NgB..l...>..v.. 0020 86 bf 04 02 00 89 00 3a d2 09 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32794 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 04:49:33.247487000 Time delta from previous packet: 0.004675000 seconds Time relative to first packet: 358883.722283000 seconds Frame Number: 32794 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 62.251.129.118 (62.251.129.118) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x3fff Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x111b (incorrect, should be 0x0776) Source: 172.16.134.191 (172.16.134.191) Destination: 62.251.129.118 (62.251.129.118) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x67ca (incorrect, should be 0x7b84) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 3f ff 00 00 7f 11 11 1b ac 10 86 bf 3e fb .7?...........>. 0020 81 76 00 89 04 02 01 23 67 ca 01 00 84 00 00 00 .v.....#g....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 32802 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 05:11:05.211640000 Time delta from previous packet: 1288.962224000 seconds Time relative to first packet: 360175.686436000 seconds Frame Number: 32802 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 164.125.76.48 (164.125.76.48), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xa54f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 106 Protocol: UDP (0x11) Header checksum: 0x9177 (incorrect, should be 0x87d2) Source: 164.125.76.48 (164.125.76.48) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0xa1cc (incorrect, should be 0x9827) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e a5 4f 00 00 6a 11 91 77 a4 7d 4c 30 ac 10 .N.O..j..w.}L0.. 0020 86 bf 04 03 00 89 00 3a a1 cc 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32803 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 05:11:05.216463000 Time delta from previous packet: 0.004823000 seconds Time relative to first packet: 360175.691259000 seconds Frame Number: 32803 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 164.125.76.48 (164.125.76.48) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x41d0 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xdf0d (incorrect, should be 0xd568) Source: 172.16.134.191 (172.16.134.191) Destination: 164.125.76.48 (164.125.76.48) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0x2e8d (incorrect, should be 0x4247) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 41 d0 00 00 7f 11 df 0d ac 10 86 bf a4 7d .7A............} 0020 4c 30 00 89 04 03 01 23 2e 8d 01 00 84 00 00 00 L0.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 09 00 00 ..... Frame 32812 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 05:18:15.625264000 Time delta from previous packet: 425.799435000 seconds Time relative to first packet: 360606.100060000 seconds Frame Number: 32812 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 219.94.46.57 (219.94.46.57), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xeaee Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x2dee (incorrect, should be 0x2449) Source: 219.94.46.57 (219.94.46.57) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x88e4 (incorrect, should be 0x7f3f) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e ea ee 00 00 6f 11 2d ee db 5e 2e 39 ac 10 .N....o.-..^.9.. 0020 86 bf 04 01 00 89 00 3a 88 e4 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32813 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 05:18:15.631208000 Time delta from previous packet: 0.005944000 seconds Time relative to first packet: 360606.106004000 seconds Frame Number: 32813 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 219.94.46.57 (219.94.46.57) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x4271 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc582 (incorrect, should be 0xbbdd) Source: 172.16.134.191 (172.16.134.191) Destination: 219.94.46.57 (219.94.46.57) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x1ca5 (incorrect, should be 0x305f) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 42 71 00 00 7f 11 c5 82 ac 10 86 bf db 5e .7Bq...........^ 0020 2e 39 00 89 04 01 01 23 1c a5 01 00 84 00 00 00 .9.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 02 00 00 ..... Frame 32821 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 05:22:17.023961000 Time delta from previous packet: 237.041294000 seconds Time relative to first packet: 360847.498757000 seconds Frame Number: 32821 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.140.149.137 (61.140.149.137), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x5ba4 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0xf1ba (incorrect, should be 0xe815) Source: 61.140.149.137 (61.140.149.137) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1031 (1031), Dst Port: netbios-ns (137) Source port: 1031 (1031) Destination port: netbios-ns (137) Length: 58 Checksum: 0xbf60 (incorrect, should be 0xb5bb) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 5b a4 00 00 71 11 f1 ba 3d 8c 95 89 ac 10 .N[...q...=..... 0020 86 bf 04 07 00 89 00 3a bf 60 01 00 00 10 00 01 .......:.`...