This may not be relevant since it's just the socket that changes, but you don't have another workstation with a duplicate address, do you? I have seen similar symptoms from that.
JMcL Ole D Jensen wrote: > > Thanks Priscilla for a very good explanation. > > The numbers were just made up, but it keeps changing from 85E8 > to E885 and > back to 85E8 a second later. > > As far as I have found out so far, 85E8 is Microsoft Endpoint > Mapper for > RPC, however the workstation is a Windows 98. > > I will take a closer look at the workstation, but if anyone > have a good > tip, please let me know. > > Thanks, > > Ole > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > Ole Drews Jensen > Systems Network Manager > CCNP, MCSE, MCP+I > RWR Enterprises, Inc. > [EMAIL PROTECTED] > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > http://www.RouterChief.com > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > > > > > > > > > > > "Priscilla Oppenheimer" > Sent by: [EMAIL PROTECTED] > 10/10/2002 11:46 AM > Please respond to "Priscilla Oppenheimer" > > > To: [EMAIL PROTECTED] > cc: > Subject: Re: Novell Server node address change > [7:55264] > > > The number after network.node is the IPX socket number, not an > SPX socket > number. Some protocols, such as IPX and DDP, have a socket > number at the > network layer. > > SPX was used by RCONSOLE. Some SNA gateways used it, though > most used > NetBIOS. I think some printing can use SPX. Ordinary > client/server traffic > uses NetWare Core Protocol (NCP), however, which resides > directly above > IPX > and does not use SPX. NCP has its own build-in transport like > behavior > that > is similar to the old IPX PEP and provides a semi-reliable > delivery > service > for single packet exchanges (often called a ping/pong > protocol). SPX > behaves > more like TCP but is way less important and not used by much. > > It would be normal for a client's socket number to change if > new > appliations > were started or restarted. Could you watch this user and see > what they do? > I > usually blame the users. ;-) Could they be playing a game > perhaps? > > Were those numbers you told us made up to hide the details for > security > reasons? Can you tell us the actual numbers? > > You can probably get more detailed info at novell.com, but > here's a few > nuggets about IPX sockets: > > Socket numbers between 0x4000 and 0x7FFF are dynamic sockets; > these are > used > by clients to communicate with servers. Socket numbers between > 0x8000 and > 0xFFFF are well-known sockets; these are assigned by Novell to > specific > processes. Software developers who write NetWare applications > can ask > Novell > to reserve a socket number and get on the list of well-known > sockets. > Novell > also reserves several sockets for use in the NetWare > environment. Here's a > partial list of socket numbers. > > Socket Process > 0x0002 Cisco IPX ping > 0x0451 NCP server > 0x0452 SAP > 0x0453 RIP > 0x0455 Novell NetBIOS > 0x0456 Diagnostics > 0x85BE EIGRP > 0x9001 NLSP > 0x9004 IPXWAN > 0x9086 Novell IPX ping > _______________________________ > > Priscilla Oppenheimer > www.troubleshootingnetworks.com > www.priscilla.com > > Ole D Jensen wrote: > > > > Yeah, I think you're right. I am not spending much time on the > > NW side of > > my network, so I can't remember all the facts by heart. > > > > The apps installed on that WorkStation are the same as > > installed on most > > other WorkStations on my networks. > > > > Ole > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Ole Drews Jensen > > Systems Network Manager > > CCNP, MCSE, MCP+I > > RWR Enterprises, Inc. > > [EMAIL PROTECTED] > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > http://www.RouterChief.com > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > > > > > > > > "The Long and Winding Road" > > Sent by: [EMAIL PROTECTED] > > 10/10/2002 10:03 AM > > Please respond to "The Long and Winding Road" > > > > > > To: [EMAIL PROTECTED] > > cc: > > Subject: Re: Novell Server node address change > > [7:55264] > > > > > > Ole, it's been a long time for me as well, but isn't that last > > set of > > numbers - the four after the : ( colon ) the SPX socket > number? > > That is > > the > > thing that appears to be changing. > > > > > > Not that I would know what the change signifies. what's > running > > on that > > workstation? > > -- > > > > ! > > > > > > > > ""Ole D Jensen"" wrote in message > > [EMAIL PROTECTED]">news:[EMAIL PROTECTED]... > > > Thanks Dave, > > > > > > I have tried that without any luck. > > > > > > The command is "reset router". > > > > > > Thanks, > > > > > > Ole > > > > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > Ole Drews Jensen > > > Systems Network Manager > > > CCNP, MCSE, MCP+I > > > RWR Enterprises, Inc. > > > [EMAIL PROTECTED] > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > http://www.RouterChief.com > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > > > > > > > > > > > > > > > > > > > "Williams, Dave" > > > 10/10/2002 09:40 AM > > > > > > > > > To: 'Ole D Jensen' , [EMAIL PROTECTED] > > > cc: > > > Subject: RE: Novell Server node address > change > > [7:55264] > > > > > > > > > You might try and clear the routing and network tables (I > > believe the > > > command is "clear routes" although it's been a while) on the > > server. > > This > > > will cause the server to resend SAPs to populate its > tables. > > Sometimes > > > the routing tables on a Novell Server (especially 4.10) gets > > messed up > > and > > > won't dump the corrupted information. > > > Dave Williams, CCDA, CCNA, CCSA > > > Senior Network Engineer > > > (402) 661-2143 > > > > > > -----Original Message----- > > > From: Ole D Jensen [mailto:[EMAIL PROTECTED]] > > > Sent: Thursday, October 10, 2002 8:40 AM > > > To: [EMAIL PROTECTED] > > > Subject: OT: Novell Server node address change [7:55264] > > > > > > This is a good step off the Cisco topic, but since it is in > > the network > > > world, I'm sure at least one person on this list knows the > > answer. > > > I have an old Novell NetWare 4.10 running, and sometimes it > > start > > changing > > > > > > the address of one specific workstation. I have looked over > > and over at > > > the workstation to find a possible bug, but everything > lookes > > fine, and > > > reinstalling the Novell Client has not changed anything. > > > Every 30 seconds, the Novell Server changes the node address > > back and > > > forth: > > > 10-10-02 8:20:00 am: Server-4.10-3191 > > > Server WORKSTATION_27 > > > Address has changed from 00000040:123456789012:1234 > > > to 00000040:123456789012:3412 > > > Information came from router at 123456789012 > > > 10-10-02 8:20:01 am: Server-4.10-3191 > > > Server WORKSTATION_27 > > > Address has changed from 00000040:123456789012:3412 > > > to 00000040:123456789012:1234 > > > Information came from router at 123456789012 > > > To avoid misunderstandings, the WORKSTATION_27 is the > > workstation that > > it > > > keeps changing the address on. I am not sure if it's the > > workstation > > > itself that changes this address or the server, but it also > > says that > > the > > > information came from router 123456789012 which is the > > workstation. > > > I'm sure there's a logical explanation for this. > > > Thanks in advance for any comments, > > > Ole > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > Ole Drews Jensen > > > Systems Network Manager > > > CCNP, MCSE, MCP+I > > > RWR Enterprises, Inc. > > > [EMAIL PROTECTED] > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > > http://www.RouterChief.com > > > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > > Message Posted at: http://www.groupstudy.com/form/read.php?f=7&i=55341&t=55264 -------------------------------------------------- FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]
