Frame 1 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 01:08:09.525204000 Time delta from previous packet: 0.000000000 seconds Time relative to first packet: 0.000000000 seconds Frame Number: 1 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 219.118.31.42 (219.118.31.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x0706 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x20ce (incorrect, should be 0x1729) Source: 219.118.31.42 (219.118.31.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0x97db (incorrect, should be 0x8e36) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 07 06 00 00 6f 11 20 ce db 76 1f 2a ac 10 .N....o. ..v.*.. 0020 86 bf 04 01 00 89 00 3a 97 db 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 2 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 01:08:09.525205000 Time delta from previous packet: 0.000001000 seconds Time relative to first packet: 0.000001000 seconds Frame Number: 2 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 219.118.31.42 (219.118.31.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x82e4 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x93f4 (incorrect, should be 0x8a4f) Source: 172.16.134.191 (172.16.134.191) Destination: 219.118.31.42 (219.118.31.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 309 Checksum: 0x7fb8 (incorrect, should be 0x9372) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 82 e4 00 00 7f 11 93 f4 ac 10 86 bf db 76 .I.............v 0020 1f 2a 00 89 04 01 01 35 7f b8 01 00 84 00 00 00 .*.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff 00 8d 94 ff 00 00 00 00 00 00 ................ 0150 00 00 15 02 00 ff 00 ....... Frame 11 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 03:33:12.419783000 Time delta from previous packet: 1952.777889000 seconds Time relative to first packet: 8702.894579000 seconds Frame Number: 11 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 218.163.9.89 (218.163.9.89), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xf3b1 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x47c6 (incorrect, should be 0x3e21) Source: 218.163.9.89 (218.163.9.89) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1025 (1025), Dst Port: netbios-ns (137) Source port: 1025 (1025) Destination port: netbios-ns (137) Length: 58 Checksum: 0xae7f (incorrect, should be 0xa4da) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e f3 b1 00 00 72 11 47 c6 da a3 09 59 ac 10 .N....r.G....Y.. 0020 86 bf 04 01 00 89 00 3a ae 7f 01 00 00 10 00 01 .......:........ 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 12 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 03:33:12.419784000 Time delta from previous packet: 0.000001000 seconds Time relative to first packet: 8702.894580000 seconds Frame Number: 12 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 218.163.9.89 (218.163.9.89) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x2029 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x0d54 (incorrect, should be 0x03af) Source: 172.16.134.191 (172.16.134.191) Destination: 218.163.9.89 (218.163.9.89) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1025 (1025) Source port: netbios-ns (137) Destination port: 1025 (1025) Length: 309 Checksum: 0x8a17 (incorrect, should be 0x9dd1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 20 29 00 00 7f 11 0d 54 ac 10 86 bf da a3 .I ).....T...... 0020 09 59 00 89 04 01 01 35 8a 17 01 00 84 00 00 00 .Y.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff e0 d1 94 ff 00 00 00 00 00 00 ................ 0150 00 00 6b 00 65 00 72 ..k.e.r Frame 34 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 06:59:32.078668000 Time delta from previous packet: 6021.004819000 seconds Time relative to first packet: 21082.553464000 seconds Frame Number: 34 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 61.155.126.150 (61.155.126.150), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x6e29 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 47 Protocol: UDP (0x11) Header checksum: 0x381a (incorrect, should be 0x2e75) Source: 61.155.126.150 (61.155.126.150) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0xd649 (incorrect, should be 0xcca4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 6e 29 00 00 2f 11 38 1a 3d 9b 7e 96 ac 10 .Nn)../.8.=.~... 0020 86 bf 04 02 00 89 00 3a d6 49 01 00 00 10 00 01 .......:.I...