Hi Steve
Well I 've edited it down to the bare minimum
There is a tree disconnect request at 17 and a timeout in 15.
But I dont see any request timeouts or retrys. This set appears to repeat
with the occassional extra
Peter
No. Time Source Destination Protocol Info
1 0.000000 10.0.0.20 10.0.0.255 NBNS
Name query NB CTC@GILGANDRA<20>
2 0.001061 10.0.0.10 10.0.0.20 NBNS
Name query response NB 10.0.0.10
3 0.001196 10.0.0.20 Broadcast ARP Who
has 10.0.0.10? Tell 10.0.0.20
Address Resolution Protocol (request)
4 0.001380 10.0.0.10 10.0.0.20 ARP
10.0.0.10 is at 08:00:37:0d:92:7e
Address Resolution Protocol (reply)
5 0.001392 10.0.0.20 10.0.0.10 TCP
4809 > netbios-ssn [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 0, Ack: 0, Len: 0
6 0.001740 10.0.0.10 10.0.0.20 TCP
netbios-ssn > 4809 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 0, Ack: 1, Len: 0
7 0.001802 10.0.0.20 10.0.0.10 NBSS
Session request, to CTC@GILGANDRA<20> from WS0<00>
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 1, Ack: 1, Len: 72
NetBIOS Session Service
Message Type: Session request
Called name: CTC@GILGANDRA<20> (Server service)
Calling name: WS0<00> (Workstation/Redirector)
8 0.002683 10.0.0.10 10.0.0.20 NBSS
NBSS Continuation Message
NetBIOS Session Service Continuation data
9 0.024863 10.0.0.20 10.0.0.10 SMB
Negotiate Protocol Request
NetBIOS Session Service Message Type: Session message
SMB Header
SMB Command: Negotiate Protocol (0x72)
NT Status: STATUS_SUCCESS (0x00000000)
Process ID: 65279
User ID: 0
Multiplex ID: 0
10 0.044379 10.0.0.10 10.0.0.20 SMB
Negotiate Protocol Response
NetBIOS Session Service
Message Type: Session message
SMB Header
Response to: 9
SMB Command: Negotiate Protocol (0x72)
Error Class: Success (0x00)
Process ID: 65279
Negotiate Protocol Response (0x72)
Word Count (WCT): 17
Dialect Index: 5, greater than LANMAN2.1
Encryption Key: EA7C533FB0B844DE
Primary Domain: W
Server: O
11 0.227759 10.0.0.20 10.0.0.10 TCP
4809 > netbios-ssn [ACK] Seq=210 Ack=106 Win=65430 Len=0
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 210, Ack: 106, Len: 0
12 0.369394 10.0.0.20 10.0.0.10 SMB
Session Setup AndX Request, User: WS0\gaffy; Tree Connect AndX, Path:
\\CTC@GILGANDRA\IPC$
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 210, Ack: 106, Len: 190
NetBIOS Session Service Message Type: Session message
SMB Header
SMB Command: Session Setup AndX (0x73)
Error Class: Success (0x00)
Error Code: No Error
Tree ID: 0
Process ID: 65279
User ID: 0
Multiplex ID: 16
Session Setup AndX Request (0x73)
AndXCommand: Tree Connect AndX (0x75)
Session Key: 0x0ea6f010
ANSI Password Length: 1
Unicode Password Length: 1
Account: gaffy
Primary Domain: WS0
Native OS: Windows 2002 Service Pack 2 2600
Native LAN Manager: Windows 2002 5.1
Extra byte parameters
Tree Connect AndX Request (0x75)
AndXCommand: No further commands (0xff)
Password: 5C001245E2543ABD242BFF77855C136BB82941935F62390A
Path: \\CTC@GILGANDRA\IPC$
Service: ?????