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32822 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 05:22:17.034251000 Time delta from previous packet: 0.010290000 seconds Time relative to first packet: 360847.509047000 seconds Frame Number: 32822 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.140.149.137 (61.140.149.137) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x42d2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xfba3 (incorrect, should be 0xf1fe) Source: 172.16.134.191 (172.16.134.191) Destination: 61.140.149.137 (61.140.149.137) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1031 (1031) Source port: netbios-ns (137) Destination port: 1031 (1031) Length: 291 Checksum: 0x5521 (incorrect, should be 0x68db) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 42 d2 00 00 7f 11 fb a3 ac 10 86 bf 3d 8c .7B...........=. 0020 95 89 00 89 04 07 01 23 55 21 01 00 84 00 00 00 .......#U!...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ..... Frame 32830 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 06:11:08.397735000 Time delta from previous packet: 2928.881669000 seconds Time relative to first packet: 363778.872531000 seconds Frame Number: 32830 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 81.114.77.37 (81.114.77.37), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xf086 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 104 Protocol: UDP (0x11) Header checksum: 0x9a56 (incorrect, should be 0x90b1) Source: 81.114.77.37 (81.114.77.37) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 42908 (42908), Dst Port: netbios-ns (137) Source port: 42908 (42908) Destination port: netbios-ns (137) Length: 58 Checksum: 0x5049 (incorrect, should be 0x46a4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e f0 86 00 00 68 11 9a 56 51 72 4d 25 ac 10 .N....h..VQrM%.. 0020 86 bf a7 9c 00 89 00 3a 50 49 01 00 00 10 00 01 .......:PI...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32831 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 06:11:08.402766000 Time delta from previous packet: 0.005031000 seconds Time relative to first packet: 363778.877562000 seconds Frame Number: 32831 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 81.114.77.37 (81.114.77.37) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x471e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x2bd6 (incorrect, should be 0x2231) Source: 172.16.134.191 (172.16.134.191) Destination: 81.114.77.37 (81.114.77.37) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 42908 (42908) Source port: netbios-ns (137) Destination port: 42908 (42908) Length: 291 Checksum: 0x5413 (incorrect, should be 0x67cd) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 47 1e 00 00 7f 11 2b d6 ac 10 86 bf 51 72 .7G.....+.....Qr 0020 4d 25 00 89 a7 9c 01 23 54 13 01 00 84 00 00 00 M%.....#T....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 52 65 ff 00 00 00 00 d8 52 65 ff d8 52 ...Re......Re..R 0140 65 ff 5c 00 53 e.\.S Frame 32836 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 08:55:38.233738000 Time delta from previous packet: 5624.488710000 seconds Time relative to first packet: 373648.708534000 seconds Frame Number: 32836 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 200.66.98.107 (200.66.98.107), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x1fac Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0xd81a (incorrect, should be 0xce75) Source: 200.66.98.107 (200.66.98.107) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 32027 (32027), Dst Port: netbios-ns (137) Source port: 32027 (32027) Destination port: netbios-ns (137) Length: 58 Checksum: 0xeeb3 (incorrect, should be 0xe50e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 1f ac 00 00 6f 11 d8 1a c8 42 62 6b ac 10 .N....o....Bbk.. 0020 86 bf 7d 1b 00 89 00 3a ee b3 01 00 00 10 00 01 ..}....:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32837 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 08:55:38.254292000 Time delta from previous packet: 0.020554000 seconds Time relative to first packet: 373648.729088000 seconds Frame Number: 32837 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 200.66.98.107 (200.66.98.107) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x557d Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x9160 (incorrect, should be 0x87bb) Source: 172.16.134.191 (172.16.134.191) Destination: 200.66.98.107 (200.66.98.107) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 32027 (32027) Source port: netbios-ns (137) Destination port: 32027 (32027) Length: 291 Checksum: 0xc324 (incorrect, should be 0xd6de) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 55 7d 00 00 7f 11 91 60 ac 10 86 bf c8 42 .7U}.....`.....B 0020 62 6b 00 89 7d 1b 01 23 c3 24 01 00 84 00 00 00 bk..}..#.$...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff ff ................ 0140 00 00 60 4f 61 ..