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 35 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 06:59:32.080296000 Time delta from previous packet: 0.001628000 seconds Time relative to first packet: 21082.555092000 seconds Frame Number: 35 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 61.155.126.150 (61.155.126.150) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x9505 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xc042 (incorrect, should be 0xb69d) Source: 172.16.134.191 (172.16.134.191) Destination: 61.155.126.150 (61.155.126.150) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 309 Checksum: 0xc0f4 (incorrect, should be 0xd4ae) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 95 05 00 00 7f 11 c0 42 ac 10 86 bf 3d 9b .I.......B....=. 0020 7e 96 00 89 04 02 01 35 c0 f4 01 00 84 00 00 00 ~......5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff 60 bf 93 ff 00 00 00 00 00 00 ......`......... 0150 00 00 37 00 7d 00 00 ..7.}.. Frame 46 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 08:43:42.664104000 Time delta from previous packet: 5006.422702000 seconds Time relative to first packet: 27333.138900000 seconds Frame Number: 46 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 66.190.67.122 (66.190.67.122), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc98e Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 118 Protocol: UDP (0x11) Header checksum: 0xcbad (incorrect, should be 0xc208) Source: 66.190.67.122 (66.190.67.122) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x0c41 (incorrect, should be 0x029c) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c9 8e 00 00 76 11 cb ad 42 be 43 7a ac 10 .N....v...B.Cz.. 0020 86 bf 04 04 00 89 00 3a 0c 41 01 00 00 10 00 01 .......:.A...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 47 (343 bytes on wire, 343 bytes captured) Arrival Time: Mar 1, 2003 08:43:42.668880000 Time delta from previous packet: 0.004776000 seconds Time relative to first packet: 27333.143676000 seconds Frame Number: 47 Packet Length: 343 bytes Capture Length: 343 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 66.190.67.122 (66.190.67.122) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 329 Identification: 0x9548 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xf5f8 (incorrect, should be 0xec53) Source: 172.16.134.191 (172.16.134.191) Destination: 66.190.67.122 (66.190.67.122) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 309 Checksum: 0x9515 (incorrect, should be 0xa8cf) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 227 Number of names: 10 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: ADMINISTRATOR<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 49 95 48 00 00 7f 11 f5 f8 ac 10 86 bf 42 be .I.H..........B. 0020 43 7a 00 89 04 04 01 35 95 15 01 00 84 00 00 00 Cz.....5........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 e3 0a 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 41 44 4d 49 4e 49 53 54 52 41 54 _....ADMINISTRAT 0110 4f 52 20 20 03 04 00 00 05 69 00 01 56 00 00 00 OR .....i..V... 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0140 00 00 00 00 00 ff c0 95 9b ff 00 00 00 00 00 00 ................ 0150 00 00 31 00 7d 00 00 ..1.}.. Frame 55 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 09:00:10.420196000 Time delta from previous packet: 987.563980000 seconds Time relative to first packet: 28320.894992000 seconds Frame Number: 55 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 62.127.38.198 (62.127.38.198), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xffeb Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 105 Protocol: UDP (0x11) Header checksum: 0xc343 (incorrect, should be 0xb99e) Source: 62.127.38.198 (62.127.38.198) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x2d36 (incorrect, should be 0x2391) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e ff eb 00 00 69 11 c3 43 3e 7f 26 c6 ac 10 .N....i..C>.&... 0020 86 bf 04 02 00 89 00 3a 2d 36 01 00 00 10 00 01 .......:-6...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 76 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 09:23:39.448982000 Time delta from previous packet: 942.475695000 seconds Time relative to first packet: 29729.923778000 seconds Frame Number: 76 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 141.149.155.249 (141.149.155.249), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xd72c Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 107 Protocol: UDP (0x11) Header checksum: 0x25b9 (incorrect, should be 0x1c14) Source: 141.149.155.249 (141.149.155.249) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 65060 (65060), Dst Port: netbios-ns (137) Source port: 65060 (65060) Destination port: netbios-ns (137) Length: 58 Checksum: 0x6ec9 (incorrect, should be 0x6524) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e d7 2c 00 00 6b 11 25 b9 8d 95 9b f9 ac 10 .N.,..k.