13 0.369688 10.0.0.10 10.0.0.20 TCP
netbios-ssn > 4809 [ACK] Seq=106 Ack=400 Win=8006 Len=0
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 106, Ack: 400, Len: 0
14 0.371567 10.0.0.10 10.0.0.20 SMB
Session Setup AndX Response; Tree Connect AndX
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 106, Ack: 400, Len: 85
NetBIOS Session Service Message Type: Session message
SMB Header Response to: 12
SMB Command: Session Setup AndX (0x73)
Error Class: Success (0x00)
Tree ID: 26
Process ID: 65279
User ID: 33606
Multiplex ID: 16
Session Setup AndX Response (0x73)
AndXCommand: Tree Connect AndX (0x75)
AndXOffset: 68
Action: 0x0001
Native OS: FXOS 0.1
Native LAN Manager: FX 0.01
Primary Domain: WORKGROUP
Tree Connect AndX Response (0x75)
AndXCommand: No further commands (0xff)
Service: IPC
15 0.431055 10.0.0.20 10.0.0.10 LANMAN
WPrintQGetInfo Request
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 400, Ack: 191, Len: 124
NetBIOS Session Service Message Type: Session message
SMB Header
SMB Command: Trans (0x25)
Error Class: Success (0x00)
Tree ID: 26
Process ID: 65279
User ID: 33606
Multiplex ID: 32
Trans Request (0x25)
Total Parameter Count: 40
Total Data Count: 0
Max Parameter Count: 6
Max Data Count: 1024
Max Setup Count: 0
Timeout: 5 seconds
Parameter Count: 40
Parameter Offset: 80
Data Count: 0
Data Offset: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 57
Transaction Name: \PIPE\LANMAN
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
16 0.432225 10.0.0.10 10.0.0.20 LANMAN
WPrintQGetInfo Response
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 191, Ack: 524, Len: 151
NetBIOS Session Service Message Type: Session message
SMB Header
Response to: 15
SMB Command: Trans (0x25)
Error Class: Success (0x00)
Error Code: No Error
Tree ID: 26
Process ID: 65279
User ID: 33606
Multiplex ID: 32
Trans Response (0x25)
Total Parameter Count: 6
Total Data Count: 85
Reserved: 0000
Parameter Count: 6
Parameter Offset: 56
Parameter Displacement: 0
Data Count: 85
Data Offset: 62
Data Displacement: 0
Setup Count: 0
Reserved: 00
Byte Count (BCC): 92
Padding: 00
SMB Pipe Protocol
Microsoft Windows Lanman Remote API Protocol
17 0.493552 10.0.0.20 10.0.0.10 SMB
Tree Disconnect Request
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 524, Ack: 342, Len: 39
NetBIOS Session Service Message Type: Session message
SMB Header
Response in: 18
SMB Command: Tree Disconnect (0x71)
Error Class: Success (0x00)
Error Code: No Error
Tree ID: 26
Process ID: 65279
User ID: 33606
Multiplex ID: 48
Tree Disconnect Request (0x71)
Word Count (WCT): 0
Byte Count (BCC): 0
18 0.494509 10.0.0.10 10.0.0.20 SMB
Tree Disconnect Response
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 342, Ack: 563, Len: 39
NetBIOS Session Service Message Type: Session message
SMB Header
Server Component: SMB
Response to: 17
Time from request: 0.000957000 seconds
SMB Command: Tree Disconnect (0x71)
Error Class: Success (0x00)
Reserved: 00
Error Code: No Error
Flags: 0x98
Flags2: 0x0003
Process ID High: 0
Signature: 0000000000000000
Reserved: 0000
Tree ID: 26
Process ID: 65279
User ID: 33606
Multiplex ID: 48
Tree Disconnect Response (0x71)
Word Count (WCT): 0
Byte Count (BCC): 0
19 0.556148 10.0.0.20 10.0.0.10 TCP
4809 > netbios-ssn [FIN, ACK] Seq=563 Ack=381 Win=65155 Len=0
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 563, Ack: 381, Len: 0
20 0.556354 10.0.0.10 10.0.0.20 TCP
netbios-ssn > 4809 [ACK] Seq=381 Ack=564 Win=8192 Len=0
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 381, Ack: 564, Len: 0
21 0.556439 10.0.0.10 10.0.0.20 TCP
netbios-ssn > 4809 [FIN, ACK] Seq=381 Ack=564 Win=8192 Len=0
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4809
(4809), Seq: 381, Ack: 564, Len: 0
22 0.556465 10.0.0.20 10.0.0.10 TCP
4809 > netbios-ssn [ACK] Seq=564 Ack=382 Win=65155 Len=0
Transmission Control Protocol, Src Port: 4809 (4809), Dst Port: netbios-ssn
(139), Seq: 564, Ack: 382, Len: 0
23 0.650249 10.0.0.20 10.0.0.10 TCP
4811 > netbios-ssn [SYN] Seq=0 Ack=0 Win=65535 Len=0 MSS=1460
Transmission Control Protocol, Src Port: 4811 (4811), Dst Port: netbios-ssn
(139), Seq: 0, Ack: 0, Len: 0
24 0.650544 10.0.0.10 10.0.0.20 TCP
netbios-ssn > 4811 [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: 4811
(4811), Seq: 0, Ack: 1, Len: 0
25 0.650624 10.0.0.20 10.0.0.10 NBSS