malformed broadcast packets?

[Jason Boles]

> I am still seeing nothing wrong with the packets in this capture.  The things
> that confuse me are:
> 
> 1) SonicWall reports problems every 15 minutes, but the name queries are 5
>   minutes apart, not 15.  They're also identical.
 
The sonicwall log (on the device) gets every single one, every 5
minutes (12 minutes for port 138).  The sonicwall email alerter only
sends an email every 15 minutes, and only for port 137.  So those are
both oddities.


> 2) I don't see anything wrong with any of these packets.
> 
> > It could be related to using security = DOMAIN now, whereas before
> > (before OS upgrade) I was using security = USER.
> 
> Possibly, but I'm not seeing any packet that would be related to that change.
> These are all very normal.

Yeah, I had to revert from security = ADS to security = DOMAIN, as
with ADS, some machines could map, and others couldn't - though their
network config was identical.  I've seen similar problems reported
with the PDC as win2K3 (like ours), and even though kerberos worked
fine, samba didn't.

-Jason