%....... 0020 86 bf fe 24 00 89 00 3a 6e c9 01 00 00 10 00 01 ...$...:n....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 77 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 09:23:39.454345000 Time delta from previous packet: 0.005363000 seconds Time relative to first packet: 29729.929141000 seconds Frame Number: 77 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 141.149.155.249 (141.149.155.249) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0066 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xe796 (incorrect, should be 0xddf1) Source: 172.16.134.191 (172.16.134.191) Destination: 141.149.155.249 (141.149.155.249) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 65060 (65060) Source port: netbios-ns (137) Destination port: 65060 (65060) Length: 291 Checksum: 0x1f22 (incorrect, should be 0x32dc) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 66 00 00 7f 11 e7 96 ac 10 86 bf 8d 95 .7.f............ 0020 9b f9 00 89 fe 24 01 23 1f 22 01 00 84 00 00 00 .....$.#."...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 85 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 11:50:52.466280000 Time delta from previous packet: 8832.440524000 seconds Time relative to first packet: 38562.941076000 seconds Frame Number: 85 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 207.6.77.235 (207.6.77.235), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x9c4f Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x6633 (incorrect, should be 0x5c8e) Source: 207.6.77.235 (207.6.77.235) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1026 (1026), Dst Port: netbios-ns (137) Source port: 1026 (1026) Destination port: netbios-ns (137) Length: 58 Checksum: 0x7589 (incorrect, should be 0x6be4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 9c 4f 00 00 72 11 66 33 cf 06 4d eb ac 10 .N.O..r.f3..M... 0020 86 bf 04 02 00 89 00 3a 75 89 01 00 00 10 00 01 .......:u....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 86 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 11:50:52.471501000 Time delta from previous packet: 0.005221000 seconds Time relative to first packet: 38562.946297000 seconds Frame Number: 86 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 207.6.77.235 (207.6.77.235) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x00be Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xf3db (incorrect, should be 0xea36) Source: 172.16.134.191 (172.16.134.191) Destination: 207.6.77.235 (207.6.77.235) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1026 (1026) Source port: netbios-ns (137) Destination port: 1026 (1026) Length: 291 Checksum: 0x20fe (incorrect, should be 0x34b8) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 be 00 00 7f 11 f3 db ac 10 86 bf cf 06 .7.............. 0020 4d eb 00 89 04 02 01 23 20 fe 01 00 84 00 00 00 M......# ....... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 94 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 13:29:07.208143000 Time delta from previous packet: 5894.205806000 seconds Time relative to first packet: 44457.682939000 seconds Frame Number: 94 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 162.33.189.252 (162.33.189.252), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x865b Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 114 Protocol: UDP (0x11) Header checksum: 0x38fb (incorrect, should be 0x2f56) Source: 162.33.189.252 (162.33.189.252) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1027 (1027), Dst Port: netbios-ns (137) Source port: 1027 (1027) Destination port: netbios-ns (137) Length: 58 Checksum: 0x325c (incorrect, should be 0x28b7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 86 5b 00 00 72 11 38 fb a2 21 bd fc ac 10 .N.[..r.8..!.... 0020 86 bf 04 03 00 89 00 3a 32 5c 01 00 00 10 00 01 .......:2\...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 95 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 13:29:07.212956000 Time delta from previous packet: 0.004813000 seconds Time relative to first packet: 44457.687752000 seconds Frame Number: 95 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 162.33.189.252 (162.33.189.252) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x00fe Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xb06f (incorrect, should be 0xa6ca) Source: 172.16.134.191 (172.16.134.191) Destination: 162.33.189.252 (162.33.189.252) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1027 (1027) Source port: netbios-ns (137) Destination port: 1027 (1027) Length: 291 Checksum: 0xe2b4 (incorrect, should be 0xf66e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 00 fe 00 00 7f 11 b0 6f ac 10 86 bf a2 21 .7.......o.....! 0020 bd fc 00 89 04 03 01 23 e2 b4 01 00 84 00 00 00 .......