Is it possible to clear a Windows LMB cache?
David Wuertele
dave-gnus at bfnet.com
Wed Nov 5 20:40:49 GMT 2003
CH> Love to hear the results.
I thought of an easier way to clear the cache. I shut down my entire
LAN, created four new vmware windows instances, configured DHCP to
give them H,B,P,M status respectively, then booted these virgin
windows systems while capturing. Since tethereal's interface is
connected to a switch, I only saw broadcast packets and non-broadcast
packets directed to that interface (which hosts the configured gateway
for the subnet as well as the DHCP server).
The complete mind-numbing capture is included below, but the
interesting stuff is in the following four frames:
287 642.104774 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation
288 642.123405 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation, Potential Browser
289 642.125821 192.168.5.233 -> 192.168.5.255 BROWSER Request Announcement
445 1121.986560 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation, Potential Browser
These frames are examples of a Peer-to-Peer host announcing itself to
the subnet broadcast IP address. Just to make sure it is
Peer-to-Peer, I ran ipconfig /all on 192.168.5.233:
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\dave>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : b3-XP-3
Primary Dns Suffix . . . . . . . : rokutest
Node Type . . . . . . . . . . . . : Peer-Peer
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : rokutest
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . : localdomain
Description . . . . . . . . . . . : AMD PCNET Family PCI Ethernet Adapter
Physical Address. . . . . . . . . : 00-50-56-31-03-03
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.5.233
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.5.1
DHCP Server . . . . . . . . . . . : 192.168.5.1
DNS Servers . . . . . . . . . . . : 192.168.0.10
Primary WINS Server . . . . . . . : 192.168.5.101
Lease Obtained. . . . . . . . . . : Wednesday, November 05, 2003 11:40:14 AM
Lease Expires . . . . . . . . . . : Wednesday, November 05, 2003 11:40:14 PM
C:\Documents and Settings\dave>net view
Server Name Remark
-------------------------------------------------------------------------------
\\B1-XP-3 b1-XP-3
\\B2-XP-3 b2-XP-3
\\B3-XP-3 b3-XP-3
\\B4-XP-3 b4-XP-3
The command completed successfully.
C:\Documents and Settings\dave>
Notice that the entire browse list is available to this P node:
B1-XP-3 is an H node, B2-XP-3 is a B node, B3-XP-3 is this P node, and
B4-XP-3 is an M node. The EXACT SAME browse list is displayed when I
run net view on the other three hosts.
Now, for your mind-numbing pleasure, here is the entire tethereal
trace. For the "tethereal -V -x" version (its huge! 2.14MB!), please
visit this web page:
http://www.bfnet.com/ptest-verbose.txt
First, I started tethereal like this:
tethereal -i eth1 -w trace -f "not src port 22 and not dst port 22"
Before booting anything, I saw some noise from two PCs that are also
on the test LAN:
1 0.000000 192.168.5.11 -> 192.168.0.13 NBNS Name query NB TSWG<1b>
2 0.000919 192.168.0.13 -> 192.168.5.11 NBNS Name query response NB 192.168.0.10
In the captures that follow, I will be deleting all records that come
from hosts 192.168.5.11 and 192.168.0.13, since they are unrelated to
this test.
Next, I turned on the Samba WINS server, which is host 192.168.5.101
and saw this:
3 24.114724 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<20>
4 24.114769 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<03>
5 24.114796 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<00>
6 24.114834 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<00>
7 24.114862 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<1e>
8 24.115359 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
9 26.107753 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<20>
10 26.107757 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<03>
11 26.107801 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<00>
12 26.107831 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<1e>
13 26.107805 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<00>
14 26.107896 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<20>
15 26.107898 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<03>
16 26.107935 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<00>
17 26.107938 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<00>
18 26.107974 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<1e>
19 28.107467 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<20>
20 28.107471 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<03>
21 28.107516 192.168.5.101 -> 192.168.5.255 NBNS Registration NB RH9BOX1<00>
22 28.107551 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<1e>
23 28.107521 192.168.5.101 -> 192.168.5.255 NBNS Registration NB NOWORKGROUP<00>
24 31.051815 192.168.5.101 -> 192.168.0.10 DNS Standard query A rh9box1.localdomain
25 31.052666 192.168.0.10 -> 192.168.5.101 DNS Standard query response A 192.168.5.101
26 31.064052 192.168.5.101 -> 192.168.0.10 DNS Standard query A rh9box1.localdomain
27 31.064893 192.168.0.10 -> 192.168.5.101 DNS Standard query response A 192.168.5.101
Next, I turned on the first Windows XP Pro, which is configured via
DHCP to get address 192.168.5.231 and Mode H.
