[jcifs] JCIFS: Strange NetBIOS resolving issue
Peter
hostalp at post.cz
Thu Jul 5 18:30:23 GMT 2007
Hello,
we use jcifs-1.2.14 in one our web application. In our test environment it's
running on WebSphere AS 5.1.1.14 / RHEL 3ES Linux-x86. In this environment we
have one problem which occurs on random basis.
After the application server running our application is started and we try to
access its web interface there's an attempt to contact the domain controller,
perform ntlm authentication etc. before the access to the web is allowed... all
done by jcifs functionality. And here it sometimes works and sometimes it
doesn't and the application hangs before the first page is diaplayed.
We switched on the highets jcifs logging level in order to capture what is it
doing when we get into the nonworking state, we also captured the network
traffic on that application server machine and everything looks like the
problem occurs during NetBIOS name resolution. First, I'll show the jcifs log
data from the nonworking state:
[7/4/07 19:30:01:054 CEST] 78dc534 SystemErr R NameQueryRequest
[nameTrnId=1,isResponse=false,opCode=QUERY,isAuthAnswer=false,isTruncated=false,
isRecurAvailable=false,isRecurDesired=true,isBroadcast=true,resultCode=0,questio
nCount=1,answerCount=0,authorityCount=0,additionalCount=0,questionName=DC2<1D>,q
uestionType=0x0020,questionClass=IN,recordName=null,recordType=0x0000,recordClas
s=0x0000,ttl=0,rDataLength=0]
[7/4/07 19:30:01:054 CEST] 7f40534 SystemErr R NetBIOS: new data read from
socket
[7/4/07 19:30:01:054 CEST] 78dc534 SystemErr R 00000: 00 01 01 10 00 01 00
00 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 42 4E 00 00 20 |ACACACACACABN.. |
00030: 00 01 |.. |
[7/4/07 19:30:01:055 CEST] 78dc534 SystemErr R
[7/4/07 19:30:01:055 CEST] 7f14534 SystemErr R NameQueryRequest
[nameTrnId=2,isResponse=false,opCode=QUERY,isAuthAnswer=false,isTruncated=false,
isRecurAvailable=false,isRecurDesired=true,isBroadcast=true,resultCode=0,questio
nCount=1,answerCount=0,authorityCount=0,additionalCount=0,questionName=DC2<20>,q
uestionType=0x0020,questionClass=IN,recordName=null,recordType=0x0000,recordClas
s=0x0000,ttl=0,rDataLength=0]
[7/4/07 19:30:01:056 CEST] 7f14534 SystemErr R 00000: 00 02 01 10 00 01 00
00 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 43 41 00 00 20 |ACACACACACACA.. |
00030: 00 01 |.. |
[7/4/07 19:30:01:056 CEST] 7f14534 SystemErr R
[7/4/07 19:30:04:065 CEST] 7f14534 SystemErr R NameQueryRequest
[nameTrnId=3,isResponse=false,opCode=QUERY,isAuthAnswer=false,isTruncated=false,
isRecurAvailable=false,isRecurDesired=true,isBroadcast=true,resultCode=0,questio
nCount=1,answerCount=0,authorityCount=0,additionalCount=0,questionName=DC2<20>,q
uestionType=0x0020,questionClass=IN,recordName=null,recordType=0x0000,recordClas
s=0x0000,ttl=0,rDataLength=0]
[7/4/07 19:30:04:066 CEST] 7f14534 SystemErr R 00000: 00 03 01 10 00 01 00
00 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 43 41 00 00 20 |ACACACACACACA.. |
00030: 00 01 |.. |
[7/4/07 19:30:04:066 CEST] 7f14534 SystemErr R
here it hangs and the application is unusable until it's restarted.