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 105 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 19:01:30.338061000 Time delta from previous packet: 12838.867971000 seconds Time relative to first packet: 64400.812857000 seconds Frame Number: 105 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 64.17.250.240 (64.17.250.240), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x46bf Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 109 Protocol: UDP (0x11) Header checksum: 0xa2b3 (incorrect, should be 0x990e) Source: 64.17.250.240 (64.17.250.240) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1029 (1029), Dst Port: netbios-ns (137) Source port: 1029 (1029) Destination port: netbios-ns (137) Length: 58 Checksum: 0x5776 (incorrect, should be 0x4dd1) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e 46 bf 00 00 6d 11 a2 b3 40 11 fa f0 ac 10 .NF...m...@..... 0020 86 bf 04 05 00 89 00 3a 57 76 01 00 00 10 00 01 .......:Wv...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 106 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 19:01:30.343299000 Time delta from previous packet: 0.005238000 seconds Time relative to first packet: 64400.818095000 seconds Frame Number: 106 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 64.17.250.240 (64.17.250.240) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x01d2 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xd4b7 (incorrect, should be 0xcb12) Source: 172.16.134.191 (172.16.134.191) Destination: 64.17.250.240 (64.17.250.240) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1029 (1029) Source port: netbios-ns (137) Destination port: 1029 (1029) Length: 291 Checksum: 0x87d7 (incorrect, should be 0x9b91) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 01 d2 00 00 7f 11 d4 b7 ac 10 86 bf 40 11 .7............@. 0020 fa f0 00 89 04 05 01 23 87 d7 01 00 84 00 00 00 .......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 d9 a0 ff 00 00 00 00 58 d9 a0 ff 58 d9 ..........X...X. 0140 a0 ff 5c 00 53 ..\.S Frame 114 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 21:17:18.440828000 Time delta from previous packet: 8147.669922000 seconds Time relative to first packet: 72548.915624000 seconds Frame Number: 114 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 213.84.75.42 (213.84.75.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xe049 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0x21ac (incorrect, should be 0x1807) Source: 213.84.75.42 (213.84.75.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 10569 (10569), Dst Port: netbios-ns (137) Source port: 10569 (10569) Destination port: netbios-ns (137) Length: 58 Checksum: 0x4cb5 (incorrect, should be 0x4310) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e e0 49 00 00 6f 11 21 ac d5 54 4b 2a ac 10 .N.I..o.!..TK*.. 0020 86 bf 29 49 00 89 00 3a 4c b5 01 00 00 10 00 01 ..)I...:L....... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 115 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 21:17:18.447242000 Time delta from previous packet: 0.006414000 seconds Time relative to first packet: 72548.922038000 seconds Frame Number: 115 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 213.84.75.42 (213.84.75.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0226 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0xeee6 (incorrect, should be 0xe541) Source: 172.16.134.191 (172.16.134.191) Destination: 213.84.75.42 (213.84.75.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 10569 (10569) Source port: netbios-ns (137) Destination port: 10569 (10569) Length: 291 Checksum: 0xf829 (incorrect, should be 0x0be4) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 26 00 00 7f 11 ee e6 ac 10 86 bf d5 54 .7.&...........T 0020 4b 2a 00 89 29 49 01 23 f8 29 01 00 84 00 00 00 K*..)I.#.)...... 