Win2K resetting connections. Is there a service pack?

[Richard Sharpe]

On Thu, 1 Aug 2002, Christopher R. Hertel wrote:

> On Fri, Aug 02, 2002 at 04:49:55AM +0930, Richard Sharpe wrote:
> :
> > It's the NegProt. Once the first NegProt is issued on any open TCP
> > connection, all the others get RSTs if they have not got past that point. 
> > It is bizare. They come from another planet, I tell you.
> 
> Odd.  Are these all connections from the same client?  If not, then it's 
> definitely a bug.  You'd have only one client able to connect at a time...

Oh, they are definitely all from the same client.

What is wierd is that it only affects 445. So, if I fire up 10 clients, 
they all connect quickly. One does a negprot, the others get RST. They 
they all reconnect on 139, go through their normal NetBIOS session setup, 
NegProts etc, and everyone is happy.
 
> If it only happens across multiple connections from the same client, then
> it makes a kind of twisted sense.  Microsoft may assume (since, as I
> understand it, their software works this way) that there will be only one
> TCP connection per SMB client system.  I think that the SMB session is 
> handled within the OS on Windows boxes, so only one TCP connection is 
> needed, and therefore only one NegProt will be sent.
> 
> I'm already several guesses deep, but if the server gets a new NegProt
> from the same client, it may assume that the other connections are now
> bogus.  W2K expects other Windows systems to be its clients, so it may
> also expect the clients to crash and be rebooted frequently.  Given those
> assumptions, it makes sense that a new NegProt would be taken by the
> server as a signal that the client was rebooted and the other connections
> should be dropped.
> 
> It's bogus, but it is the same kind of logic that is behind the VC=0
> reset.
> 
> I wonder what would happen if you simply didn't send the NegProt or 
> SessionSetup, and just started using a [V]UID from one of the other 
> sessions...  Ooohh.  Ouch.
> 
> Chris -)-----
> 
> 

-- 
Regards
-----
Richard Sharpe, rsharpe at ns.aus.com, rsharpe at samba.org, 
sharpe at ethereal.com