SCOUG-HELP Mailing List Archives

<< Previous Message << >> Next Message >>

Date:	Wed, 23 Jan 2002 14:43:12 PST7
From:	"Steven Levine" <steve53@earthlink.net >
Reply-To:	scoug-help@scoug.com
To:	scoug-help@scoug.com
Subject:	SCOUG-Help: Re: Cable/DSL Router

=====================================================
If you are responding to someone asking for help who
may not be a member of this list, be sure to use the
REPLY TO ALL feature of your email program.
=====================================================

In <0GQE003PPVHQCF@mta7.pltn13.pbi.net>, on 01/23/02
at 01:54 PM, sshapiro@ucsd.edu (Sandy Shapiro) said:

>so I zipped it up and am attaching it. (iptrace.dmp was not readable)

I would be worried, it it was.

>I don't know what I should look for.

This is odd... Here's what I see...

This is a NetBIOS request being sent over TCPBEUI looking fore Neil_XP (I
guess):

-------------------------- #:1 --------------------------
Delta Time: 0.000sec Packet Length: 250 bytes (FA hex)
DIX: Dest: FF:FF:FF:FF:FF:FF Source: 00:A0:CC:E3:25:FD
DIX: Dest: 192.168.002.255 Source: 192.168.002.025
----------------------- IP HEADER -----------------------
IP: Version: 4 Correct Header Length: 20 bytes
IP: Type Of Service: 00
IP: 000. .... Routine
IP: ...0 .... Normal Delay
IP: .... 0... Normal Throughput
IP: .... .0.. Normal Reliability
IP: Total Len: 236 (xEC) bytes Id: 2473
IP: Flags: 0
IP: .0.. May Fragment
IP: ..0. Last Fragment
IP: Fragment Offset: 000
IP: Time To Live: 128 sec Protocol: 17 UDP
IP: Header Checksum: 8F25 (Correct)
IP: No Options

---------------------- UDP HEADER ----------------------
UDP: Source Port: 138 (NETBIOS Datagram) Dest Port: 138 (NETBIOS
Datagram)
UDP: Length: 216 (xD8)
UDP: Checksum: 51AF (Correct)
--------------------------------- DATA
-----------------------------------
0000 11 02 80 3E C0 A8 02 19 00 8A 00 C2 00 00 20 45 ...>..........
E
0010 4F 45 46 45 4A 45 4D 43 41 43 41 43 41 43 41 43
OEFEJEMCACACACAC
0020 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 00
ACACACACACACACA.
0030 20 45 49 45 50 45 4E 45 46 43 41 43 41 43 41 43
EIEPENEFCACACAC
0040 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 42
ACACACACACACACAB
0050 4F 00 FF 53 4D 42 25 00 00 00 00 00 00 00 00 00
O..SMB%.........
0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
................
0070 00 00 11 00 00 28 00 00 00 00 00 00 00 00 00 E8
.....(..........
0080 03 00 00 00 00 00 00 00 00 28 00 56 00 03 00 01
.........(.V....
0090 00 00 00 02 00 39 00 5C 4D 41 49 4C 53 4C 4F 54
.....9.\MAILSLOT
00A0 5C 42 52 4F 57 53 45 00 0F 00 80 FC 0A 00 4E 45
\BROWSE.......NE
00B0 49 4C 00 00 72 00 65 00 5C 00 50 00 6F 00 05 01
IL..r.e.\.P.o...
00C0 03 12 05 00 0F 01 55 AA 4E 65 69 6C 5F 58 50 00
......U.Neil_XP.

16.7 seconds later on the other NIC (probably the once connected to the
Linksys) there's an address resolution request to resolve
2.2.168.192.in-addr.arpa.

-------------------------- #:2 --------------------------
Delta Time: 16.709sec Packet Length: 42 bytes (2A hex)
DIX: Dest: FF:FF:FF:FF:FF:FF Source: 00:10:5A:28:9C:7F
-------------------------- ARP --------------------------
ARP: Hardware Type:1 (Ethernet 10Mb)
ARP: Protocol Type:0800 (IP Address)
ARP: Hardware Len:6
ARP: Protocol Len:4
ARP: Operation:1 (ARP Request)
ARP: Sender HW address: 00105A289C7F
ARP: Sender PA: 192.168.002.002.
ARP: Target HW address: 000000000000
ARP: Target PA: 192.168.002.001.

-------------------------- #:3 --------------------------
Delta Time: 0.000sec Packet Length: 60 bytes (3C hex)
DIX: Dest: 00:10:5A:28:9C:7F Source: 00:04:E2:23:CF:F4
-------------------------- ARP --------------------------
ARP: Hardware Type:1 (Ethernet 10Mb)
ARP: Protocol Type:0800 (IP Address)
ARP: Hardware Len:6
ARP: Protocol Len:4
ARP: Operation:2 (ARP Response)
ARP: Sender HW address: 0004E223CFF4
ARP: Sender PA: 192.168.002.001.
ARP: Target HW address: 00105A289C7F
ARP: Target PA: 192.168.002.002.