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 130 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 23:16:43.629885000 Time delta from previous packet: 7139.219292000 seconds Time relative to first packet: 79714.104681000 seconds Frame Number: 130 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 68.152.53.138 (68.152.53.138), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xbc41 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 111 Protocol: UDP (0x11) Header checksum: 0xec10 (incorrect, should be 0xe26b) Source: 68.152.53.138 (68.152.53.138) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1028 (1028), Dst Port: netbios-ns (137) Source port: 1028 (1028) Destination port: netbios-ns (137) Length: 58 Checksum: 0x1857 (incorrect, should be 0x0eb2) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e bc 41 00 00 6f 11 ec 10 44 98 35 8a ac 10 .N.A..o...D.5... 0020 86 bf 04 04 00 89 00 3a 18 57 01 00 00 10 00 01 .......:.W...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 131 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 23:16:43.648090000 Time delta from previous packet: 0.018205000 seconds Time relative to first packet: 79714.122886000 seconds Frame Number: 131 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 68.152.53.138 (68.152.53.138) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x0276 Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x94f3 (incorrect, should be 0x8b4e) Source: 172.16.134.191 (172.16.134.191) Destination: 68.152.53.138 (68.152.53.138) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 1028 (1028) Source port: netbios-ns (137) Destination port: 1028 (1028) Length: 291 Checksum: 0xc3cb (incorrect, should be 0xd785) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 76 00 00 7f 11 94 f3 ac 10 86 bf 44 98 .7.v..........D. 0020 35 8a 00 89 04 04 01 23 c3 cb 01 00 84 00 00 00 5......#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 7d a2 ff 00 00 00 00 98 7d a2 ff 98 7d ...}.......}...} 0140 a2 ff 5c 00 53 ..\.S Frame 139 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 1, 2003 23:40:01.725575000 Time delta from previous packet: 1397.716902000 seconds Time relative to first packet: 81112.200371000 seconds Frame Number: 139 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 4.64.221.42 (4.64.221.42), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0xc1ee Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x7d1b (incorrect, should be 0x7376) Source: 4.64.221.42 (4.64.221.42) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 32934 (32934), Dst Port: netbios-ns (137) Source port: 32934 (32934) Destination port: netbios-ns (137) Length: 58 Checksum: 0x346c (incorrect, should be 0x2ac7) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Message is a query .000 0... .... .... = Opcode: Name query (0) .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... ...1 .... = Broadcast: Broadcast packet Questions: 1 Answer RRs: 0 Authority RRs: 0 Additional RRs: 0 Queries *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> (Workstation/Redirector) Type: NBSTAT Class: inet 0000 00 05 69 00 01 e2 00 e0 b6 05 ce 0a 08 00 45 00 ..i...........E. 0010 00 4e c1 ee 00 00 71 11 7d 1b 04 40 dd 2a ac 10 .N....q.}..@.*.. 0020 86 bf 80 a6 00 89 00 3a 34 6c 01 00 00 10 00 01 .......:4l...... 0030 00 00 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 AAAAAAA..!.. Frame 140 (325 bytes on wire, 325 bytes captured) Arrival Time: Mar 1, 2003 23:40:01.728237000 Time delta from previous packet: 0.002662000 seconds Time relative to first packet: 81112.203033000 seconds Frame Number: 140 Packet Length: 325 bytes Capture Length: 325 bytes Ethernet II, Src: 00:05:69:00:01:e2, Dst: 00:e0:b6:05:ce:0a Destination: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Source: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Type: IP (0x0800) Internet Protocol, Src Addr: 172.16.134.191 (172.16.134.191), Dst Addr: 4.64.221.42 (4.64.221.42) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 311 Identification: 0x028a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 127 Protocol: UDP (0x11) Header checksum: 0x2d97 (incorrect, should be 0x23f2) Source: 172.16.134.191 (172.16.134.191) Destination: 4.64.221.42 (4.64.221.42) User Datagram Protocol, Src Port: netbios-ns (137), Dst Port: 32934 (32934) Source port: netbios-ns (137) Destination port: 32934 (32934) Length: 291 Checksum: 0xe4c4 (incorrect, should be 0xf87e) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x8400 (Name query response, No error) 1... .... .... .... = Response: Message is a response .000 0... .... .... = Opcode: Name query (0) .... .1.. .... .... = Authoritative: Server is an authority for domain .... ..0. .... .... = Truncated: Message is not truncated .... ...0 .... .... = Recursion desired: Don't do query recursively .... .... 0... .... = Recursion available: Server can't do recursive queries .... .... ...0 .... = Broadcast: Not a broadcast packet .... .... .... 