28 68.696018 0.0.0.0 -> 255.255.255.255 DHCP DHCP Discover - Transaction ID 0xfc07d724
29 68.696354 192.168.5.1 -> 192.168.5.231 DHCP DHCP Offer - Transaction ID 0xfc07d724
30 68.701655 0.0.0.0 -> 255.255.255.255 DHCP DHCP Request - Transaction ID 0xfc07d724
31 68.701848 192.168.5.1 -> 192.168.5.231 DHCP DHCP ACK - Transaction ID 0xfc07d724
32 68.718146 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.231
33 69.405268 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.231
34 70.409150 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.231
35 73.003303 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.231
36 73.850480 192.168.5.231 -> 192.168.5.255 BROWSER Host Announcement B1-XP-3, Workstation, Server, NT Workstation
37 73.893451 192.168.5.231 -> 192.168.5.255 BROWSER Host Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser
38 73.895794 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
39 75.362680 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
40 76.900929 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
41 78.410736 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
42 88.061668 192.168.5.231 -> 192.168.5.255 BROWSER Browser Election Request
43 88.979570 192.168.5.231 -> 192.168.5.255 BROWSER Browser Election Request
44 88.980252 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
45 89.999046 192.168.5.231 -> 192.168.5.255 BROWSER Browser Election Request
46 90.968891 192.168.5.231 -> 192.168.5.255 BROWSER Browser Election Request
47 91.983763 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
48 91.984118 192.168.5.231 -> 192.168.5.255 BROWSER Request Announcement
49 91.987272 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
50 92.048296 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
51 92.798322 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
52 93.558224 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
53 94.357879 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
54 95.117684 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
57 95.827830 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
58 110.876972 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
59 131.636118 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.231
60 131.636191 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
61 131.636517 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA b1-XP-3.tswgtest
62 131.824217 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
63 131.827720 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA tswgtest
64 131.828561 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
65 136.818663 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP Who has 192.168.5.231? Tell 192.168.5.1
66 136.819263 VMware_31:01:03 -> Tyan_Com_27:66:5b ARP 192.168.5.231 is at 00:50:56:31:01:03
67 146.589146 192.168.5.1 -> 192.168.5.255 BROWSER Host Announcement RAVE, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
68 151.992283 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
69 181.169430 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
114 211.952819 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
115 211.953610 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
118 313.011041 192.168.5.231 -> 192.168.5.255 BROWSER Get Backup List Request
119 313.011554 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.231
120 313.044893 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
121 313.795171 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
122 314.555076 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
123 334.551564 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
124 336.551200 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
125 336.551265 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
126 337.126055 Tyan_Com_27:66:5b -> Jetway_I_56:70:52 ARP Who has 192.168.5.103? Tell 192.168.5.1
127 337.126190 Jetway_I_56:70:52 -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
128 337.846230 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
129 337.846369 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
130 338.550896 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
131 338.551005 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
132 338.551239 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB RAVE<00>
133 338.551279 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB RAVE<00>
134 338.551298 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB RAVE<00>
135 338.551318 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB RAVE<00>
136 338.551336 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB RAVE<03>
137 338.551351 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB RAVE<03>
138 338.551367 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB RAVE<03>
139 338.551401 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB RAVE<03>
140 338.551416 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB RAVE<20>
141 338.551431 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB RAVE<20>
142 338.551445 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB RAVE<20>
143 338.551460 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB RAVE<20>
144 338.551477 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
145 338.551493 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
146 338.551508 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
147 338.551523 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
148 338.551542 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
149 338.551560 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
150 338.551577 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
151 338.551593 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
152 338.552043 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
153 338.552102 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
154 338.552144 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
155 338.552184 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
156 338.552236 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
157 338.552276 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
158 338.552323 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
159 338.552361 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
160 338.552407 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
161 338.552453 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
162 338.552492 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
163 338.552532 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
164 338.552589 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
165 338.552636 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
166 338.552676 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
167 338.552721 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
168 338.552767 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
169 338.552812 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
170 338.552853 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
171 338.552892 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
172 348.722548 192.168.5.102 -> 192.168.0.10 DNS Standard query A rh9box2.localdomain
173 348.723969 192.168.0.10 -> 192.168.5.102 DNS Standard query response A 192.168.5.102
174 348.761324 192.168.5.102 -> 192.168.0.10 DNS Standard query A rh9box2.localdomain
175 348.762216 192.168.0.10 -> 192.168.5.102 DNS Standard query response A 192.168.5.102
Next, I turned on the second Windows XP Pro, which is configured via
DHCP to get address 192.168.5.232 and Mode B.
