malformed broadcast packets?

Jason Boles threepercentmilk at gmail.com
Thu Jul 8 00:17:13 GMT 2004


Sorry for the delay fellas,

I got some captured packets from tcpdump, see the file attached.

One thing I found (which is odd) is that the sonicwall only sent me
alerts every 15 minutes (and only 137), whereas the log in the
sonicwall lists malformed packets every 5 minutes for 137, and every
12 minutes for port 138 (both UDP).


-Jason



On Wed, 7 Jul 2004 16:44:08 -0500, Christopher R. Hertel
<crh at ubiqx.mn.org> wrote:
> On Wed, Jul 07, 2004 at 02:03:44PM -0700, Richard Sharpe wrote:
> > On Wed, 7 Jul 2004, Jason Boles wrote:
> >
> > >   I recently upgraded to Redhat AS3 from an older 7.3 installation.
> > > With samba 3 (3.0.2-6.3E is the rpm version), I've been seeing
> > > activity that wasn't present before.
> > >
> > > Every 15 minutes (within a few seconds accuracy), I receive an alert
> > > from our SonicWall (firewall appliance) reporting that a "Malformed IP
> > > packet dropped." where the source was the upgraded server, and the
> > > destination was the subnet (x.y.z.255).  Src & Dest port was 137.
> > >
> > > So what is smbd or nmbd (or maybe winbindd) transmitting every 15 minutes ?
> > >
> > > There is nothing in the logs corresponding to those timestamps, or to
> > > indicate that there is another source for this.
> > >
> > > (turning off sonicwall alerts is not an option)
> > >
> > > all of the samba clients are win2k/XP and on the same subnet as the
> > > server.  It's setup for security = DOMAIN, with another Windows Server
> > > 2003 box as the domain controller (also on the same subnet, behind the
> > > same firewall).
> >
> > What would really help is a capture of the offending packets. Perhaps you
> > could run tcpdump on your Samba server capturing the port 137 packets or
> > something like that.
> 
> Capture both 137 and 138 (UDP).  There's nothing that would cause the name
> service to broadcast a message every 15 minutes (nothing I can think of
> off hand) but the Browse Service does have something that runs on a 15
> minute clock.  The Browse Service activity probably triggers name service
> lookups.
> 
> Chris -)-----
> 
> --
> "Implementing CIFS - the Common Internet FileSystem" ISBN: 013047116X
> Samba Team -- http://www.samba.org/     -)-----   Christopher R. Hertel
> jCIFS Team -- http://jcifs.samba.org/   -)-----   ubiqx development, uninq.
> ubiqx Team -- http://www.ubiqx.org/     -)-----   crh at ubiqx.mn.org
> OnLineBook -- http://ubiqx.org/cifs/    -)-----   crh at ubiqx.org
>
-------------- next part --------------

anonymized via name replacements:

sambaserver.mydomain.com	= fqdn of server (where mydomain.com is ADS domain)
MYDOMAIN					= netbios domain name
SAMBASERVER					= netbios machine name
1.2.3.x						= IP of server

----------------------------------------------
tcpdump -vvv -x -X "(port 137 or 138) and dst 1.2.3.255 and src sambaserver"
-------------------- log below ---------------


19:37:03.910166 sambaserver.mydomain.com.netbios-ns > 1.2.3.255.netbios-ns: [udp sum ok] 
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
TrnID=0x6C4C
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=MYDOMAIN        NameType=0x1D (Master Browser)
QuestionType=0x20
QuestionClass=0x1

 (DF) [ttl 0] (id 864, len 78)
0x0000	 4500 004e 0360 4000 0011 b702 888e 5721	E..N.`@.......W!
0x0010	 888e 57ff 0089 0089 003a 4d66 6c4c 0110	..W......:MflL..
0x0020	 0001 0000 0000 0000 2045 4c45 4646 4a46	.........ELEFFJF
0x0030	 4446 4545 5045 4f45 4643 4143 4143 4143	DFEEPEOEFCACACAC
0x0040	 4143 4143 4143 4142 4e00 0020 0001     	ACACACABN.....
________________________________________________________________________________