`Oa Frame 32849 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 11:10:46.100051000 Time delta from previous packet: 1766.489408000 seconds Time relative to first packet: 381756.574847000 seconds Frame Number: 32849 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.14.66.92 (61.14.66.92), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x1734 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 115 Protocol: UDP (0x11) Header checksum: 0x87d6 (incorrect, should be 0x7e31) Source: 61.14.66.92 (61.14.66.92) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: netbios-ns (137) Source port: 1029 (1029) Destination port: netbios-ns (137) Length: 58 Checksum: 0x130e (incorrect, should be 0x0969) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 17 34 00 00 73 11 87 d6 3d 0e 42 5c ac 10 .N.4..s...=.B\.. 0020 86 bf 04 05 00 89 00 3a 13 0e 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32850 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 11:10:46.110483000 Time delta from previous packet: 0.010432000 seconds Time relative to first packet: 381756.585279000 seconds Frame Number: 32850 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.14.66.92 (61.14.66.92) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x6162 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x30bf (incorrect, should be 0x271a) Source: 172.16.134.191 (172.16.134.191) Destination: 61.14.66.92 (61.14.66.92) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1029 (1029) Source port: netbios-ns (137) Destination port: 1029 (1029) Length: 291 Checksum: 0x5a9b (incorrect, should be 0x6e55) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 61 62 00 00 7f 11 30 bf ac 10 86 bf 3d 0e .7ab....0.....=. 0020 42 5c 00 89 04 05 01 23 5a 9b 01 00 84 00 00 00 B\.....#Z....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ff 0f ................ 0140 00 00 e0 22 6f ..."o Frame 32859 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 12:17:55.546009000 Time delta from previous packet: 3845.891815000 seconds Time relative to first packet: 385786.020805000 seconds Frame Number: 32859 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 200.60.202.74 (200.60.202.74), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0d2b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 112 Protocol: UDP (0x11) Header checksum: 0x81c2 (incorrect, should be 0x781d) Source: 200.60.202.74 (200.60.202.74) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1030 (1030), Dst Port: netbios-ns (137) Source port: 1030 (1030) Destination port: netbios-ns (137) Length: 58 Checksum: 0xffef (incorrect, should be 0xf64a) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 0d 2b 00 00 70 11 81 c2 c8 3c ca 4a ac 10 .N.+..p....<.J.. 0020 86 bf 04 06 00 89 00 3a ff ef 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32860 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 12:17:55.552430000 Time delta from previous packet: 0.006421000 seconds Time relative to first packet: 385786.027226000 seconds Frame Number: 32860 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 200.60.202.74 (200.60.202.74) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x672e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x17d6 (incorrect, should be 0x0e31) Source: 172.16.134.191 (172.16.134.191) Destination: 200.60.202.74 (200.60.202.74) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1030 (1030) Source port: netbios-ns (137) Destination port: 1030 (1030) Length: 291 Checksum: 0x682e (incorrect, should be 0x7be8) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 67 2e 00 00 7f 11 17 d6 ac 10 86 bf c8 3c .7g............< 0020 ca 4a 00 89 04 06 01 23 68 2e 01 00 84 00 00 00 .J.....#h....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 81 6e ff 00 00 00 00 18 81 6e ff 18 81 ....n.......n... 0140 6e ff 5c 00 53 n.\.S Frame 32869 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 12:56:00.713788000 Time delta from previous packet: 32.643435000 seconds Time relative to first packet: 388071.188584000 seconds Frame Number: 32869 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 217.227.245.101 (217.227.245.101), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x338a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x1da1 (incorrect, should be 0x13fc) Source: 217.227.245.101 (217.227.245.101) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0xc32f (incorrect, should be 0xb98a) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 33 8a 00 00 71 11 1d a1 d9 e3 f5 65 ac 10 .N3...q......e.. 0020 86 bf 04 04 00 89 00 3a c3 2f 01 00 00 10 00 01 .......:./...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32870 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 12:56:00.723430000 Time delta from previous packet: 0.009642000 seconds Time relative to first packet: 388071.198226000 seconds Frame Number: 32870 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 217.227.245.101 (217.227.245.101) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x6a7f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd7c2 (incorrect, should be 0xce1d) Source: 172.16.134.191 (172.16.134.191) Destination: 217.227.245.101 (217.227.245.101) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0x122c (incorrect, should be 0x25e6) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 6a 7f 00 00 7f 11 d7 c2 ac 10 86 bf d9 e3 .7j............. 0020 f5 65 00 89 04 04 01 23 12 2c 01 00 84 00 00 00 .e.....#.,...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 97 61 ff 00 00 00 00 38 97 61 ff 38 97 ....a.....8.a.8. 0140 61 ff 5c 00 53 a.