Attachment 3786 Details for Bug 5952 – Network packets snoop at SMB port, log.smb and log.winbind

Network packets snoop at SMB port, log.smb and log.winbind

CTDB-SMB_Mount_Error.txt (text/plain), 14.13 KB, created by Tim Clusters on 2008-12-07 14:36:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Tim Clusters

Created: 2008-12-07 14:36:18 UTC

Size: 14.13 KB

patch

obsolete

>
>Windows Client tries to connect to node-02 (192.168.97.5)
>----------------------------------------------------------
>
>AD User Info
>------------
>[root@node-02 ~]# wbinfo -u list
>TESTDOMAIN+administrator
>TESTDOMAIN+guest
>TESTDOMAIN+krbtgt
>TESTDOMAIN+testuser
>TESTDOMAIN+peyton
>TESTDOMAIN+eli
>
>[root@node-02 ~]# getent passwd TESTDOMAIN+eli
>TESTDOMAIN+eli:*:10778327:10777729:eli manning:/home/TESTDOMAIN+eli:/bin/bash
>
>When Windows tries to Network mount, we get following error:
>-----
>The mapped networked drive could not be created because the following error has occured
>
>"The specified network name is no longer available"
>-----
>
>Network analysis on SMB port, during network mount:
>---------------------------------------------------
>
>63.197774 192.168.97.2 -> 192.168.97.5 TCP ies-lm > microsoft-ds [SYN] Seq=0 Win=16384 Len=0 MSS=8960 WS=0
> 63.197797 192.168.97.5 -> 192.168.97.2 TCP microsoft-ds > ies-lm [SYN, ACK] Seq=0 Ack=1 Win=17920 Len=0 MSS=8960 WS=9
> 63.197840 192.168.97.2 -> 192.168.97.5 TCP ies-lm > microsoft-ds [ACK] Seq=1 Ack=1 Win=16384 Len=0
> 63.197978 192.168.97.2 -> 192.168.97.5 SMB Negotiate Protocol Request
> 63.197987 192.168.97.5 -> 192.168.97.2 TCP microsoft-ds > ies-lm [ACK] Seq=1 Ack=138 Win=17920 Len=0
> 63.201121 192.168.97.5 -> 192.168.97.2 SMB Negotiate Protocol Response
> 63.201497 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
> 63.202430 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
> 63.202600 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: \
> 63.205758 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
> 63.205915 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\IPC$
> 63.207225 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
> 63.207355 192.168.97.2 -> 192.168.97.5 SMB Trans2 Request, GET_DFS_REFERRAL, File: \192.168.97.5\global-share
> 63.207509 192.168.97.5 -> 192.168.97.2 SMB Trans2 Response, GET_DFS_REFERRAL, Error: STATUS_NOT_FOUND
> 63.208742 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
> 63.209184 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
> 63.209407 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: TESTDOMAIN\eli
> 63.217306 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
> 63.217479 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\global-share
> 63.218535 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
> 63.218604 192.168.97.2 -> 192.168.97.5 TCP ies-lm > microsoft-ds [FIN, ACK] Seq=1744 Ack=1298 Win=15087 Len=0
> 63.219935 192.168.97.5 -> 192.168.97.2 TCP microsoft-ds > ies-lm [FIN, ACK] Seq=1298 Ack=1745 Win=17920 Len=0
> 63.219986 192.168.97.2 -> 192.168.97.5 TCP ies-lm > microsoft-ds [ACK] Seq=1745 Ack=1299 Win=15087 Len=0
>
>log.winbind
>------------
>
>2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_domain_info(657)
>  [22020]: domain_info [TESTDOMAIN]
>[2008/12/05 14:53:55,  3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754)
>  [22020]: pam auth crap domain: [TESTDOMAIN] user: eli
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [22020]: request interface version
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [22020]: request location of privileged pipe
>[2008/12/05 14:53:55,  3] winbindd/winbindd_user.c:winbindd_getpwnam(375)
>  [22020]: getpwnam testdomain+eli
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22020]: ping
>[2008/12/05 14:53:55,  3] winbindd/winbindd_user.c:winbindd_getpwnam(375)
>  [22020]: getpwnam TESTDOMAIN+eli
