[Samba] Who or what is IP client 0.0.0.0?

[James Peach]

On 1/15/06, taso <ahg4 at aanet.com.au> wrote:
> Samba 3.0.21a
>
> Getting a fair bit of activity logged from IP 0.0.0.0
> What does it mean?
>
> [2006/01/14 13:42:23, 0] lib/util_sock.c:get_peer_addr(1222)
>    getpeername failed. Error was Transport endpoint is not connected
> [2006/01/14 13:42:23, 0] lib/access.c:check_access(328)
> [2006/01/14 13:42:23, 0] lib/util_sock.c:get_peer_addr(1222)
>    getpeername failed. Error was Transport endpoint is not connected
>    Denied connection from  (0.0.0.0)
> [2006/01/14 13:42:23, 1] smbd/process.c:process_smb(1187)
> [2006/01/14 13:42:23, 0] lib/util_sock.c:get_peer_addr(1222)
>    getpeername failed. Error was Transport endpoint is not connected
>    Connection denied from 0.0.0.0
> [2006/01/14 13:42:23, 0] lib/util_sock.c:write_data(554)
>    write_data: write failure in writing to client 0.0.0.0. Error Connection reset by peer
> [2006/01/14 13:42:23, 0] lib/util_sock.c:send_smb(762)
>    Error writing 5 bytes to client. -1. (Connection reset by peer)
> [2006/01/14 13:54:23, 0] lib/util_sock.c:get_peer_addr(1222)

0.0.0.0 is not the address of any client. This log snippet shows that
smbd is calling the getpeername function to retrieve the IP address
of the client. This fails because the client has already disconnected
(this is what "transport endpoint is not connected" means).

So, you have one or more clients on your network that disconnects from the
server unexpectedly. You might be able to track them down by increasing
the log level.

--
James Peach | jorgar at gmail.com