\.S Frame 32880 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 15:14:00.018362000 Time delta from previous packet: 6414.000553000 seconds Time relative to first packet: 396350.493158000 seconds Frame Number: 32880 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 216.228.8.158 (216.228.8.158), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc0e5 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x7d0c (incorrect, should be 0x7367) Source: 216.228.8.158 (216.228.8.158) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: netbios-ns (137) Source port: 1029 (1029) Destination port: netbios-ns (137) Length: 58 Checksum: 0x03f3 (incorrect, should be 0xfa4d) NetBIOS Name Service Transaction ID: 0xae02 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c0 e5 00 00 72 11 7d 0c d8 e4 08 9e ac 10 .N....r.}....... 0020 86 bf 04 05 00 89 00 3a 03 f3 ae 02 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32881 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 15:14:00.028969000 Time delta from previous packet: 0.010607000 seconds Time relative to first packet: 396350.503765000 seconds Frame Number: 32881 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 216.228.8.158 (216.228.8.158) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x76a1 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xb967 (incorrect, should be 0xafc2) Source: 172.16.134.191 (172.16.134.191) Destination: 216.228.8.158 (216.228.8.158) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1029 (1029) Source port: netbios-ns (137) Destination port: 1029 (1029) Length: 291 Checksum: 0x52ef (incorrect, should be 0x66a9) NetBIOS Name Service Transaction ID: 0xae02 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 76 a1 00 00 7f 11 b9 67 ac 10 86 bf d8 e4 .7v......g...... 0020 08 9e 00 89 04 05 01 23 52 ef ae 02 84 00 00 00 .......#R....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 97 61 ff 00 00 00 00 38 97 61 ff 38 97 ....a.....8.a.8. 0140 61 ff 5c 00 53 a.\.S Frame 32893 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 16:11:01.507378000 Time delta from previous packet: 1448.977179000 seconds Time relative to first packet: 399771.982174000 seconds Frame Number: 32893 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 203.115.96.146 (203.115.96.146), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x5d35 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 110 Protocol: UDP (0x11) Header checksum: 0x9a39 (incorrect, should be 0x9094) Source: 203.115.96.146 (203.115.96.146) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1057 (1057), Dst Port: netbios-ns (137) Source port: 1057 (1057) Destination port: netbios-ns (137) Length: 58 Checksum: 0x6656 (incorrect, should be 0x5cb1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 5d 35 00 00 6e 11 9a 39 cb 73 60 92 ac 10 .N]5..n..9.s`... 0020 86 bf 04 21 00 89 00 3a 66 56 01 00 00 10 00 01 ...!...:fV...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 32894 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 16:11:01.512882000 Time delta from previous packet: 0.005504000 seconds Time relative to first packet: 399771.987678000 seconds Frame Number: 32894 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 203.115.96.146 (203.115.96.146) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x7ba1 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x69e4 (incorrect, should be 0x603f) Source: 172.16.134.191 (172.16.134.191) Destination: 203.115.96.146 (203.115.96.146) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1057 (1057) Source port: netbios-ns (137) Destination port: 1057 (1057) Length: 291 Checksum: 0xe014 (incorrect, should be 0xf3ce) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 7b a1 00 00 7f 11 69 e4 ac 10 86 bf cb 73 .7{.....i......s 0020 60 92 00 89 04 21 01 23 e0 14 01 00 84 00 00 00 `....!.#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 34 00 64 00 30 00 2d 00 30 00 30 00 ....4.d.0.-.0.0. 0140 63 00 30 00 34 c.0.4 Frame 33206 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 17:22:08.784453000 Time delta from previous packet: 1220.782035000 seconds Time relative to first packet: 404039.259249000 seconds Frame Number: 33206 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 212.110.30.110 (212.110.30.110), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x60 (DSCP 0x18: Class Selector 3; ECN: 0x00) 0110 00.. = Differentiated Services Codepoint: Class Selector 3 (0x18) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x1b2b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 108 Protocol: UDP (0x11) Header checksum: 0x170d (incorrect, should be 0x0d68) Source: 212.110.30.110 (212.110.30.110) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x9f9f (incorrect, should be 0x95fa) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 60 ..i...........E` 0010 00 4e 1b 2b 00 00 6c 11 17 0d d4 6e 1e 6e ac 10 .N.