Can't see network neighbourhood

Joel Hammer jhammer2 at
Sun Oct 28 05:23:04 GMT 2001

> 17:21:20.937587 < coo.localdomain.1028 > posh.localdomain.netbios-ssn: S 1394810:1394810(0) win 8192 <mss 1460> (DF)
> 17:21:20.937587 > posh.localdomain > coo.localdomain: icmp: posh.localdomain tcp port netbios-ssn unreachable (DF) [tos 0xc0] 

It is easier to sort out what tcpdump is trying to say if you use the -n
It looks to me as though:
1.  coo can find posh and send packets to it.
2.  posh can find coo
3.  posh can't send packets to coo on its port 139.
The cryptic note with icmp means, just guessing here, that posh can't talk
to the netbios-ssn port on the windows machine.
This may be a windows problem. Have you got a firewall on the windows
With nmap, here is what I see when I scan my windows clients.

Interesting ports on (
(The 1521 ports scanned but not shown below are in state: closed)
Port       State       Service
135/tcp    open        loc-srv
139/tcp    open        netbios-ssn

You might get a copy of nmap and scan your windows box.
(And yes, I am surprised that port 137 isn't open, but, what do I know about
windows networking! I guess the windows clients don't offer nmbd type
As for the rest of the tcpdump output, it is hard for me to understand it
because of the admixture of hostnames and ipnumbers. The -n switch will fix
that. I also don't know the name/ip of your internet interface device.
As far as using the dns, this is complicated by the dynamic assignment of ip
numbers from your internet device. I just don't know how that is configured.
Does is always supply coo and posh the same ip number? That might not
matter, but it is a nagging thought.
I would work on the port problem on the windows machine first,though.
And, you do have a good firewall you understand on the internet network
device? Otherwise, everybody might be able to mount your shared windows

More information about the samba mailing list