>[2008/12/05 14:53:57,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [22065]: request interface version
>[2008/12/05 14:53:57,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [22065]: request location of privileged pipe
>[2008/12/05 14:53:57,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22065]: ping
>[2008/12/05 14:54:13,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [22230]: request interface version
>[2008/12/05 14:54:13,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [22230]: request location of privileged pipe
>[2008/12/05 14:54:13,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22230]: ping
>[2008/12/05 14:54:28,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [22410]: request interface version
>[2008/12/05 14:54:28,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [22410]: request location of privileged pipe
>[2008/12/05 14:54:28,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [22410]: ping
>
>log.smbd
>---------
>[2008/12/05 14:52:52,  3] smbd/server.c:remove_child_pid(299)
>  smbd/server.c:299 Unclean shutdown of pid 21453
>[2008/12/05 14:53:55,  3] smbd/server.c:remove_child_pid(299)
>  smbd/server.c:299 Unclean shutdown of pid 22020
>[2008/12/05 14:57:54,  3] smbd/server.c:remove_child_pid(299)
>  smbd/server.c:299 Unclean shutdown of pid 24302
>[2008/12/05 14:58:22,  3] smbd/server.c:remove_child_pid(299)
>  smbd/server.c:299 Unclean shutdown of pid 24537
>
>
>RESTART Winbind on node-02
>---------------------------
>
>****** NOW THE WINDOWS client can mount from node-02 *******
>****** BUT mount from node-01 fails with the same error message above ***
>
>
>[root@node-02 ~]# /etc/init.d/winbind restart
>
>Shutting down Winbind services:                            [  OK  ]
>Starting Winbind services:                                 [  OK  ]
>
>[root@node-02 ~]# wbinfo -u list
>TESTDOMAIN+administrator
>TESTDOMAIN+guest
>TESTDOMAIN+krbtgt
>TESTDOMAIN+testuser
>TESTDOMAIN+peyton
>TESTDOMAIN+eli
>
>[root@node-02 ~]# getent passwd TESTDOMAIN+eli
>TESTDOMAIN+eli:*:10778327:10777729:eli manning:/home/TESTDOMAIN+eli:/bin/bash
>
>Network analysis on SMB port, during network mount:
>---------------------------------------------------
>
> 0.000000 192.168.97.2 -> 192.168.97.5 TCP csdm > microsoft-ds [SYN] Seq=0 Win=16384 Len=0 MSS=8960 WS=0
>  0.000006 192.168.97.5 -> 192.168.97.2 TCP microsoft-ds > csdm [SYN, ACK] Seq=0 Ack=1 Win=17920 Len=0 MSS=8960 WS=9
>  0.000042 192.168.97.2 -> 192.168.97.5 TCP csdm > microsoft-ds [ACK] Seq=1 Ack=1 Win=16384 Len=0
>  0.000235 192.168.97.2 -> 192.168.97.5 SMB Negotiate Protocol Request
>  0.000245 192.168.97.5 -> 192.168.97.2 TCP microsoft-ds > csdm [ACK] Seq=1 Ack=138 Win=17920 Len=0
>  0.003448 192.168.97.5 -> 192.168.97.2 SMB Negotiate Protocol Response
>  0.003862 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
>  0.004870 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
>  0.005089 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: \
>  0.017038 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
>  0.017234 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\IPC$
>  0.018557 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
>  0.018701 192.168.97.2 -> 192.168.97.5 SMB Trans2 Request, GET_DFS_REFERRAL, File: \192.168.97.5\global-share
>  0.018875 192.168.97.5 -> 192.168.97.2 SMB Trans2 Response, GET_DFS_REFERRAL, Error: STATUS_NOT_FOUND
>  0.020272 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_NEGOTIATE
>  0.020702 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response, NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
>  0.020901 192.168.97.2 -> 192.168.97.5 SMB Session Setup AndX Request, NTLMSSP_AUTH, User: TESTDOMAIN\eli
>  0.028576 192.168.97.5 -> 192.168.97.2 SMB Session Setup AndX Response
>  0.028732 192.168.97.2 -> 192.168.97.5 SMB Tree Connect AndX Request, Path: \\192.168.97.5\global-share
>  0.029700 192.168.97.5 -> 192.168.97.2 SMB Tree Connect AndX Response
