[Samba] smbclient on MacOS X via PPTP won't mount Win2k share

[Tobias Galitzien]

Hello!

Following situation:

A linux gateway with pptpd is connected via ethernet to a Win2k box. The
Win2k server's netbios and DNS name is "server".

Issuing a "smbclient //server/share" from the linux box works. I watched the
tcpdump output carefully to see what happens. The linux box ("promogate")
immediately sends this session request:

18:30:08.988555 192.168.1.254.2744 > 192.168.1.1.139: P [tcp sum ok] 1:77(76) ack 1 win 5840 <nop,nop,timestamp 371354769 0>
>>> NBT Packet
NBT Session Request
Flags=0x81000048
Destination=SERVER          NameType=0x20 (Server)
Source=PROMOGATE       NameType=0x00 (Workstation)
Data: (4 bytes)
[000] 00 00 00 00                                       \000\000\000\000 

and gets a positive answer back. As you can see, it uses "SERVER" as
destination which is the correct netbios name of the Win2k fileserver.

When I try the same with MacOS X via PPTP, it doesn't connect immediately on
port 139/TCP but first sends a node status request to the server and gets
back the following list of names (LOCALHOST is the AD domain name, it was
not my idea...):

18:38:27.823904 192.168.1.1.137 > 192.168.1.191.49267: [udp sum ok] 
>>> NBT UDP PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST
TrnID=0x1
OpCode=0
NmFlags=0x40
Rcode=0
QueryCount=0
AnswerCount=1
AuthorityCount=0
AddressRecCount=0

ResourceRecords:
Name=*               NameType=0x00 (Workstation)
ResType=0x21
ResClass=0x1
TTL=0 (0x0)
ResourceLength=263
ResourceData=
NumNames=0xC
Name=SERVER          NameType=0x00 (Workstation)	M <ACTIVE> 
Name=LOCALHOST       NameType=0x00 (Workstation)	<GROUP> M <ACTIVE> 
Name=LOCALHOST       NameType=0x1C (Unknown)	<GROUP> M <ACTIVE> 
Name=SERVER          NameType=0x20 (Server)	M <ACTIVE> 
Name=LOCALHOST       NameType=0x1B (Domain Controller)	M <ACTIVE> 
Name=LOCALHOST       NameType=0x1E (Browser Server)	<GROUP> M <ACTIVE> 
Name=SERVER          NameType=0x03 (Client?)	M <ACTIVE> 
Name=SERVER$         NameType=0x03 (Client?)	M <ACTIVE> 
Name=ADMINISTRATOR   NameType=0x03 (Client?)	M <ACTIVE> 
Name=LOCALHOST       NameType=0x1D (Master Browser)	M <ACTIVE> 
Name=
__MSBROWSE__ NameType=0x01 (Unknown)	<GROUP> M <ACTIVE> 
Name=Cls04011788541D NameType=0x20 (Server)	M <ACTIVE> 

As you can see here, the Win2k server sends two names of type 0x20, the
correct one (SERVER) and a weird one (Cls04011788541D). As it's clear to see
in the following session request of smbclient it chooses the wrong one:

18:38:28.085945 192.168.1.191.49183 > 192.168.1.1.139: P [tcp sum ok] 1:73(72) ack 1 win 65535 <nop,nop,timestamp 4192856581 0>
>>> NBT Packet
NBT Session Request
Flags=0x81000044
Destination=CLS04011788541D NameType=0x20 (Server)
Source=HAMMERBROOK     NameType=0x00 (Workstation)

and surely gets back a negative answer, because this is not at all the
correct netbios name of the Win2k server.

Why is this?
Why does MacOS X's smbclient ask a node status request prior to the session
request?
Why does the Win2k server give two names while one of them is clearly wrong?
Why does smbclient chose the wrong one?
What am I (or the software) doing wrong?

Hoping for ideas of you gurus, thanks for reading,
Tobias