Thanks Priscilla for a very good explanation. The numbers were just made up, but it keeps changing from 85E8 to E885 and back to 85E8 a second later.
As far as I have found out so far, 85E8 is Microsoft Endpoint Mapper for RPC, however the workstation is a Windows 98. I will take a closer look at the workstation, but if anyone have a good tip, please let me know. Thanks, Ole ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Ole Drews Jensen Systems Network Manager CCNP, MCSE, MCP+I RWR Enterprises, Inc. [EMAIL PROTECTED] ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ http://www.RouterChief.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "Priscilla Oppenheimer" Sent by: [EMAIL PROTECTED] 10/10/2002 11:46 AM Please respond to "Priscilla Oppenheimer" To: [EMAIL PROTECTED] cc: Subject: Re: Novell Server node address change [7:55264] The number after network.node is the IPX socket number, not an SPX socket number. Some protocols, such as IPX and DDP, have a socket number at the network layer. SPX was used by RCONSOLE. Some SNA gateways used it, though most used NetBIOS. I think some printing can use SPX. Ordinary client/server traffic uses NetWare Core Protocol (NCP), however, which resides directly above IPX and does not use SPX. NCP has its own build-in transport like behavior that is similar to the old IPX PEP and provides a semi-reliable delivery service for single packet exchanges (often called a ping/pong protocol). SPX behaves more like TCP but is way less important and not used by much. It would be normal for a client's socket number to change if new appliations were started or restarted. Could you watch this user and see what they do? I usually blame the users. ;-) Could they be playing a game perhaps? Were those numbers you told us made up to hide the details for security reasons? Can you tell us the actual numbers? You can probably get more detailed info at novell.com, but here's a few nuggets about IPX sockets: Socket numbers between 0x4000 and 0x7FFF are dynamic sockets; these are used by clients to communicate with servers. Socket numbers between 0x8000 and 0xFFFF are well-known sockets; these are assigned by Novell to specific processes. Software developers who write NetWare applications can ask Novell to reserve a socket number and get on the list of well-known sockets. Novell also reserves several sockets for use in the NetWare environment. Here's a partial list of socket numbers. Socket Process 0x0002 Cisco IPX ping 0x0451 NCP server 0x0452 SAP 0x0453 RIP 0x0455 Novell NetBIOS 0x0456 Diagnostics 0x85BE EIGRP 0x9001 NLSP 0x9004 IPXWAN 0x9086 Novell IPX ping _______________________________ Priscilla Oppenheimer www.troubleshootingnetworks.com www.priscilla.com Ole D Jensen wrote: > > Yeah, I think you're right. I am not spending much time on the > NW side of > my network, so I can't remember all the facts by heart. > > The apps installed on that WorkStation are the same as > installed on most > other WorkStations on my networks. > > Ole > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Ole Drews Jensen > Systems Network Manager > CCNP, MCSE, MCP+I > RWR Enterprises, Inc. > [EMAIL PROTECTED] > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > http://www.RouterChief.com > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > > "The Long and Winding Road" > Sent by: [EMAIL PROTECTED] > 10/10/2002 10:03 AM > Please respond to "The Long and Winding Road" > > > To: [EMAIL PROTECTED] > cc: > Subject: Re: Novell Server node address change > [7:55264] > > > Ole, it's been a long time for me as well, but isn't that last > set of > numbers - the four after the : ( colon ) the SPX socket number? > That is > the > thing that appears to be changing. > > > Not that I would know what the change signifies. what's running > on that > workstation? > -- > > ! > > > > ""Ole D Jensen"" wrote in message > [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > > Thanks Dave, > > > > I have tried that without any luck. > > > > The command is "reset router". > > > > Thanks, > > > > Ole > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Ole Drews Jensen > > Systems Network Manager > > CCNP, MCSE, MCP+I > > RWR Enterprises, Inc. > > [EMAIL PROTECTED] > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > http://www.RouterChief.com > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > > > > > > > > > > "Williams, Dave" > > 10/10/2002 09:40 AM > > > > > > To: 'Ole D Jensen' , [EMAIL PROTECTED] > > cc: > > Subject: RE: Novell Server node address change > [7:55264] > > > > > > You might try and clear the routing and network tables (I > believe the > > command is "clear routes" although it's been a while) on the > server. > This > > will cause the server to resend SAPs to populate its tables. > Sometimes > > the routing tables on a Novell Server (especially 4.10) gets > messed up > and > > won't dump the corrupted information. > > Dave Williams, CCDA, CCNA, CCSA > > Senior Network Engineer > > (402) 661-2143 > > > > -----Original Message----- > > From: Ole D Jensen [mailto:[EMAIL PROTECTED]] > > Sent: Thursday, October 10, 2002 8:40 AM > > To: [EMAIL PROTECTED] > > Subject: OT: Novell Server node address change [7:55264] > > > > This is a good step off the Cisco topic, but since it is in > the network > > world, I'm sure at least one person on this list knows the > answer. > > I have an old Novell NetWare 4.10 running, and sometimes it > start > changing > > > > the address of one specific workstation. I have looked over > and over at > > the workstation to find a possible bug, but everything lookes > fine, and > > reinstalling the Novell Client has not changed anything. > > Every 30 seconds, the Novell Server changes the node address > back and > > forth: > > 10-10-02 8:20:00 am: Server-4.10-3191 > > Server WORKSTATION_27 > > Address has changed from 00000040:123456789012:1234 > > to 00000040:123456789012:3412 > > Information came from router at 123456789012 > > 10-10-02 8:20:01 am: Server-4.10-3191 > > Server WORKSTATION_27 > > Address has changed from 00000040:123456789012:3412 > > to 00000040:123456789012:1234 > > Information came from router at 123456789012 > > To avoid misunderstandings, the WORKSTATION_27 is the > workstation that > it > > keeps changing the address on. I am not sure if it's the > workstation > > itself that changes this address or the server, but it also > says that > the > > information came from router 123456789012 which is the > workstation. > > I'm sure there's a logical explanation for this. > > Thanks in advance for any comments, > > Ole > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Ole Drews Jensen > > Systems Network Manager > > CCNP, MCSE, MCP+I > > RWR Enterprises, Inc. > > [EMAIL PROTECTED] > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > http://www.RouterChief.com > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=55308&t=55264 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
