[Samba] Nmbd is using the wrong ip address as source

Mon Oct 6 06:05:04 GMT 2008

Hello,

Sorry for seeming impatient, I just had some rough night hours because of this problem :)

tcpdump shows:
08:21:22.920832 IP X.X.X.X.netbios-dgm > 10.10.10.255.netbios-dgm: NBT UDP PACKET(138)
08:21:22.920986 IP X.X.X.X.netbios-dgm > 10.10.10.255.netbios-dgm: NBT UDP PACKET(138)
08:21:23.072063 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:23.072069 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:23.072073 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:23.072076 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:23.072079 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:24.072491 IP X.X.X.X.netbios-dgm > 10.10.10.255.netbios-dgm: NBT UDP PACKET(138)
08:21:24.072497 IP X.X.X.X.netbios-dgm > 10.10.10.255.netbios-dgm: NBT UDP PACKET(138)
08:21:24.072656 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST
08:21:25.073432 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:25.073438 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
08:21:25.073441 IP X.X.X.X.netbios-ns > 10.10.10.255.netbios-ns: NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST

( where X.X.X.X is the public ip address of the linux server from eth0 ), this tcpdump was taken from another linux machine with the
ip: 10.10.10.2

The requested netstat output:

[root at ns ~]# netstat -nap |grep [sn]mbd
tcp        0      0 10.10.10.1:139              0.0.0.0:*                   LISTEN      18538/smbd
tcp        0      0 10.10.10.1:445              0.0.0.0:*                   LISTEN      18538/smbd
udp        0      0 10.10.10.1:137              0.0.0.0:*                               18542/nmbd
udp        0      0 10.10.10.255:137            0.0.0.0:*                               18542/nmbd
udp        0      0 10.10.10.1:138              0.0.0.0:*                               18542/nmbd
udp        0      0 10.10.10.255:138            0.0.0.0:*                               18542/nmbd
unix  2      [ ]         DGRAM                    194986 18542/nmbd
unix  2      [ ]         DGRAM                    194960 18538/smbd

nmblookup from both machines returns this:
querying server on 10.10.10.255
name_query failed to find name server

Right now there are no PCs open in the network, but friday when I was testing various configurations,
I was able to see that one of the XP machines reported back as master browser ( I could see the share list
with _MSBROWSE_ as well. )

However if I do a unicast request to 10.10.10.1 ( basically it acts as a wins server ): 
querying HDV on 10.10.10.1
10.10.10.1 HDV<00>

In the nmbd.log I have:

[2008/10/06 08:52:50, 0] nmbd/nmbd.c:main(698)
  Netbios nameserver version 3.0.28-1.el5_2.1 started.
  Copyright Andrew Tridgell and the Samba Team 1992-2007
[2008/10/06 08:52:51, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_bcast(290)
  become_domain_master_browser_bcast:
  Attempting to become domain master browser on workgroup HOSTNAME on subnet 10.10.10.1
[2008/10/06 08:52:51, 0] nmbd/nmbd_become_dmb.c:become_domain_master_browser_bcast(303)
  become_domain_master_browser_bcast: querying subnet 10.10.10.1 for domain master browser on workgroup HOSTNAME
[2008/10/06 08:53:01, 0] nmbd/nmbd_become_dmb.c:become_domain_master_stage2(113)
  *****

  Samba server HNS is now a domain master browser for workgroup HOSTNAME on subnet 10.10.10.1

  *****
[2008/10/06 08:53:15, 0] nmbd/nmbd_become_lmb.c:become_local_master_stage2(396)
  *****

  Samba name server HNS is now a local master browser for workgroup HOSTNAME on subnet 10.10.10.1

  *****

Thank you for your time!

Teodor

  _____  

From: Frank Gruman [mailto:fgatwork at verizon.net] 
Sent: Sunday, October 05, 2008 10:28 PM
To: Teodor Iacob
Cc: samba at lists.samba.org
Subject: RE: [Samba] Nmbd is using the wrong ip address as source

On Sun, 2008-10-05 at 18:35 +0300, Teodor Iacob wrote: 

Does anybody have a suggestion for another list or forum to address

this issue?