In the case it works, the log looks like this:
[7/4/07 19:42:00:519 CEST] 78986b22 SystemErr R NameQueryRequest
[nameTrnId=1,isResponse=false,opCode=QUERY,isAuthAnswer=false,isTruncated=false,
isRecurAvailable=false,isRecurDesired=true,isBroadcast=true,resultCode=0,questio
nCount=1,answerCount=0,authorityCount=0,additionalCount=0,questionName=DC2<20>,q
uestionType=0x0020,questionClass=IN,recordName=null,recordType=0x0000,recordClas
s=0x0000,ttl=0,rDataLength=0]
[7/4/07 19:42:00:520 CEST] 789b2b22 SystemErr R NetBIOS: new data read from
socket
[7/4/07 19:42:00:520 CEST] 78986b22 SystemErr R 00000: 00 01 01 10 00 01 00
00 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 43 41 00 00 20 |ACACACACACACA.. |
00030: 00 01 |.. |
[7/4/07 19:42:00:520 CEST] 78986b22 SystemErr R
[7/4/07 19:42:00:521 CEST] 789b2b22 SystemErr R NameQueryResponse
[nameTrnId=1,isResponse=true,opCode=QUERY,isAuthAnswer=true,isTruncated=false,is
RecurAvailable=false,isRecurDesired=true,isBroadcast=false,resultCode=0,question
Count=0,answerCount=1,authorityCount=0,additionalCount=0,questionName=null,quest
ionType=0x0000,questionClass=IN,recordName=DC2<20>,recordType=0x0020,recordClass
=IN,ttl=300000,rDataLength=6,addrEntry=[Ljcifs.netbios.NbtAddress;@30882b2a]
[7/4/07 19:42:00:521 CEST] 789b2b22 SystemErr R 00000: 00 01 85 00 00 00 00
01 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 43 41 00 00 20 |ACACACACACACA.. |
00030: 00 01 00 04 93 E0 00 06 60 00 0A 02 01 09 |.....à..`..... |
[7/4/07 19:42:00:521 CEST] 789b2b22 SystemErr R
[7/4/07 19:42:00:521 CEST] 7884eb22 SystemErr R NameQueryRequest
[nameTrnId=2,isResponse=false,opCode=QUERY,isAuthAnswer=false,isTruncated=false,
isRecurAvailable=false,isRecurDesired=true,isBroadcast=true,resultCode=0,questio
nCount=1,answerCount=0,authorityCount=0,additionalCount=0,questionName=DC2<1D>,q
uestionType=0x0020,questionClass=IN,recordName=null,recordType=0x0000,recordClas
s=0x0000,ttl=0,rDataLength=0]
[7/4/07 19:42:00:522 CEST] 7884eb22 SystemErr R 00000: 00 02 01 10 00 01 00
00 00 00 00 00 20 45 45 45 |............ EEE|
00010: 44 44 43 43 41 43 41 43 41 43 41 43 41 43 41 43 |DDCCACACACACACAC|
00020: 41 43 41 43 41 43 41 43 41 43 41 42 4E 00 00 20 |ACACACACACABN.. |
00030: 00 01 |.. |
[7/4/07 19:42:00:522 CEST] 7884eb22 SystemErr R
[7/4/07 19:42:00:522 CEST] 789b2b22 SystemErr R NetBIOS: new data read from
socket
[7/4/07 19:42:00:522 CEST] 789b2b22 SystemErr R NetBIOS: new data read from
socket
[7/4/07 19:42:00:523 CEST] 789b2b22 SystemErr R NetBIOS: new data read from
socket
[7/4/07 19:42:00:621 CEST] 63772b22 SystemErr R SmbComNegotiate
[command=SMB_COM_NEGOTIATE,received=false,errorCode=0,flags=0x0018,flags2=0xC003
,signSeq=0,tid=0,pid=31034,uid=0,mid=1,wordCount=0,byteCount=12,wordCount=0,dial
ects=NT LM 0.12]
[7/4/07 19:42:00:621 CEST] 63772b22 SystemErr R 00000: FF 53 4D 42 72 00 00
00 00 18 03 C0 00 00 00 00 |ÿSMBr......À....|