176 388.652864 0.0.0.0 -> 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x7757f328
177 388.653187 192.168.5.1 -> 192.168.5.232 DHCP DHCP Offer - Transaction ID 0x7757f328
178 388.658635 0.0.0.0 -> 255.255.255.255 DHCP DHCP Request - Transaction ID 0x7757f328
179 388.658905 192.168.5.1 -> 192.168.5.232 DHCP DHCP ACK - Transaction ID 0x7757f328
180 388.816901 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.232? Tell 192.168.5.232
181 388.935690 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.232? Tell 192.168.5.232
182 389.945102 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.232? Tell 192.168.5.232
183 391.041677 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<00>
184 391.824872 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<00>
185 391.825495 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
186 392.584781 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<00>
187 393.304605 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<00>
188 394.148340 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<00>
189 394.894833 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<00>
190 395.624069 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<00>
191 396.394082 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<00>
192 397.394611 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<03>
193 397.973844 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<20>
194 398.199672 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<03>
195 398.573568 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<20>
196 398.853853 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<03>
197 399.286531 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<20>
198 399.599564 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<03>
199 400.036748 192.168.5.232 -> 192.168.5.255 NBNS Registration NB B2-XP-3<20>
200 400.802448 192.168.5.232 -> 192.168.5.255 BROWSER Host Announcement B2-XP-3, Workstation, Server, NT Workstation
201 400.904726 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<1e>
202 401.652071 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<1e>
203 401.739508 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.232
204 401.739570 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
205 401.740832 192.168.5.232 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
206 401.740907 192.168.5.1 -> 192.168.5.232 ICMP Destination unreachable
207 401.743337 192.168.5.232 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
208 401.743351 192.168.5.1 -> 192.168.5.232 ICMP Destination unreachable
209 402.007408 192.168.5.232 -> 192.168.5.255 NBNS Registration NB DAVE<03>
210 402.422945 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<1e>
211 402.772767 192.168.5.232 -> 192.168.5.255 NBNS Registration NB DAVE<03>
212 403.145097 192.168.5.232 -> 192.168.5.255 NBNS Registration NB WG1<1e>
213 403.494757 192.168.5.232 -> 192.168.5.255 NBNS Registration NB DAVE<03>
214 403.933271 192.168.5.232 -> 192.168.5.255 BROWSER Request Announcement
215 403.936226 192.168.5.232 -> 192.168.5.255 BROWSER Host Announcement B2-XP-3, Workstation, Server, NT Workstation, Potential Browser
216 403.945472 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
217 404.243066 192.168.5.232 -> 192.168.5.255 NBNS Registration NB DAVE<03>
218 404.741276 192.168.5.232 -> 224.0.0.22 IGMP V3 Membership Report
219 404.777506 192.168.5.232 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
220 405.448971 192.168.5.232 -> 224.0.0.22 IGMP V3 Membership Report
221 406.732531 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP Who has 192.168.5.232? Tell 192.168.5.1
222 406.733836 VMware_31:02:03 -> Tyan_Com_27:66:5b ARP 192.168.5.232 is at 00:50:56:31:02:03
223 407.792404 192.168.5.232 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
224 408.109362 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.231
225 408.109392 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
226 408.109868 192.168.5.231 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
227 408.109933 192.168.5.1 -> 192.168.5.231 ICMP Destination unreachable
228 408.112531 192.168.5.231 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
229 408.112547 192.168.5.1 -> 192.168.5.231 ICMP Destination unreachable
230 408.134508 192.168.5.231 -> 224.0.0.22 IGMP V3 Membership Report
231 408.364597 192.168.5.231 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
232 408.840027 192.168.5.231 -> 224.0.0.22 IGMP V3 Membership Report
233 410.831926 192.168.5.232 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
234 411.671828 192.168.5.231 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
235 413.104031 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP Who has 192.168.5.231? Tell 192.168.5.1
236 413.104833 VMware_31:01:03 -> Tyan_Com_27:66:5b ARP 192.168.5.231 is at 00:50:56:31:01:03
237 414.838505 192.168.5.231 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
238 426.794142 192.168.5.232 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
239 426.794182 192.168.5.1 -> 192.168.5.232 ICMP Destination unreachable
240 426.794780 192.168.5.232 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
241 426.794794 192.168.5.1 -> 192.168.5.232 ICMP Destination unreachable
242 431.820527 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA b1-XP-3.tswgtest
243 431.821294 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
244 431.822985 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA tswgtest
245 431.823790 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
246 433.171773 192.168.5.231 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