0000 = Reply code: No error (0) Questions: 0 Answer RRs: 1 Authority RRs: 0 Additional RRs: 0 Answers *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>: type NBSTAT, class inet Name: *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00> Type: NBSTAT Class: inet Time to live: 0 time Data length: 209 Number of names: 9 Name: PC0191<00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<20> (Server service) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<00> (Workstation/Redirector) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1e> (Browser Election Service) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: PC0191<03> (Messenger service/Main name) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: INet~Services<1c> (Domain Controllers) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: IS~PC0191<00><00><00><00><00><00><00> (Workstation/Redirector) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: SBM<1d> (Local Master Browser) Name flags: 0x400 (B-node, unique, active) 0... .... .... .... = Unique name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Name: <01><02>__MSBROWSE__<02><01> (Browser) Name flags: 0x8400 (B-node, group, active) 1... .... .... .... = Group name .00. .... .... .... = B-node ...0 .... .... .... = Name is not being deregistered .... 0... .... .... = Name is not in conflict .... .1.. .... .... = Name is active .... ..0. .... .... = Not permanent node name Unit ID: 00:05:69:00:01:56 Jumpers: 0x0 Test result: 0x0 Version number: 0x0 Period of statistics: 0x0 Number of CRCs: 0 Number of alignment errors: 0 Number of collisions: 0 Number of send aborts: 0 Number of good sends: 0 Number of good receives: 0 Number of retransmits: 0 Number of no resource conditions: 0 Number of command blocks: 0 Number of pending sessions: 0 Max number of pending sessions: 0 Max total sessions possible: 0 Session data packet size: 0 0000 00 e0 b6 05 ce 0a 00 05 69 00 01 e2 08 00 45 00 ........i.....E. 0010 01 37 02 8a 00 00 7f 11 2d 97 ac 10 86 bf 04 40 .7......-......@ 0020 dd 2a 00 89 80 a6 01 23 e4 c4 01 00 84 00 00 00 .*.....#........ 0030 00 01 00 00 00 00 20 43 4b 41 41 41 41 41 41 41 ...... CKAAAAAAA 0040 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 41 AAAAAAAAAAAAAAAA 0050 41 41 41 41 41 41 41 00 00 21 00 01 00 00 00 00 AAAAAAA..!...... 0060 00 d1 09 50 43 30 31 39 31 20 20 20 20 20 20 20 ...PC0191 0070 20 20 00 04 00 50 43 30 31 39 31 20 20 20 20 20 ...PC0191 0080 20 20 20 20 20 04 00 53 42 4d 20 20 20 20 20 20 ..SBM 0090 20 20 20 20 20 20 00 84 00 53 42 4d 20 20 20 20 ...SBM 00a0 20 20 20 20 20 20 20 20 1e 84 00 50 43 30 31 39 ...PC019 00b0 31 20 20 20 20 20 20 20 20 20 03 04 00 49 4e 65 1 ...INe 00c0 74 7e 53 65 72 76 69 63 65 73 20 20 1c 84 00 49 t~Services ...I 00d0 53 7e 50 43 30 31 39 31 00 00 00 00 00 00 00 04 S~PC0191........ 00e0 00 53 42 4d 20 20 20 20 20 20 20 20 20 20 20 20 .SBM 00f0 1d 04 00 01 02 5f 5f 4d 53 42 52 4f 57 53 45 5f .....__MSBROWSE_ 0100 5f 02 01 84 00 00 05 69 00 01 56 00 00 00 00 00 _......i..V..... 0110 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0120 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 0130 00 00 00 dc a0 ff 00 00 00 00 18 dc a0 ff 18 dc ................ 0140 a0 ff 5c 00 53 ..\.S Frame 150 (92 bytes on wire, 92 bytes captured) Arrival Time: Mar 2, 2003 00:01:58.099615000 Time delta from previous packet: 287.146093000 seconds Time relative to first packet: 82428.574411000 seconds Frame Number: 150 Packet Length: 92 bytes Capture Length: 92 bytes Ethernet II, Src: 00:e0:b6:05:ce:0a, Dst: 00:05:69:00:01:e2 Destination: 00:05:69:00:01:e2 (00:05:69:00:01:e2) Source: 00:e0:b6:05:ce:0a (00:e0:b6:05:ce:0a) Type: IP (0x0800) Internet Protocol, Src Addr: 66.92.135.108 (66.92.135.108), Dst Addr: 172.16.134.191 (172.16.134.191) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) 0000 00.. = Differentiated Services Codepoint: Default (0x00) .... ..0. = ECN-Capable Transport (ECT): 0 .... ...0 = ECN-CE: 0 Total Length: 78 Identification: 0x410a Flags: 0x00 .0.. = Don't fragment: Not set ..0. = More fragments: Not set Fragment offset: 0 Time to live: 113 Protocol: UDP (0x11) Header checksum: 0x15a2 (incorrect, should be 0x0bfd) Source: 66.92.135.108 (66.92.135.108) Destination: 172.16.134.191 (172.16.134.191) User Datagram Protocol, Src Port: 1043 (1043), Dst Port: netbios-ns (137) Source port: 1043 (1043) Destination port: netbios-ns (137) Length: 58 Checksum: 0xc8a1 (incorrect, should be 0xbefc) NetBIOS Name Service Transaction ID: 0x0100 Flags: 0x0010 (Name query) 0... .... .... .... = Response: Messa