00010: 00 00 00 00 00 00 00 00 00 00 3A 79 00 00 01 00 |..........:y....|
00020: 00 0C 00 02 4E 54 20 4C 4D 20 30 2E 31 32 00 |....NT LM 0.12. |
[7/4/07 19:42:00:621 CEST] 63772b22 SystemErr R
[7/4/07 19:42:00:622 CEST] 63772b22 SystemErr R New data read: Transport1
[0.0.0.0<00>/10.2.1.9:0]
[7/4/07 19:42:00:622 CEST] 63772b22 SystemErr R 00000: FF 53 4D 42 72 00 00
00 00 98 03 C0 00 00 00 00 |ÿSMBr......À....|
00010: 00 00 00 00 00 00 00 00 00 00 3A 79 00 00 01 00 |..........:y....|
[7/4/07 19:42:00:622 CEST] 63772b22 SystemErr R
[7/4/07 19:42:00:624 CEST] 63772b22 SystemErr R byteCount=34 but
readBytesWireFormat returned 24
[7/4/07 19:42:00:625 CEST] 63772b22 SystemErr R SmbComNegotiateResponse
[command=SMB_COM_NEGOTIATE,received=false,errorCode=0,flags=0x0098,flags2=0xC003
,signSeq=0,tid=0,pid=31034,uid=0,mid=1,wordCount=17,byteCount=34,wordCount=17,di
alectIndex=0,securityMode=0xF,security=user,encryptedPasswords=true,maxMpxCount=
50,maxNumberVcs=1,maxBufferSize=16644,maxRawSize=65536,sessionKey=0x00000000,cap
abilities=0x0001F3FD,serverTime=Wed Jul 04 19:42:00 CEST
2007,serverTimeZone=65416,encryptionKeyLength=8,byteCount=34,encryptionKey=0x6D7
11B1008697119,oemDomainName=XYZ]
[7/4/07 19:42:00:625 CEST] 63772b22 SystemErr R 00000: FF 53 4D 42 72 00 00
00 00 98 03 C0 00 00 00 00 |ÿSMBr......À....|
00010: 00 00 00 00 00 00 00 00 00 00 3A 79 00 00 01 00 |..........:y....|
00020: 11 00 00 0F 32 00 01 00 04 41 00 00 00 00 01 |....2....A..... |
[7/4/07 19:42:00:625 CEST] 63772b22 SystemErr R
and so on... the communication just works pretty well.
What is really strange is that it occurs really randomly. One time we start the
application it works well, another time it doesn't etc...
When we looked at the captured packets we found out that in both cases there
were correct responses sent back to the application server machine so we don't
understand why it sometimes doesn't work properly.
Here's the packet capture from the nonworking state:
- traffic between the application server machine (10.2.4.23) and the domain
controller DC2 (10.2.1.9):
19:29:27.820451 10.2.4.23.32847 > 10.2.1.9.domain: 25799+ A?
xyzxyzxy.xyzxyzxy.xy. (38) (DF)
0x0000 4500 0042 a01f 4000 4011 8168 0a02 0417 E..B.. at .@..h....
0x0010 0a02 0109 804f 0035 002e 2e73 64c7 0100 .....O.5...sd...
0x0020 0001 0000 0000 0000 0878 797a 7879 7a78 .........xyzxyzx
0x0030 7908 7879 7a78 797a 7879 0278 7900 0001 y.xyzxyzxy.xy...
0x0040 0001 ..
19:29:27.820652 10.2.1.9.domain > 10.2.4.23.32847: 25799* 1/0/0 A 10.2.1.192
(54)
0x0000 4500 0052 d513 0000 8011 4c64 0a02 0109 E..R......Ld....
0x0010 0a02 0417 0035 804f 003e cfec 64c7 8580 .....5.O.>..d...
0x0020 0001 0001 0000 0000 0878 797a 7879 7a78 .........xyzxyzx
0x0030 7908 7879 7a78 797a 7879 0278 7900 0001 y.xyzxyzxy.xy...
0x0040 0001 c00c 0001 0001 0000 0e10 0004 0a02 ................
0x0050 01c0 ..
19:30:01.055594 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a d652 0000 8011 4b1d 0a02 0109 E..Z.R....K.....