247 433.171811 192.168.5.1 -> 192.168.5.231 ICMP Destination unreachable
248 433.172038 192.168.5.231 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
249 433.172084 192.168.5.1 -> 192.168.5.231 ICMP Destination unreachable
250 451.036738 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA b2-XP-3.tswgtest
251 451.237382 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
252 451.239138 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA tswgtest
253 451.239956 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
254 456.234358 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP Who has 192.168.5.232? Tell 192.168.5.1
255 456.235035 VMware_31:02:03 -> Tyan_Com_27:66:5b ARP 192.168.5.232 is at 00:50:56:31:02:03
256 471.438139 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
258 511.911203 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
259 521.191102 192.168.5.232 -> 192.168.5.255 BROWSER Get Backup List Request
260 521.192471 192.168.5.232 -> 192.168.5.255 NBNS Name query NB WG1<1b>
261 521.233940 192.168.5.231 -> 192.168.5.255 NBNS Name query NB B2-XP-3<00>
262 521.235641 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.232
263 521.954840 192.168.5.232 -> 192.168.5.255 NBNS Name query NB WG1<1b>
264 522.734788 192.168.5.232 -> 192.168.5.255 NBNS Name query NB WG1<1b>
265 523.453116 192.168.5.232 -> 192.168.5.255 NBNS Name query NB B1-XP-3<20>
266 560.779430 Tyan_Com_27:66:5b -> Jetway_I_58:23:75 ARP Who has 192.168.5.105? Tell 192.168.5.1
267 560.779573 Jetway_I_58:23:75 -> Tyan_Com_27:66:5b ARP 192.168.5.105 is at 00:30:18:58:23:75
268 577.063342 Tyan_Com_27:66:5b -> Jetway_I_56:70:52 ARP Who has 192.168.5.103? Tell 192.168.5.1
269 577.063475 Jetway_I_56:70:52 -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
270 600.208045 192.168.5.103 -> 192.168.0.10 DNS Standard query A rh9box3.localdomain
271 600.209482 192.168.0.10 -> 192.168.5.103 DNS Standard query response A 192.168.5.103
272 600.254479 192.168.5.103 -> 192.168.0.10 DNS Standard query A rh9box3.localdomain
273 600.255452 192.168.0.10 -> 192.168.5.103 DNS Standard query response A 192.168.5.103
Next, I turned on the third Windows XP Pro, which is configured via
DHCP to get address 192.168.5.233 and Mode P. Note frame 287.
276 638.508104 0.0.0.0 -> 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x6c139f2c
277 638.508608 192.168.5.1 -> 192.168.5.233 DHCP DHCP Offer - Transaction ID 0x6c139f2c
278 638.525559 0.0.0.0 -> 255.255.255.255 DHCP DHCP Request - Transaction ID 0x6c139f2c
279 638.525937 192.168.5.1 -> 192.168.5.233 DHCP DHCP ACK - Transaction ID 0x6c139f2c
280 638.871407 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.233? Tell 192.168.5.233
281 638.999138 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.233? Tell 192.168.5.233
282 640.005063 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.233? Tell 192.168.5.233
283 641.060857 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.233
284 641.062570 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
285 641.062573 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
286 642.049882 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
287 642.104774 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation
288 642.123405 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation, Potential Browser
289 642.125821 192.168.5.233 -> 192.168.5.255 BROWSER Request Announcement
290 642.128605 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
291 644.125832 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
292 644.127274 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
293 646.125532 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
294 701.065066 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.233
295 701.065126 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
296 701.065426 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA b3-XP-3.tswgtest
297 701.184174 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
298 701.186194 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA tswgtest
299 701.187013 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
300 706.184379 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP Who has 192.168.5.233? Tell 192.168.5.1
301 706.184944 VMware_31:03:03 -> Tyan_Com_27:66:5b ARP 192.168.5.233 is at 00:50:56:31:03:03
302 751.233737 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.232
303 751.233775 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
304 751.234004 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA b2-XP-3.tswgtest
305 751.234835 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
306 751.237204 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA tswgtest
307 751.238073 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
308 756.226396 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP Who has 192.168.5.232? Tell 192.168.5.1
309 756.226932 VMware_31:02:03 -> Tyan_Com_27:66:5b ARP 192.168.5.232 is at 00:50:56:31:02:03
310 779.690266 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
312 800.381788 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.233
313 800.384527 rh9box1.localdomain -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.101
314 801.822894 192.168.5.233 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
315 801.822977 192.168.5.1 -> 192.168.5.233 ICMP Destination unreachable
316 801.825630 192.168.5.233 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
317 801.825672 192.168.5.1 -> 192.168.5.233 ICMP Destination unreachable
318 801.842924 192.168.5.233 -> 224.0.0.22 IGMP V3 Membership Report
319 801.925330 192.168.5.233 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