>  0.046374 192.168.97.2 -> 192.168.97.5 SMB Trans2 Request, QUERY_PATH_INFO, Query File Basic Info, Path: \AutoRun.inf
>  0.046707 192.168.97.5 -> 192.168.97.2 SMB Trans2 Response, QUERY_PATH_INFO, Error: STATUS_OBJECT_NAME_NOT_FOUND
>  0.214872 192.168.97.2 -> 192.168.97.5 TCP csdm > microsoft-ds [ACK] Seq=1848 Ack=1337 Win=15048 Len=0
>
>log.winbind
>------------
>
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [27893]: request interface version
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [27893]: request location of privileged pipe
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_domain_info(657)
>  [27893]: domain_info [TESTDOMAIN]
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-5-32-544
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-5-32-544
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-5-32-545
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-5-32-545
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-1-0
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-1-0
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-5-2
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-5-2
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-5-32-546
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-5-32-546
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_domain_info(657)
>  [27893]: domain_info [TESTDOMAIN]
>[2008/12/05 15:04:17,  3] winbindd/winbindd_pam.c:winbindd_pam_auth_crap(1754)
>  [27893]: pam auth crap domain: [TESTDOMAIN] user: eli
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [27893]: request interface version
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [27893]: request location of privileged pipe
>[2008/12/05 15:04:17,  3] winbindd/winbindd_user.c:winbindd_getpwnam(375)
>  [27893]: getpwnam testdomain+eli
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_sid.c:winbindd_sid_to_gid(341)
>  [27893]: sid to gid S-1-5-11
>[2008/12/05 15:04:17,  5] winbindd/winbindd_idmap.c:winbindd_sid2gid_recv(266)
>  sid2gid returned an error
>[2008/12/05 15:04:17,  5] winbindd/winbindd_sid.c:sid2gid_recv(277)
>  Could not convert sid S-1-5-11
>[2008/12/05 15:04:17,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27893]: ping
>[2008/12/05 15:04:17,  3] winbindd/winbindd_user.c:winbindd_getpwnam(375)
>  [27893]: getpwnam TESTDOMAIN+eli
>[2008/12/05 15:04:19,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [27937]: request interface version
>[2008/12/05 15:04:19,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [27937]: request location of privileged pipe
>[2008/12/05 15:04:19,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [27937]: ping
>[2008/12/05 15:04:34,  3] winbindd/winbindd_misc.c:winbindd_interface_version(757)
>  [28005]: request interface version
>[2008/12/05 15:04:34,  3] winbindd/winbindd_misc.c:winbindd_priv_pipe_dir(790)
>  [28005]: request location of privileged pipe
>[2008/12/05 15:04:34,  3] winbindd/winbindd_misc.c:winbindd_ping(736)
>  [28005]: ping
>
>log.smbd
>---------
>
>
>[2008/12/05 15:04:55,  3] smbd/server.c:remove_child_pid(299)
>  smbd/server.c:299 Unclean shutdown of pid 27893
>[2008/12/05 15:04:55,  2] lib/messages_local.c:message_notify(270)
>  message to process 11801 failed - No such process
>[2008/12/05 15:04:55,  2] lib/messages_local.c:messaging_tdb_send(358)
>  pid 0:11801 doesn't exist - deleting messages record
>[2008/12/05 15:04:55,  2] lib/messages.c:traverse_fn(127)
>  pid 0:11801 doesn't exist - deleting connections -1 []
>[2008/12/05 15:04:55,  2] lib/messages_local.c:message_notify(270)
>  message to process 27893 failed - No such process
>[2008/12/05 15:04:55,  2] lib/messages_local.c:messaging_tdb_send(358)
>  pid 0:27893 doesn't exist - deleting messages record
>[2008/12/05 15:04:55,  2] lib/messages.c:traverse_fn(127)
>
>

Actions: View

Attachments on bug 5952: 3786 | 3791 | 3792 | 3793 | 3794 | 3806