0x0010 0a02 0417 0089 804f 0046 a412 0002 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:30:04.065503 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a d678 0000 8011 4af7 0a02 0109 E..Z.x....J.....
0x0010 0a02 0417 0089 804f 0046 a411 0003 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:32:21.366187 10.2.1.9.netbios-ns > 10.2.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST
0x0000 4500 004e dcf9 0000 8011 4899 0a02 0109 E..N......H.....
0x0010 0a02 ffff 0089 0089 003a a3bc ca1b 0110 .........:......
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4f45 4346 4445 4446 4146 4345 4245 4945 OECFDEDFAFCEBEIE
0x0040 4243 4f45 4446 4b43 4100 0020 0001 BCOEDFKCA.....
19:32:22.114727 10.2.1.9.netbios-ns > 10.2.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST
0x0000 4500 004e dd48 0000 8011 484a 0a02 0109 E..N.H....HJ....
0x0010 0a02 ffff 0089 0089 003a a3bc ca1b 0110 .........:......
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4f45 4346 4445 4446 4146 4345 4245 4945 OECFDEDFAFCEBEIE
0x0040 4243 4f45 4446 4b43 4100 0020 0001 BCOEDFKCA.....
19:32:22.864640 10.2.1.9.netbios-ns > 10.2.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST
0x0000 4500 004e dd60 0000 8011 4832 0a02 0109 E..N.`....H2....
0x0010 0a02 ffff 0089 0089 003a a3bc ca1b 0110 .........:......
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4f45 4346 4445 4446 4146 4345 4245 4945 OECFDEDFAFCEBEIE
0x0040 4243 4f45 4446 4b43 4100 0020 0001 BCOEDFKCA.....
- complete netbios-ns traffic on the application server at the same time:
19:30:01.053349 10.2.4.23.32847 > 255.255.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST (DF)
0x0000 4500 004e 0000 4000 4011 2c87 0a02 0417 E..N.. at .@.,.....
0x0010 ffff ffff 804f 0089 003a 251e 0001 0110 .....O...:%.....
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 ACACACABN.....
19:30:01.053845 10.2.1.192.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 ea80 0000 4011 763c 0a02 01c0 E..V.... at .v<....
0x0010 0a02 0417 0089 804f 0042 5e3b 0001 bc00 .......O.B^;....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 0000 ACACACABN.......
0x0050 001e 0002 0000 ......
19:30:01.054095 10.2.1.193.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 a7f1 0000 4011 b8ca 0a02 01c1 E..V.... at .......
0x0010 0a02 0417 0089 804f 0042 5e3a 0001 bc00 .......O.B^:....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 0000 ACACACABN.......
0x0050 001e 0002 0000 ......
19:30:01.055246 10.2.4.23.32847 > 255.255.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST (DF)
0x0000 4500 004e 0001 4000 4011 2c86 0a02 0417 E..N.. at .@.,.....
0x0010 ffff ffff 804f 0089 003a 321c 0002 0110 .....O...:2.....
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 ACACACACA.....
19:30:01.055594 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a d652 0000 8011 4b1d 0a02 0109 E..Z.R....K.....
0x0010 0a02 0417 0089 804f 0046 a412 0002 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:30:01.055717 10.2.1.193.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 a7f2 0000 4011 b8c9 0a02 01c1 E..V.... at .......
0x0010 0a02 0417 0089 804f 0042 6b38 0002 bc00 .......O.Bk8....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
19:30:01.055842 10.2.1.192.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 ea81 0000 4011 763b 0a02 01c0 E..V.... at .v;....
0x0010 0a02 0417 0089 804f 0042 6b39 0002 bc00 .......O.Bk9....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
19:30:04.065313 10.2.4.23.32847 > 255.255.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST (DF)
0x0000 4500 004e 0002 4000 4011 2c85 0a02 0417 E..N.. at .@.,.....
0x0010 ffff ffff 804f 0089 003a 321b 0003 0110 .....O...:2.....
