[Samba] ignoring malformed3 datagram packet

[Thomas Schulz]

> On Fri, Apr 25, 2014 at 09:52:29PM -0400, Thomas Schulz wrote:
> > > On Fri, Apr 18, 2014 at 10:44:19AM +0200, samba.20.andwin at spamgourmet.com wrote:
> > > > Just for the record: After some investigation I've found out that
> > > > these malformed packages originate from a service called 'NuTCRACKER'
> > > > on the Windows clients which seems to be installed along with products
> > > > from PTC.
> > > 
> > > Hmmm. Sounds like an infection trying to exploit an
> > > old bug to me.
> > 
> > NuTCRACKER is a product that we use here. It allows programs that were
> > initally created on Unix to be more easily ported to Windows. It provides
> > an environment that looks much like Unix on a Windows machine.
> > 
> > Now that I look, I see those same messages here.
> 
> Can you get me a wireshark capture trace containing
> these packets ? Once I've seen that I can fix nmbd
> to treat them correctly.
> 
> Cheers,
> 
> 	Jeremy.

I should be able to do that. I see that my test server that has wireshark on
it is logging those messages. I will get to it as soon as I can.

Tom Schulz
Applied Dynamics Intl.
schulz at adi.com