320 802.447253 192.168.5.233 -> 224.0.0.22 IGMP V3 Membership Report
321 805.514562 192.168.5.233 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
322 806.818554 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP Who has 192.168.5.233? Tell 192.168.5.1
323 806.819035 VMware_31:03:03 -> Tyan_Com_27:66:5b ARP 192.168.5.233 is at 00:50:56:31:03:03
324 808.669549 192.168.5.233 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
325 811.894542 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
326 816.530730 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
327 817.310886 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
330 818.080444 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
331 826.866319 192.168.5.233 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
332 826.866376 192.168.5.1 -> 192.168.5.233 ICMP Destination unreachable
333 826.866880 192.168.5.233 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
334 826.866897 192.168.5.1 -> 192.168.5.233 ICMP Destination unreachable
335 879.158465 192.168.5.233 -> 192.168.5.255 BROWSER Get Backup List Request
336 879.160364 192.168.5.1 -> 192.168.5.255 BROWSER Host Announcement RAVE, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
337 879.161636 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.233? Tell 192.168.5.231
338 883.131452 192.168.5.232 -> 192.168.5.255 BROWSER Host Announcement B2-XP-3, Workstation, Server, NT Workstation, Potential Browser
343 937.719991 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
344 937.720139 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
345 943.122032 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
346 943.122069 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
347 945.121683 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
348 945.121764 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
349 947.121369 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
350 947.121486 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
351 953.093684 Tyan_Com_27:66:5b -> rh9box1.localdomain ARP Who has 192.168.5.101? Tell 192.168.5.1
352 953.093831 rh9box1.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.101 is at 00:30:18:58:10:b8
353 955.154174 Tyan_Com_27:66:5b -> Jetway_I_54:43:87 ARP Who has 192.168.5.104? Tell 192.168.5.1
354 955.154320 Jetway_I_54:43:87 -> Tyan_Com_27:66:5b ARP 192.168.5.104 is at 00:30:18:54:43:87
355 957.924841 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
356 958.925077 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
357 958.925224 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
358 958.925228 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
359 980.700304 Tyan_Com_27:66:5b -> Jetway_I_58:23:75 ARP Who has 192.168.5.105? Tell 192.168.5.1
360 980.700471 Jetway_I_58:23:75 -> Tyan_Com_27:66:5b ARP 192.168.5.105 is at 00:30:18:58:23:75
361 996.974218 Tyan_Com_27:66:5b -> Jetway_I_56:70:52 ARP Who has 192.168.5.103? Tell 192.168.5.1
362 996.974366 rh9box3.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
363 997.704383 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
364 997.704518 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
365 1001.135311 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.233
366 1001.135350 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
367 1001.135637 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA b3-XP-3.tswgtest
368 1001.136595 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
369 1001.138941 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA tswgtest
370 1001.139679 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
371 1002.395303 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
372 1002.399077 192.168.5.232 -> 192.168.5.255 BROWSER Request Announcement
373 1002.400556 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
374 1002.408341 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.232
375 1006.136409 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP Who has 192.168.5.233? Tell 192.168.5.1
376 1006.136904 VMware_31:03:03 -> Tyan_Com_27:66:5b ARP 192.168.5.233 is at 00:50:56:31:03:03
377 1031.742776 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.231
378 1031.742837 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
379 1031.743072 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA b1-XP-3.tswgtest
380 1031.743957 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
381 1031.745672 192.168.5.231 -> 192.168.0.10 DNS Standard query SOA tswgtest
382 1031.746453 192.168.0.10 -> 192.168.5.231 DNS Standard query response, No such name
383 1032.440378 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
384 1036.743755 Tyan_Com_27:66:5b -> VMware_31:01:03 ARP Who has 192.168.5.231? Tell 192.168.5.1
385 1036.744261 VMware_31:01:03 -> Tyan_Com_27:66:5b ARP 192.168.5.231 is at 00:50:56:31:01:03
386 1056.958604 Tyan_Com_27:66:5b -> rh9box3.localdomain ARP Who has 192.168.5.103? Tell 192.168.5.1
387 1056.958751 rh9box3.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
388 1057.698784 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
389 1057.698920 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
390 1062.416066 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
391 1075.132968 Tyan_Com_27:66:5b -> Jetway_I_54:43:87 ARP Who has 192.168.5.104? Tell 192.168.5.1
392 1075.133103 Jetway_I_54:43:87 -> Tyan_Com_27:66:5b ARP 192.168.5.104 is at 00:30:18:54:43:87
419 1087.075845 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
420 1087.075995 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
421 1090.316621 Tyan_Com_27:66:5b -> rh9box1.localdomain ARP Who has 192.168.5.101? Tell 192.168.5.1
