SAMLOGON UDP request

[Luke Kenneth Casson Leighton]

On Mon, 14 Dec 1998, Jean Francois Micouleau wrote:

> 
> 
> On Mon, 14 Dec 1998, Andrej Borsenkow wrote:
> 
> > > the request already has the domain name built in, and we check it.
> > 
> > Do you mean SAMLOGON? I have not seen any domain name there and I don't see
> 
> There is no domain name in the trace you provided, but the SAMLOGON
> request is directed to the PDC, check the Dest Addr of the request packet.

not necessarily.

it is actually sent, by broadcast, to DOMAIN_NAME<00>, DOMAIN_NAME<1c> 
and only by unicast to DOMAIN_NAME<1b>.  check the cifs documentation,
it's in there.