19:42:12.220209 sambaserver.mydomain.com.netbios-ns > 1.2.3.255.netbios-ns: [udp sum ok] 
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
TrnID=0x6C4D
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=MYDOMAIN        NameType=0x1D (Master Browser)
QuestionType=0x20
QuestionClass=0x1

 (DF) [ttl 0] (id 865, len 78)
0x0000	 4500 004e 0361 4000 0011 b701 888e 5721	E..N.a at .......W!
0x0010	 888e 57ff 0089 0089 003a 4d65 6c4d 0110	..W......:MelM..
0x0020	 0001 0000 0000 0000 2045 4c45 4646 4a46	.........ELEFFJF
0x0030	 4446 4545 5045 4f45 4643 4143 4143 4143	DFEEPEOEFCACACAC
0x0040	 4143 4143 4143 4142 4e00 0020 0001     	ACACACABN.....
________________________________________________________________________________

19:47:18.940213 sambaserver.mydomain.com.netbios-ns > 1.2.3.255.netbios-ns: [udp sum ok] 
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
TrnID=0x6C4E
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=MYDOMAIN        NameType=0x1D (Master Browser)
QuestionType=0x20
QuestionClass=0x1

 (DF) [ttl 0] (id 866, len 78)
0x0000	 4500 004e 0362 4000 0011 b700 888e 5721	E..N.b at .......W!
0x0010	 888e 57ff 0089 0089 003a 4d64 6c4e 0110	..W......:MdlN..
0x0020	 0001 0000 0000 0000 2045 4c45 4646 4a46	.........ELEFFJF
0x0030	 4446 4545 5045 4f45 4643 4143 4143 4143	DFEEPEOEFCACACAC
0x0040	 4143 4143 4143 4142 4e00 0020 0001     	ACACACABN.....
________________________________________________________________________________

19:47:46.273838 sambaserver.mydomain.com.netbios-dgm > 1.2.3.255.netbios-dgm: 
>>> NBT UDP PACKET(138) Res=0x110A ID=0x6C4F IP=1 (0x01).2 (0x02).3 (0x03).x (0xXX) Port=138 (0x8a) Length=197 (0xc5) Res2=0x0
SourceName=SAMBASERVER            NameType=0x00 (Workstation)
DestName=
WARNING: Short packet. Try increasing the snap length

 (DF) [ttl 0] (id 292, len 239)
0x0000	 4500 00ef 0124 4000 0011 b89d 888e 5721	E....$@.......W!
0x0010	 888e 57ff 008a 008a 00db aeb1 110a 6c4f	..W...........lO
0x0020	 888e 5721 008a 00c5 0000 2045 4b45 4246	..W!.......EKEBF
0x0030	 4745 4243 4143 4143 4143 4143 4143 4143	GEBCACACACACACAC
0x0040	 4143 4143 4143 4143 4141 4100 2045 4c45	ACACACACAAA..ELE
0x0050	 4646                                   	FF
________________________________________________________________________________

19:52:23.140215 sambaserver.mydomain.com.netbios-ns > 1.2.3.255.netbios-ns: [udp sum ok] 
>>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
TrnID=0x6C50
OpCode=0
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=0
QuestionRecords:
Name=MYDOMAIN        NameType=0x1D (Master Browser)
QuestionType=0x20
QuestionClass=0x1

 (DF) [ttl 0] (id 867, len 78)
0x0000	 4500 004e 0363 4000 0011 b6ff 888e 5721	E..N.c at .......W!
0x0010	 888e 57ff 0089 0089 003a 4d62 6c50 0110	..W......:MblP..
0x0020	 0001 0000 0000 0000 2045 4c45 4646 4a46	.........ELEFFJF
0x0030	 4446 4545 5045 4f45 4643 4143 4143 4143	DFEEPEOEFCACACAC
0x0040	 4143 4143 4143 4142 4e00 0020 0001     	ACACACABN.....


More information about the samba-technical mailing list