422 1090.316762 rh9box1.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.101 is at 00:30:18:58:10:b8
428 1092.421130 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
429 1092.421438 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
441 1100.679094 Tyan_Com_27:66:5b -> Jetway_I_58:23:75 ARP Who has 192.168.5.105? Tell 192.168.5.1
442 1100.679229 Jetway_I_58:23:75 -> Tyan_Com_27:66:5b ARP 192.168.5.105 is at 00:30:18:58:23:75
443 1117.683174 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
444 1117.683315 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
445 1121.986560 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation, Potential Browser
446 1122.397070 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
447 1147.100231 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
448 1147.100367 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
449 1150.291002 Tyan_Com_27:66:5b -> rh9box1.localdomain ARP Who has 192.168.5.101? Tell 192.168.5.1
450 1150.291145 rh9box1.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.101 is at 00:30:18:58:10:b8
451 1152.412086 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
452 1176.927390 Tyan_Com_27:66:5b -> rh9box3.localdomain ARP Who has 192.168.5.103? Tell 192.168.5.1
453 1176.927530 rh9box3.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
454 1177.667569 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
455 1177.667699 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
456 1182.398859 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
457 1195.121754 Tyan_Com_27:66:5b -> Jetway_I_54:43:87 ARP Who has 192.168.5.104? Tell 192.168.5.1
458 1195.121897 Jetway_I_54:43:87 -> Tyan_Com_27:66:5b ARP 192.168.5.104 is at 00:30:18:54:43:87
459 1207.064618 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
460 1207.064754 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
461 1210.325401 Tyan_Com_27:66:5b -> rh9box1.localdomain ARP Who has 192.168.5.101? Tell 192.168.5.1
462 1210.325539 rh9box1.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.101 is at 00:30:18:58:10:b8
463 1212.383316 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
466 1242.389863 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
467 1242.390606 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
468 1244.387752 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
469 1244.387835 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
470 1246.387409 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
471 1246.387526 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
472 1267.099008 Tyan_Com_27:66:5b -> Jetway_I_58:23:67 ARP Who has 192.168.5.102? Tell 192.168.5.1
473 1267.099148 Jetway_I_58:23:67 -> Tyan_Com_27:66:5b ARP 192.168.5.102 is at 00:30:18:58:23:67
474 1272.374458 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
475 1280.652257 Tyan_Com_27:66:5b -> Jetway_I_58:23:75 ARP Who has 192.168.5.105? Tell 192.168.5.1
476 1280.652410 Jetway_I_58:23:75 -> Tyan_Com_27:66:5b ARP 192.168.5.105 is at 00:30:18:58:23:75
477 1297.646331 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
478 1297.646466 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
479 1302.351169 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
480 1302.354951 192.168.5.233 -> 192.168.5.255 BROWSER Request Announcement
481 1302.356825 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
482 1302.357967 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
483 1302.363740 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.233
484 1332.356586 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
485 1351.154723 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.232
486 1351.154787 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
487 1351.155124 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA b2-XP-3.tswgtest
488 1351.155985 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
489 1351.157746 192.168.5.232 -> 192.168.0.10 DNS Standard query SOA tswgtest
490 1351.158596 192.168.0.10 -> 192.168.5.232 DNS Standard query response, No such name
491 1356.150381 Tyan_Com_27:66:5b -> VMware_31:02:03 ARP Who has 192.168.5.232? Tell 192.168.5.1
492 1356.150940 VMware_31:02:03 -> Tyan_Com_27:66:5b ARP 192.168.5.232 is at 00:50:56:31:02:03
493 1356.930555 Tyan_Com_27:66:5b -> rh9box3.localdomain ARP Who has 192.168.5.103? Tell 192.168.5.1
494 1356.930694 rh9box3.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
495 1357.680730 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
496 1357.680877 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
497 1360.870223 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.233
498 1362.610532 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
500 1373.512766 Tyan_Com_27:66:5b -> Apple_Co_6d:9d:6e ARP 192.168.5.1 is at 00:e0:81:27:66:5b
501 1385.559940 192.168.5.104 -> 192.168.0.10 DNS Standard query A rh9box4.localdomain
502 1385.561441 192.168.0.10 -> 192.168.5.104 DNS Standard query response A 192.168.5.104
503 1385.595092 192.168.5.104 -> 192.168.0.10 DNS Standard query A rh9box4.localdomain
504 1385.596039 192.168.0.10 -> 192.168.5.104 DNS Standard query response A 192.168.5.104
505 1392.399102 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
506 1398.770084 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
508 1411.838659 192.168.5.231 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WG1, NT Workstation, Domain Enum
509 1422.402683 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
Next, I turned on the third Windows XP Pro, which is configured via
DHCP to get address 192.168.5.234 and Mode M.