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 ACACACACA.....
19:30:04.065503 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a d678 0000 8011 4af7 0a02 0109 E..Z.x....J.....
0x0010 0a02 0417 0089 804f 0046 a411 0003 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:30:04.065748 10.2.1.192.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 ea82 0000 4011 763a 0a02 01c0 E..V.... at .v:....
0x0010 0a02 0417 0089 804f 0042 6b38 0003 bc00 .......O.Bk8....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
19:30:04.066124 10.2.1.193.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 a7f3 0000 4011 b8c8 0a02 01c1 E..V.... at .......
0x0010 0a02 0417 0089 804f 0042 6b37 0003 bc00 .......O.Bk7....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
So we see that there was always response for each request.
To compare with what is being communicated in working state we again captured
the traffic which looks like this:
- traffic between the application server machine (10.2.4.23) and the domain
controller DC2 (10.2.1.9):
19:41:38.535319 10.2.4.23.32847 > 10.2.1.9.domain: 3372+ A?
xyzxyzxy.xyzxyzxy.xy. (38) (DF)
0x0000 4500 0042 bd8f 4000 4011 63f8 0a02 0417 E..B.. at .@.c.....
0x0010 0a02 0109 804f 0035 002e 860e 0d2c 0100 .....O.5.....,..
0x0020 0001 0000 0000 0000 0878 797a 7879 7a78 .........xyzxyzx
0x0030 7908 7879 7a78 797a 7879 0278 7900 0001 y.xyzxyzxy.xy...
0x0040 0001 ..
19:41:38.535614 10.2.1.9.domain > 10.2.4.23.32847: 3372* 1/0/0 A 10.2.1.192
(54)
0x0000 4500 0052 f609 0000 8011 2b6e 0a02 0109 E..R......+n....
0x0010 0a02 0417 0035 804f 003e 2788 0d2c 8580 .....5.O.>'..,..
0x0020 0001 0001 0000 0000 0878 797a 7879 7a78 .........xyzxyzx
0x0030 7908 7879 7a78 797a 7879 0278 7900 0001 y.xyzxyzxy.cz...
0x0040 0001 c00c 0001 0001 0000 0e10 0004 0a02 ................
0x0050 01c0 ..
19:42:00.519075 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a f717 0000 8011 2a58 0a02 0109 E..Z......*X....
0x0010 0a02 0417 0089 804f 0046 a413 0001 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:42:00.615063 10.2.4.23.58462 > 10.2.1.9.microsoft-ds: S 1859402628:1859402628
(0) win 5840 <mss 1460,sackOK,timestamp 1018086958 0,nop,wscale 0> (DF)
0x0000 4500 003c fdaa 4000 4006 23ee 0a02 0417 E..<.. at .@.#.....
0x0010 0a02 0109 e45e 01bd 6ed4 3b84 0000 0000 .....^..n.;.....
0x0020 a002 16d0 84c2 0000 0204 05b4 0402 080a ................
0x0030 3cae c62e 0000 0000 0103 0300 <...........
19:42:00.615269 10.2.1.9.microsoft-ds > 10.2.4.23.58462: S 3938860359:3938860359
(0) ack 1859402629 win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp 0
0,nop,nop,sackOK>
0x0000 4500 0040 f718 0000 8006 2a7c 0a02 0109 E.. at ......*|....
0x0010 0a02 0417 01bd e45e eac6 3d47 6ed4 3b85 .......^..=Gn.;.
0x0020 b012 4000 244a 0000 0204 05b4 0103 0300 .. at .$J..........
0x0030 0101 080a 0000 0000 0000 0000 0101 0402 ................
19:42:00.615289 10.2.4.23.58462 > 10.2.1.9.microsoft-ds: . ack 1 win 5840
<nop,nop,timestamp 1018086959 0> (DF)
0x0000 4500 0034 fdab 4000 4006 23f5 0a02 0417 E..4.. at .@.#.....
