query_name_response: Multiple responses received

[Robert Dahlem]

Mac,

On Wed, 16 Aug 2000 09:52:24 +0100 (BST), Mac wrote:

>I'm still not clear on the original point though.

>For the dual homed (and additional virtual interfaces) machine, 
>surely the nmbd is samrt enough only to send out any given response 
>packet onto any given subnet exactly once, no matter how many 
>interfaces it has open to it?  To do otherwise is surely nonsense.

Ok.

>So, assuming it _is_ doing that, where is the extraneous response 
>coming from?

It comes from the extraneous request nmbd receives. :-)

Assume box A has two interfaces and box B has one interface, both in
the same physical networks, but only one of A in the same logical
network with B. Box B brodcasts a name query. In a class B network
1.2.0.0 this would be addressed to 1.2.255.255 at the IP layer and to
ff:ff:ff:ff:ff:ff at the MAC layer.

Further assume both boxes are connected through a single switch. The
packet arrives at the switch. Because it is addressed to the broadcast
MAC address, the switch has no way to decide on which (single) port to
spit it out, so it goes out to all ports. Box A now on wondrous wise
receives two packets were only one packet has been sent from box B.
Same goes for hubs (they will always let all packets out on all ports)
but I think, the switch model makes it clearer.

Well, you could say, nmbd has two feet in the physical network, one in
logical network 1.2, the other in the logical network (lets say) 3.4.
So why should interface 3.4.x.x answer to requests to 1.2.255.255?
Shouldn't it really know it can't be meant?

I think this has to do with nmbd being not unnecessarily silent to
stations in other logical networks probably behind routers. A stroll
through the sources may give an authoritative answer. :-)

>With two subnets on the same wire, a machine in only one of the 
>subnets with a lousy IP stack might see the broadcasts from the other 
>subnet, and log them  (older versions of SunOS did this) but even 
>this doesn't explain why two identical packets arrive.

I don't think broadcasts from another logical net are suppressed at the
kernel level. I can see such packets with tcpdump on a Linux machine
and most people won't argue Linux has a lousy IP stack.

With "netstat -an" I can see nmbd listens with "*.137", so no way for
the kernel to decide "nmbd should not see that packet".

>The dual-homed machine must have sent two identical packets, 

_nearly_ identical.

>_on_the_same_subnet_, and it's this behaviour that I can't fathom.

It has and I think its ok to do so ... the switch "doubled" the request
packet.

Regards,
        Robert

---------------------------------------------------------------
Robert.Dahlem at gmx.net
Radio Bornheim - 2:2461/332 at fidonet +49-69-4930830  (ZyX, V34)
                 2:2461/326 at fidonet +49-69-94414444 (ISDN X.75)
---------------------------------------------------------------