[Samba] smbstatus, SWAT, etc. not displaying NetBIOS name for XP SP2 machines

[BJ Quinn]

Ok so here's something I figured out - if I block port 445 on the XP 
computers, then they show up correctly in smbstatus.  There's a comment 
in server.c about a set_remote_machine_name call that's needed to get 
"decent entries in smbstatus for port 445 computers".  Either that 
doesn't work, or I'm misunderstanding something.  Apparently WinXP sends 
out two requests for a connection to the samba server on ports 139 and 
445, one right after the other, and whichever one responds first is the 
one it uses.  I actually added "smb ports = 139" into my smb.conf on a 
different samba server (samba 3.0.23c) since I was getting all kinds of 
the following in my /var/log/messages :

Dec  3 04:18:42 foxserver3 smbd[3032]:   getpeername failed. Error was 
Transport
 endpoint is not connected
Dec  3 04:18:42 foxserver3 smbd[3032]: [2006/12/03 04:18:42, 0] 
lib/util_sock.c:
get_peer_addr(1229)

I saw somewhere that disabling connections from port 445 got rid of 
these errors, although they may have been benign.  I didn't really like 
having thousands of them filling up my logfiles, benign or not.  It in 
fact did suppress those messages, and my XP and 2000 boxes both seemed 
to be able to connect fine after setting "smb ports = 139".

So I imagine that I could do the same for this samba server that isn't 
correctly reporting NetBIOS names for connections on port 445.  What are 
the downsides disabling port 445 connections in smb.conf?  Firewalling 
port 445 on the XP box seems to create some slowdowns especially on 
bootup, although my current experience with disabling it on the samba 
side (on my 3.0.23c server) doesn't seem to cause trouble.  I'm sure M$ 
had their reasons for adding the extra port.  Are any of them good?  Am 
I going to cause any problems by ignoring port 445?  Or is there a fix 
for this on the samba side?  My current samba version on this server is 
3.0.10.

-BJ Quinn

BJ Quinn wrote:
> I'm trying to see what computer is accessing certain files through 
> samba, and the SWAT status page is a useful tool for that.  Problem is 
> that for some computers, only the IP address shows, not the NetBIOS 
> name.  This is only a problem with certain computers.  Since we're 
> using DHCP on many computers I don't always know off the top of my 
> head what computer has any given IP address.  We're not using DNS or 
> WINS, just good old NetBIOS resolution via broadcast or whatever.  I 
> think I've narrowed down the troublemaking computers to 5 or 6 of our 
> 40 computers and they all have one thing in common - they're XP 
> service pack 2.  (Ok well one of them is a Fedora 4 box not running a 
> samba service, so I'm not surprised.)  I've double checked that the XP 
> boxes are set to "hybrid" for node type, I've given them static IPs, 
> I've turned on the messaging service (apparently required in order for 
> them to respond to certain types of nmb lookups), and nmblookup -A [ip 
> address] does return the name of the computer from our samba server.  
> What am I doing wrong?  If nmblookup can find the name of the computer 
> based on the IP address, what is samba doing differently that it can't 
> find the name of these computers?  Thanks in advance for the help!
>
> -BJ Quinn
>