0x0010 0a02 0109 e45e 01bd 6ed4 3b85 eac6 3d48 .....^..n.;...=H
0x0020 8010 16d0 8b67 0000 0101 080a 3cae c62f .....g......<../
0x0030 0000 0000 ....
19:42:00.621678 10.2.4.23.58462 > 10.2.1.9.microsoft-ds: P 1:52(51) ack 1 win
5840 <nop,nop,timestamp 1018086959 0> (DF)
0x0000 4500 0067 fdac 4000 4006 23c1 0a02 0417 E..g.. at .@.#.....
0x0010 0a02 0109 e45e 01bd 6ed4 3b85 eac6 3d48 .....^..n.;...=H
0x0020 8018 16d0 6fe6 0000 0101 080a 3cae c62f ....o.......<../
0x0030 0000 0000 0000 002f ff53 4d42 7200 0000 ......./.SMBr...
0x0040 0018 03c0 0000 0000 0000 0000 0000 0000 ................
0x0050 0000 3a79 0000 0100 000c 0002 4e54 204c ..:y........NT.L
0x0060 4d20 302e 3132 00 M.0.12.
...
- complete netbios-ns traffic on the application server at the same time:
19:42:00.518700 10.2.4.23.32847 > 255.255.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST (DF)
0x0000 4500 004e 0000 4000 4011 2c87 0a02 0417 E..N.. at .@.,.....
0x0010 ffff ffff 804f 0089 003a 321d 0001 0110 .....O...:2.....
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 ACACACACA.....
19:42:00.519075 10.2.1.9.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
QUERY; POSITIVE; RESPONSE; UNICAST
0x0000 4500 005a f717 0000 8011 2a58 0a02 0109 E..Z......*X....
0x0010 0a02 0417 0089 804f 0046 a413 0001 8500 .......O.F......
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0004 ACACACACA.......
0x0050 93e0 0006 6000 0a02 0109 ....`.....
19:42:00.519085 10.2.1.192.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 eac4 0000 4011 75f8 0a02 01c0 E..V.... at .u.....
0x0010 0a02 0417 0089 804f 0042 6b3a 0001 bc00 .......O.Bk:....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
19:42:00.519325 10.2.1.193.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 a7fb 0000 4011 b8c0 0a02 01c1 E..V.... at .......
0x0010 0a02 0417 0089 804f 0042 6b39 0001 bc00 .......O.Bk9....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4143 4100 0020 0001 0000 ACACACACA.......
0x0050 001e 0002 0000 ......
19:42:00.520683 10.2.4.23.32847 > 255.255.255.255.netbios-ns: NBT UDP PACKET
(137): QUERY; REQUEST; BROADCAST (DF)
0x0000 4500 004e 0001 4000 4011 2c86 0a02 0417 E..N.. at .@.,.....
0x0010 ffff ffff 804f 0089 003a 251d 0002 0110 .....O...:%.....
0x0020 0001 0000 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 ACACACABN.....
19:42:00.521075 10.2.1.193.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 a7fc 0000 4011 b8bf 0a02 01c1 E..V.... at .......
0x0010 0a02 0417 0089 804f 0042 5e39 0002 bc00 .......O.B^9....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 0000 ACACACABN.......
0x0050 001e 0002 0000 ......
19:42:00.521198 10.2.1.192.netbios-ns > 10.2.4.23.32847: NBT UDP PACKET(137):
WACK; POSITIVE; RESPONSE; UNICAST
0x0000 4500 0056 eac5 0000 4011 75f7 0a02 01c0 E..V.... at .u.....
0x0010 0a02 0417 0089 804f 0042 5e3a 0002 bc00 .......O.B^:....
0x0020 0000 0001 0000 0000 2045 4545 4444 4343 .........EEEDDCC
0x0030 4143 4143 4143 4143 4143 4143 4143 4143 ACACACACACACACAC
0x0040 4143 4143 4143 4142 4e00 0020 0001 0000 ACACACABN.......
0x0050 001e 0002 0000 ......