-------------------------- #:4 --------------------------
Delta Time: 0.000sec Packet Length: 84 bytes (54 hex)
DIX: Dest: 00:04:E2:23:CF:F4 Source: 00:10:5A:28:9C:7F
DIX: Dest: 192.168.002.001 Source: 192.168.002.002
----------------------- IP HEADER -----------------------
IP: Version: 4 Correct Header Length: 20 bytes
IP: Type Of Service: 00
IP: 000. .... Routine
IP: ...0 .... Normal Delay
IP: .... 0... Normal Throughput
IP: .... .0.. Normal Reliability
IP: Total Len: 70 (x46) bytes Id: 0003
IP: Flags: 0
IP: .0.. May Fragment
IP: ..0. Last Fragment
IP: Fragment Offset: 000
IP: Time To Live: 64 sec Protocol: 17 UDP
IP: Header Checksum: F550 (Correct)
IP: No Options

---------------------- UDP HEADER ----------------------
UDP: Source Port: 49152 (Unassigned port) Dest Port: 53 (Domain
NameServer)
UDP: Length: 50 (x32)
UDP: Checksum: 2D75 (Correct)
------------------------ DNS ----------------------------
DNS: ID:14
DNS: Query Standard Query
DNS: FLAGS: 10
DNS: .0. .... = No Truncation
DNS: ..1 .... = Recursion Desired
DNS: Return Code: 0 No Error
DNS: Question Cnt: 1, Answer Cnt: 0
DNS: Authority Cnt: 0, Additional Cnt: 0
DNS: Question Section
DNS: Name: 2.2.168.192.in-addr.arpa
DNS: Type: 012 Class: 01

-------------------------- #:5 --------------------------
Delta Time: 0.027sec Packet Length: 170 bytes (AA hex)
DIX: Dest: 00:10:5A:28:9C:7F Source: 00:04:E2:23:CF:F4
DIX: Dest: 192.168.002.002 Source: 192.168.002.001
----------------------- IP HEADER -----------------------
IP: Version: 4 Correct Header Length: 20 bytes
IP: Type Of Service: 00
IP: 000. .... Routine
IP: ...0 .... Normal Delay
IP: .... 0... Normal Throughput
IP: .... .0.. Normal Reliability
IP: Total Len: 156 (x9C) bytes Id: 4D04
IP: Flags: 0
IP: .0.. May Fragment
IP: ..0. Last Fragment
IP: Fragment Offset: 000
IP: Time To Live: 64 sec Protocol: 17 UDP
IP: Header Checksum: A7F9 (Correct)
IP: No Options

The DNS responds with:

---------------------- UDP HEADER ----------------------
UDP: Source Port: 53 (Domain NameServer) Dest Port: 49152
(Unassigned port)
UDP: Length: 136 (x88)
UDP: Checksum: D869 (Correct)
------------------------ DNS ----------------------------
DNS: ID:14
DNS: Query Response Standard Query
DNS: FLAGS: 18
DNS: .0. .... = No Truncation
DNS: ..1 .... = Recursion Desired
DNS: ... 1... = Recursion Available
DNS: Return Code: 3 Name Not Found
DNS: Question Cnt: 1, Answer Cnt: 0
DNS: Authority Cnt: 1, Additional Cnt: 0
DNS: Question Section
DNS: Name: 2.2.168.192.in-addr.arpa
DNS: Type: 012 Class: 01
DNS: Authority Section
DNS: Domain Name: 168.192.in-addr.arpa
DNS: Type: 6 Class: 1
DNS: TTL: 3550 Len: 0054
--------------------------------- DATA
-----------------------------------
0000 09 62 6C 61 63 6B 68 6F 6C 65 04 69 61 6E 61 03
.blackhole.iana.
0010 6F 72 67 00 05 63 72 61 69 6E 05 69 63 61 6E 6E
org..crain.icann
0020 C0 59 01 30 BD AE 00 00 2A 30 00 00 03 84 00 09
.Y.0....*0......
0030 3A 80 00 01 51 80 :...Q.

This says you are not using DHCP to talk to the Linksys side. Let me see:

lantran.log
protocol.ini
setup.cmd
dhcp.cfg (check my spelling on this one)

Steven

--
----------------------------------------------------------------
"Steven Levine" MR2/ICE 2.30a #10183 Warp4/FP15
www.scoug.com irc.webbnet.org #scoug (Wed 7pm PST)
----------------------------------------------------------------

=====================================================

To unsubscribe from this list, send an email message
to "steward@scoug.com". In the body of the message,
put the command "unsubscribe scoug-help".

For problems, contact the list owner at
"rollin@scoug.com".

=====================================================

Return to [ 23 | January | 2002 ]

SCOUG, Warp Expo West, and Warpfest are trademarks of the Southern California OS/2 User Group. OS/2, Workplace Shell, and IBM are registered trademarks of International Business Machines Corporation. All other trademarks remain the property of their respective owners.