> -----Original Message-----

> From: Teodor Iacob 

> Sent: 4 octombrie 2008 09:14

> To: samba at piven.org; samba at lists.samba.org

> Subject: RE: [Samba] Nmbd is using the wrong ip address as source

> 

>  

> 

> > -----Original Message-----

> > From: samba-bounces+theo=macsys.eu at lists.samba.org

> > [mailto:samba-bounces+theo=macsys.eu at lists.samba.org] On Behalf Of 

> > samba at piven.org

> > Sent: Saturday, October 04, 2008 4:41 AM

> > To: samba at lists.samba.org

> > Subject: Re: [Samba] Nmbd is using the wrong ip address as source

> > 

> > Teodor Iacob wrote:

> > > Hello,

> > > 

> > > I have a linux box with the following S/W versions:

> > > CentOS release 5.2 (Final)

> > > Linux ns.hostname.ro 2.6.18-92.1.13.el5 #1 SMP Wed Sep 24

> > 19:32:05 EDT 2008 x86_64 x86_64 x86_64 GNU/Linux

> > > Version 3.0.28-1.el5_2.1

> > > 

> > > My server has 2 IP interfaces, eth0: with the public ip

> > address and br0: for the private subnet.

> > > Br0 being a bridge ip interface between eth1 and tap0 ( for

> > openvpn ).

> > > 

> > > Now my problem is that the nmbd is doing the netbios

> > broadcasts using the eth0 ip address instead

> > > of the br0 one. I'm only interested in enabling samba on

> > the local network (br0). I have checked

> > > this by using tcpdump on another linux machine in the

> > network and saw the broadcasts with the source

> > > address the eth0 ip. Nmbd claims to win the master browsing

> > election, but in reality the windows machines

> > > ignore the election packets and another machine becomes

> > master and the browsing list is messed up..

> > > The smbd works just fine, connecting to the shares manually

> > works correctly.

> > > 

> > > How can I make nmbd to use the correct ip address? ( btw, I

> > removed the bridge config just for testing

> > > and only enabled ip on the eth1 and the same problem.. ). I

> > saw that in the previous version there was

> > > a parameter "-I" to force the source address..

> > > 

> > > For reference this is my smb.conf:

> > > [global]

> > >         workgroup = HOSTNAME

> > >         netbios name = HNS

> > >         interfaces = 10.10.10.1 127.0.0.1

> > 

> > ... why not just say "interfaces = br0" so that it binds to your 

> > private interface (which I presume owns 10.10.10.1)?  You 

> don't need 

> > to have Samba listen on the loopback address if you can 

> talk to it on 

> > another local address.

> 

> I mentioned also br0 in my quest of trying all possibilities 

> I could think of.. No change.

> But bind is only for listening, my problem is when nmbd it 

> sends packets by itself to make the election. I told you smbd 

> works fine and I can see from netstat -an at the LISTEN part 

> that it was only bound to the 10.10.10.1:139 and 10.10.10.1:445

> 

> 

> > 

> > >         hosts allow = 127.0.0., 10.10.10.

> > >         bind interfaces only = yes

> > [snip]

> > >         remote announce = 10.10.10.255/HOSTNAME

> > >         socket address = 10.10.10.1

> > 

> > Don

First of all, thank you for your patience on volunteer attempts to help you resolve your issue (considering it is still the weekend
in much of the world).

Now, can you include a portion of the tcpdump you viewed from the other machine (particularly the part where the wrong address is
appearing).  Also, I am assuming you have restarted both smbd and nmbd after each configuration change.

To verify that your samba settings are being read properly, try to run "netstat -nap |grep [sn]mbd" to see which ports are open on
your local machine.  Also, try running "nmblookup -B 10.10.10.255 server" to ensure that nmbd is responding to name server queries
on the broadcast address.

I Googled a moment, and came up with much of the above from her - http://samba.org/~tpot/articles/multiple-interfaces.html

Let us know how it goes.

Regards,
Frank 

__________ Information from ESET NOD32 Antivirus, version of virus signature database 3492 (20081003) __________

The message was checked by ESET NOD32 Antivirus.

http://www.eset.com