19:42:00.626902 10.2.4.23.32847 > 10.2.1.9.netbios-ns: NBT UDP PACKET(137):
QUERY; REQUEST; UNICAST (DF)
0x0000 4500 004e 0002 4000 4011 217a 0a02 0417 E..N.. at .@.!z....
0x0010 0a02 0109 804f 0089 003a 2742 0003 0000 .....O...:'B....
0x0020 0001 0000 0000 0000 2043 4b41 4141 4141 .........CKAAAAA
0x0030 4141 4141 4141 4141 4141 4141 4141 4141 AAAAAAAAAAAAAAAA
0x0040 4141 4141 4141 4141 4100 0021 0001 AAAAAAAAA..!..
...
so we see when there was a response it was identical to the case when the
application hung.
I looked at the historical logs and found out that always when we get into the
hung state the netbios query type order coming from the jcifs is <1D> first,
<20> second, while when it works the order is opposite, ie. <20> first, <1D>
second. So far we found no other difference. Could this somehow make all that
difference?
Responses to all queries seem to be correct and even in the first network
capture (nonworking state) we can see that at 19:30:04.065313 there was query
sent for the second time (3s timeout, 2 query limit) which was again replied by
correct responses from several machines, but in the log there's nothing
What I've done is that I changed the resolving method order to use DNS first so
now it works prety well, but still we'd like to figure out why this strange
netbios resolving issue occurs...
Any ideas?
Thanks for any helpful response,
Peter.
Just to not miss including anything, the jcifs configuration follows:
[7/4/07 19:30:00:997 CEST] 6930534 SystemErr R #JCIFS PROPERTIES
#Wed Jul 04 19:30:00 CEST 2007
java.vendor=IBM Corporation
jcifs.netbios.cachePolicy=1200
com.ibm.ejs.jts.processType=server
os.name=Linux
sun.boot.class.path=/opt/WebSphere/AppServer/java/jre/lib/ext/ibmorb.jar\:/opt/W
ebSphere/AppServer/java/jre/lib/ext/ibmext.jar\:/opt/WebSphere/AppServer/java/jr
e/lib/endorsed/xercesImpl.jar\:/opt/WebSphere/AppServer/java/jre/lib/endorsed/xm
lParserAPIs.jar\:/opt/WebSphere/AppServer/java/jre/lib/endorsed/xalan.jar\:/opt/
WebSphere/AppServer/java/jre/lib/core.jar\:/opt/WebSphere/AppServer/java/jre/lib
/graphics.jar\:/opt/WebSphere/AppServer/java/jre/lib/security.jar\:/opt/WebSpher
e/AppServer/java/jre/lib/server.jar\:/opt/WebSphere/AppServer/java/jre/lib/xml.j
ar\:/opt/WebSphere/AppServer/java/jre/lib/charsets.jar\:/opt/WebSphere/AppServer
/java/jre/lib/ibmcertpathprovider.jar\:/opt/WebSphere/AppServer/java/jre/lib/ibm
jaaslm.jar\:/opt/WebSphere/AppServer/java/jre/lib/ibmjcefw.jar\:/opt/WebSphere/A
ppServer/java/jre/lib/ibmjgssprovider.jar\:/opt/WebSphere/AppServer/java/jre/lib
/ibmjssefips.jar\:/opt/WebSphere/AppServer/java/jre/lib/ibmjsseprovider.jar\:/op
t/WebSphere/AppServer/java/jre/lib/ibmorb.jar\:/opt/WebSphere/AppServer/java/jre
/lib/ibmorbapi.jar\:/opt/WebSphere/AppServer/java/jre/lib/ibmpkcs.jar
sun.java2d.fontpath=
java.vm.specification.vendor=Sun Microsystems Inc.
