unknown netlogon op 10 from 172.16.100.131:138 netlogon: struct nbt_netlogon_packet command : NETLOGON_ANNOUNCE_UAS (10) req : union nbt_netlogon_request(case 10) uas: struct NETLOGON_DB_CHANGE serial_lo : 0x00000062 (98) timestamp : Sun Sep 23 09:38:07 2012 PDT pulse : 0x00001c20 (7200) random : 0x00000001 (1) pdc_name : 'S1-W2K3' domain : 'W2K3' _pad : DATA_BLOB length=1 [0000] 00 . unicode_pdc_name : 'S1-W2K3' unicode_domain : 'W2K3' db_count : 0x00000003 (3) dbchange: ARRAY(3) dbchange: struct nbt_db_change_info db_index : SAM_DATABASE_DOMAIN (0) serial : 0x00000000ffffffff (4294967295) timestamp : Sun Sep 23 09:38:08 2012 PDT dbchange: struct nbt_db_change_info db_index : SAM_DATABASE_BUILTIN (1) serial : 0x00000000ffffffff (4294967295) timestamp : Sat Feb 18 14:00:00 2012 PST dbchange: struct nbt_db_change_info db_index : SAM_DATABASE_PRIVS (2) serial : 0x00000000ffffffff (4294967295) timestamp : Sat Feb 18 14:00:00 2012 PST sid_size : 0x00000018 (24) sid : S-0-0 message_format_version : 0x00011e66 (73318) message_token : 0xffff0000 (4294901760)
Ah, as we can see this isn't unknown, but it is something that the source4 nbt server doesn't handle. The code in source3/nmbd/nmbd_processlogon.c just ignores this packet. Jeremy.