[Samba] ignoring malformed3 datagram packet

[Jeremy Allison]

On Tue, Apr 15, 2014 at 08:21:08PM +0200, samba.20.andwin at spamgourmet.com wrote:
> Hi,
> after quite some testing I do now have my Samba4 setup in production
> use. The setup mainly consists of an AD-Controller and an AD Member
> Server which provides file shares to about 20 Windows 7 clients.
> Everything is working well so far except for two somewhat 'special'
> clients. For these I observe the following:
> 
> 1) On the AD Member Server periodically (every hour) appears a message
> in log.nmbd similar to the following for each of the two clients:
> 
> [2014/04/15 13:47:46,  0] ../source3/nmbd/nmbd_packets.c:1289(process_dgram)
>   process_dgram: ignoring malformed3 (datasize = 494, len=408,
> off=100) datagram packet sent to name MYDOM<00> from IP 192.168.0.107

This is giving notice that someone sent an invalid, potentially
dangerous packet from that IP address.

        if ((buf2 + len < dgram->data) || (buf2 + len > dgram->data + dgram->datasize)) {
                DEBUG(0,("process_dgram: ignoring malformed3 (datasize = %d, len=%d, off=%d) datagram \
packet sent to name %s from IP %s\n",

This might be an attack, or an error in the client.
Investigate... Maybe a virus ?

Jeremy.