java.runtime.version=1.4.2
user.name=wasadmin
java.compiler=jitc
was.install.root=/opt/WebSphere/AppServer
db2j.system.home=/opt/WebSphere/AppServer/cloudscape
user.language=en
was.repository.temp=/opt/WebSphere/AppServer/config/temp/
sun.boot.library.path=/opt/WebSphere/AppServer/java/jre/bin
java.version=1.4.2
user.timezone=Europe/Berlin
server.root=/opt/WebSphere/AppServer
sun.arch.data.model=32
javax.rmi.CORBA.UtilClass=com.ibm.ws.orb.WSUtilDelegateImpl
java.endorsed.dirs=/opt/WebSphere/AppServer/java/jre/lib/endorsed
file.encoding.pkg=sun.io
file.separator=/
java.specification.name=Java Platform API Specification
java.class.version=48.0
user.country=US
was.status.socket=55850
java.home=/opt/WebSphere/AppServer/java/jre
java.vm.info=J2RE 1.4.2 IBM build cxia32142-20061124 (SR7) (JIT enabled\: jitc)
os.version=2.4.21-20.ELsmp
jcifs.smb.client.soTimeout=300000
java.awt.fonts=
path.separator=\:
java.vm.version=1.4.2
java.util.prefs.PreferencesFactory=java.util.prefs.FileSystemPreferencesFactory
java.protocol.handler.pkgs=com.ibm.ws.protocol|com.ibm.net.ssl.internal.www.prot
ocol
java.awt.printerjob=sun.print.PSPrinterJob
java.security.policy=/opt/WebSphere/AppServer/properties/server.policy
sun.io.unicode.encoding=UnicodeLittle
java.assistive=ON
jcifs.util.loglevel=6
java.naming.factory.url.pkgs=com.ibm.ws.runtime
user.home=/home/wasadmin
java.specification.vendor=Sun Microsystems Inc.
invokedviajava=
java.library.path=/opt/WebSphere/AppServer/java/jre/bin\:/opt/WebSphere/AppServe
r/java/jre/bin/classic\:/opt/WebSphere/AppServer/java/jre/bin\:/opt/WebSphere/Ap
pServer/bin\:/opt/mqm/java/lib\:/opt/wemps/lib\:/usr/lib\:/usr/lib64
java.vendor.url=http\://www.ibm.com/
java.vm.vendor=IBM Corporation
java.fullversion=J2RE 1.4.2 IBM build cxia32142-20061124 (SR7) (JIT enabled\:
jitc)
java.runtime.name=Java(TM) 2 Runtime Environment, Standard Edition
java.class.path=/opt/WebSphere/AppServer/properties\:/opt/WebSphere/AppServer/pr
operties\:/opt/WebSphere/AppServer/lib/bootstrap.jar\:/opt/WebSphere/AppServer/l
ib/j2ee.jar\:/opt/WebSphere/AppServer/lib/lmproxy.jar\:/opt/WebSphere/AppServer/
lib/urlprotocols.jar
ws.ext.dirs=/opt/WebSphere/AppServer/java/lib\:/opt/WebSphere/AppServer/classes\
:/opt/WebSphere/AppServer/classes\:/opt/WebSphere/AppServer/lib\:/opt/WebSphere/
AppServer/lib/ext\:/opt/WebSphere/AppServer/web/help\:/opt/WebSphere/AppServer/d
eploytool/itp/plugins/com.ibm.etools.ejbdeploy/runtime
java.vm.specification.name=Java Virtual Machine Specification
java.vm.specification.version=1.0
sun.os.patch.level=unknown
user.install.root=/opt/WebSphere/AppServer
java.io.tmpdir=/tmp
java.vendor.url.bug=
ibm.system.encoding=UTF-8
os.arch=x86
java.awt.graphicsenv=sun.awt.X11GraphicsEnvironment
ibm.websphere.preload.classes=true
java.ext.dirs=/opt/WebSphere/AppServer/java/jre/lib/ext
user.dir=/opt/WebSphere/AppServer
com.ibm.itp.location=/opt/WebSphere/AppServer/bin
line.separator=\n
java.vm.name=Classic VM
java.security.auth.login.config=/opt/WebSphere/AppServer/properties/wsjaas.conf
com.ibm.vm.bitmode=32
java.naming.provider.url=corbaloc\:rir\:/NameServiceServerRoot
file.encoding=UTF-8
java.specification.version=1.4
More information about the jcifs
mailing list