510 1424.295434 0.0.0.0 -> 255.255.255.255 DHCP DHCP Discover - Transaction ID 0x170b6032
511 1424.295823 192.168.5.1 -> 192.168.5.234 DHCP DHCP Offer - Transaction ID 0x170b6032
512 1424.300988 0.0.0.0 -> 255.255.255.255 DHCP DHCP Request - Transaction ID 0x170b6032
513 1424.301324 192.168.5.1 -> 192.168.5.234 DHCP DHCP ACK - Transaction ID 0x170b6032
514 1424.618915 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.234? Tell 192.168.5.234
515 1425.273236 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.234? Tell 192.168.5.234
516 1426.284389 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.234? Tell 192.168.5.234
517 1427.426856 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<00>
518 1428.128373 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<00>
519 1428.887199 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<00>
520 1429.654361 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<00>
521 1430.395492 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.234
522 1430.489871 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<00>
523 1431.253825 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<00>
524 1432.013359 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<00>
525 1432.723620 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<00>
526 1434.448065 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<03>
527 1434.586924 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<20>
528 1435.197058 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<03>
529 1435.337125 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<20>
530 1435.946494 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<03>
531 1436.092834 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<20>
532 1436.702964 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<03>
533 1436.834067 192.168.5.234 -> 192.168.5.255 NBNS Registration NB B4-XP-3<20>
534 1437.570884 192.168.5.234 -> 192.168.5.255 BROWSER Host Announcement B4-XP-3, Workstation, Server, NT Workstation
535 1437.850012 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<1e>
536 1438.510558 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.234
537 1438.510620 Tyan_Com_27:66:5b -> VMware_31:04:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
538 1438.511013 192.168.5.234 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
539 1438.511089 192.168.5.1 -> 192.168.5.234 ICMP Destination unreachable
540 1438.513403 192.168.5.234 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
541 1438.513463 192.168.5.1 -> 192.168.5.234 ICMP Destination unreachable
542 1438.597427 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<1e>
543 1439.360438 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<1e>
544 1440.122406 192.168.5.234 -> 192.168.5.255 NBNS Registration NB WG1<1e>
545 1440.883811 192.168.5.234 -> 192.168.5.255 BROWSER Request Announcement
546 1440.885383 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
547 1440.888219 192.168.5.234 -> 192.168.5.255 BROWSER Host Announcement B4-XP-3, Workstation, Server, NT Workstation, Potential Browser
548 1441.844875 192.168.5.234 -> 224.0.0.22 IGMP V3 Membership Report
549 1441.936811 192.168.5.234 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
550 1442.772104 192.168.5.234 -> 224.0.0.22 IGMP V3 Membership Report
551 1443.511297 Tyan_Com_27:66:5b -> VMware_31:04:03 ARP Who has 192.168.5.234? Tell 192.168.5.1
552 1443.512574 VMware_31:04:03 -> Tyan_Com_27:66:5b ARP 192.168.5.234 is at 00:50:56:31:04:03
553 1444.971888 192.168.5.234 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
554 1447.961470 192.168.5.234 -> 239.255.255.250 SSDP M-SEARCH * HTTP/1.1
555 1452.398052 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
556 1463.454502 192.168.5.234 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
557 1463.454554 192.168.5.1 -> 192.168.5.234 ICMP Destination unreachable
558 1463.455085 192.168.5.234 -> 192.168.5.1 SSDP M-SEARCH * HTTP/1.1
559 1463.455100 192.168.5.1 -> 192.168.5.234 ICMP Destination unreachable
560 1482.383461 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
561 1487.416441 192.168.5.234 -> 192.168.0.10 DNS Standard query SOA b4-XP-3.tswgtest
562 1487.607971 192.168.0.10 -> 192.168.5.234 DNS Standard query response, No such name
563 1487.610068 192.168.5.234 -> 192.168.0.10 DNS Standard query SOA tswgtest
564 1487.610946 192.168.0.10 -> 192.168.5.234 DNS Standard query response, No such name
567 1512.408801 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
568 1520.609208 Tyan_Com_27:66:5b -> Jetway_I_58:23:75 ARP Who has 192.168.5.105? Tell 192.168.5.1
569 1520.609341 Jetway_I_58:23:75 -> Tyan_Com_27:66:5b ARP 192.168.5.105 is at 00:30:18:58:23:75
570 1528.951114 Tyan_Com_27:66:5b -> rh9box3.localdomain ARP Who has 192.168.5.103? Tell 192.168.5.1
571 1528.951257 rh9box3.localdomain -> Tyan_Com_27:66:5b ARP 192.168.5.103 is at 00:30:18:56:70:52
572 1537.603096 Tyan_Com_27:66:5b -> Jetway_I_58:21:d1 ARP Who has 192.168.5.106? Tell 192.168.5.1
573 1537.603232 Jetway_I_58:21:d1 -> Tyan_Com_27:66:5b ARP 192.168.5.106 is at 00:30:18:58:21:d1
574 1538.762900 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.231
575 1538.793787 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
578 1539.563962 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
579 1540.263929 192.168.5.231 -> 192.168.5.255 NBNS Name query NB WG1<1b>
580 1540.264199 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
581 1540.264239 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
582 1540.264259 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
583 1540.264279 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB TSWG<00>
584 1540.264298 192.168.0.150 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
585 1540.264314 192.168.254.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
586 1540.264330 172.16.50.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
587 1540.264347 192.168.5.1 -> 192.168.5.101 NBNS Refresh NB TSWG<1e>
588 1540.264812 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
589 1540.264877 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
590 1540.264920 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
591 1540.264959 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
592 1540.265010 192.168.5.101 -> 192.168.0.150 NBNS Registration response NB 192.168.0.150
593 1540.265044 192.168.5.101 -> 192.168.254.1 NBNS Registration response NB 192.168.254.1
594 1540.265090 192.168.5.101 -> 172.16.50.1 NBNS Registration response NB 172.16.50.1
595 1540.265130 192.168.5.101 -> 192.168.5.1 NBNS Registration response NB 192.168.5.1
596 1542.384011 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
597 1552.381576 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
598 1554.381185 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
599 1554.381271 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
600 1555.839720 192.168.5.234 -> 192.168.5.255 BROWSER Get Backup List Request
601 1555.841083 192.168.5.234 -> 192.168.5.255 NBNS Name query NB WG1<1b>
Finally, I shared a folder from each of the WXP boxes, and ran netview
on each.