+..l....n.n.. 0020 86 bf 04 01 00 89 00 3a 9f 9f 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 33207 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 17:22:08.789615000 Time delta from previous packet: 0.005162000 seconds Time relative to first packet: 404039.264411000 seconds Frame Number: 33207 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 212.110.30.110 (212.110.30.110) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x826f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x9c3f (incorrect, should be 0x929a) Source: 172.16.134.191 (172.16.134.191) Destination: 212.110.30.110 (212.110.30.110) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 291 Checksum: 0x230e (incorrect, should be 0x36c8) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 82 6f 00 00 7f 11 9c 3f ac 10 86 bf d4 6e .7.o.....?.....n 0020 1e 6e 00 89 04 01 01 23 23 0e 01 00 84 00 00 00 .n.....##....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 71 65 ff 00 00 00 00 18 71 65 ff 18 71 ...qe......qe..q 0140 65 ff 5c 00 53 e.\.S Frame 33215 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 17:28:39.811482000 Time delta from previous packet: 390.261179000 seconds Time relative to first packet: 404430.286278000 seconds Frame Number: 33215 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 203.106.55.12 (203.106.55.12), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x764f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 109 Protocol: UDP (0x11) Header checksum: 0xabae (incorrect, should be 0xa209) Source: 203.106.55.12 (203.106.55.12) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 28938 (28938), Dst Port: netbios-ns (137) Source port: 28938 (28938) Destination port: netbios-ns (137) Length: 58 Checksum: 0x22fc (incorrect, should be 0x1957) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 76 4f 00 00 6d 11 ab ae cb 6a 37 0c ac 10 .NvO..m....j7... 0020 86 bf 71 0a 00 89 00 3a 22 fc 01 00 00 10 00 01 ..q....:"....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 33216 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 17:28:39.818852000 Time delta from previous packet: 0.007370000 seconds Time relative to first packet: 404430.293648000 seconds Frame Number: 33216 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 203.106.55.12 (203.106.55.12) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x8304 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x8c10 (incorrect, should be 0x826b) Source: 172.16.134.191 (172.16.134.191) Destination: 203.106.55.12 (203.106.55.12) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 28938 (28938) Source port: netbios-ns (137) Destination port: 28938 (28938) Length: 291 Checksum: 0x871a (incorrect, should be 0x9ad4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 83 04 00 00 7f 11 8c 10 ac 10 86 bf cb 6a .7.............j 0020 37 0c 00 89 71 0a 01 23 87 1a 01 00 84 00 00 00 7...q..#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 e1 6f ff 00 00 00 00 18 e1 6f ff 18 e1 ....o.......o... 0140 6f ff 5c 00 53 o.\.S Frame 35785 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 5, 2003 20:17:03.707354000 Time delta from previous packet: 115.051562000 seconds Time relative to first packet: 414534.182150000 seconds Frame Number: 35785 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 24.161.196.103 (24.161.196.103), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x8bc3 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 117 Protocol: UDP (0x11) Header checksum: 0xb3a8 (incorrect, should be 0xaa03) Source: 24.161.196.103 (24.161.196.103) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 65352 (65352), Dst Port: netbios-ns (137) Source port: 65352 (65352) Destination port: netbios-ns (137) Length: 58 Checksum: 0xba2b (incorrect, should be 0xb086) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 8b c3 00 00 75 11 b3 a8 18 a1 c4 67 ac 10 .N....u......g.. 0020 86 bf ff 48 00 89 00 3a ba 2b 01 00 00 10 00 01 ...H...:.+...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 35786 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 5, 2003 20:17:03.713466000 Time delta from previous packet: 0.006112000 seconds Time relative to first packet: 414534.188262000 seconds Frame Number: 35786 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 24.161.196.103 (24.161.196.103) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x9689 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x9df9 (incorrect, should be 0x9454) Source: 172.16.134.191 (172.16.134.191) Destination: 24.161.196.103 (24.161.196.103) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 65352 (65352) Source port: netbios-ns (137) Destination port: 65352 (65352) Length: 291 Checksum: 0xa843 (incorrect, should be 0xbbfd) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IWAM_PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 96 89 00 00 7f 11 9d f9 ac 10 86 bf 18 a1 .7.............. 0020 c4 67 00 89 ff 48 01 23 a8 43 01 00 84 00 00 00 .g...H.#.C...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 53 42 4d 20 20 20 20 20 20 20 20 ...SBM 0080 20 20 20 20 00 84 00 50 43 30 31 39 31 20 20 20 ...PC0191 0090 20 20 20 20 20 20 03 04 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 20 04 00 41 44 4d 1 ..ADM 00c0 49 4e 49 53 54 52 41 54 4f 52 20 20 03 04 00 49 INISTRATOR ...I 00d0 57 41 4d 5f 50 43 30 31 39 31 20 20 20 20 03 04 WAM_PC0191 .. 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 02 00 00 00 00 00 00 00 00 00 00 d0 c4 ................ 0140 d4 e1 02 00 00 .....