602 1555.841707 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
603 1555.842227 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.234? Tell 192.168.5.231
604 1556.614360 192.168.5.234 -> 192.168.5.255 NBNS Name query NB WG1<1b>
605 1557.294101 192.168.5.234 -> 192.168.5.255 NBNS Name query NB WG1<1b>
606 1557.294656 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
607 1558.092811 192.168.5.234 -> 192.168.5.255 NBNS Name query NB B1-XP-3<20>
608 1572.379190 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
609 1601.067601 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.233
610 1601.067671 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
611 1601.067978 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA b3-XP-3.tswgtest
612 1601.075778 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
613 1601.077648 192.168.5.233 -> 192.168.0.10 DNS Standard query SOA tswgtest
614 1601.078529 192.168.0.10 -> 192.168.5.233 DNS Standard query response, No such name
615 1602.384443 192.168.5.231 -> 192.168.5.255 BROWSER Become Backup Browser
616 1602.384792 192.168.5.1 -> 192.168.5.255 BROWSER Host Announcement RAVE, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
617 1602.387266 192.168.5.234 -> 192.168.5.255 BROWSER Request Announcement
618 1602.388288 192.168.5.231 -> 192.168.5.255 BROWSER Local Master Announcement B1-XP-3, Workstation, Server, NT Workstation, Potential Browser, Master Browser
619 1603.498700 192.168.5.232 -> 192.168.5.255 BROWSER Host Announcement B2-XP-3, Workstation, Server, NT Workstation, Potential Browser, Backup Browser
620 1606.068765 Tyan_Com_27:66:5b -> VMware_31:03:03 ARP Who has 192.168.5.233? Tell 192.168.5.1
621 1606.069273 VMware_31:03:03 -> Tyan_Com_27:66:5b ARP 192.168.5.233 is at 00:50:56:31:03:03
622 1623.499050 192.168.5.90 -> 192.168.5.255 BROWSER Local Master Announcement G4-BOX-1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server, Master Browser
623 1623.499291 192.168.5.90 -> 192.168.5.255 BROWSER Domain/Workgroup Announcement WORKGROUP, NT Workstation, Domain Enum
624 1709.892822 192.168.5.1 -> 192.168.5.255 NBNS Name query NB TSWG<1d>
626 1722.389812 192.168.5.232 -> 192.168.5.255 NBNS Name query NB B1-XP-3<20>
627 1722.397868 VMware_31:01:03 -> Broadcast ARP Who has 192.168.5.232? Tell 192.168.5.231
628 1732.393184 192.168.5.101 -> 192.168.5.255 BROWSER Host Announcement RH9BOX1, Workstation, Server, Print Queue Server, Xenix Server, NT Workstation, NT Server
629 1787.602239 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.1? Tell 192.168.5.234
630 1787.602263 Tyan_Com_27:66:5b -> VMware_31:04:03 ARP 192.168.5.1 is at 00:e0:81:27:66:5b
631 1787.602640 192.168.5.234 -> 192.168.0.10 DNS Standard query SOA b4-XP-3.tswgtest
632 1787.783630 192.168.0.10 -> 192.168.5.234 DNS Standard query response, No such name
633 1787.785815 192.168.5.234 -> 192.168.0.10 DNS Standard query SOA tswgtest
634 1787.786601 192.168.0.10 -> 192.168.5.234 DNS Standard query response, No such name
635 1792.781509 Tyan_Com_27:66:5b -> VMware_31:04:03 ARP Who has 192.168.5.234? Tell 192.168.5.1
636 1792.782075 VMware_31:04:03 -> Tyan_Com_27:66:5b ARP 192.168.5.234 is at 00:50:56:31:04:03
639 1841.197625 192.168.5.233 -> 192.168.5.255 BROWSER Host Announcement B3-XP-3, Workstation, Server, NT Workstation, Potential Browser, Backup Browser
640 1849.418232 VMware_31:02:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.232
641 1861.192849 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
642 1863.192477 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
643 1863.192542 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
644 1865.192166 192.168.5.101 -> 192.168.5.255 NBNS Name query NB NOWORKGROUP<1d>
645 1865.192268 192.168.5.101 -> 192.168.5.255 BROWSER Browser Election Request
646 1874.447281 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.101? Tell 192.168.5.233
647 1874.448586 VMware_31:03:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.233
648 1901.939915 VMware_31:04:03 -> Broadcast ARP Who has 192.168.5.231? Tell 192.168.5.234
649 1919.857523 192.168.5.234 -> 192.168.5.255 BROWSER Host Announcement B4-XP-3, Workstation, Server, NT Workstation, Potential Browser, Backup Browser
More information about the samba-technical
mailing list