Pardon the quote marks, I am forwarding this from my "sent" folder. I had sent this out the the folks at my local LUG and got oodles of responses, none of which were very substantial. Thought I might try here. diald is version 0.16 (I think.. whatever came stock w/SuSE) Thanks! (message follows) "Brian M. Collins" wrote: > > Last night I installed diald and masquerading on my SuSE 5.3 box. > Everything was going just dandy (dialing, routing, ipforwarding, etc) > until I realized that diald was constantly picking up and dialing. Now, > being a fairly bright boy, I used tcpdump to observe what might be > hitting the link and causing the dial. A snippet of the suspect trace > is shown below: > > > > > 08:37:28.350816 192.168.2.1.netbios-ns > 192.168.2.255.netbios-ns: > > >>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST > > TrnID=0x189 > > OpCode=0 > > NmFlags=0x11 > > Rcode=0 > > QueryCount=1 > > AnswerCount=0 > > AuthorityCount=0 > > AddressRecCount=0 > > QuestionRecords: > > Name=BALTO NameType=0x00 (Workstation) > > QuestionType= > > > > 08:37:29.120816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=38,C) len=73 > > 08:37:29.260816 ns2.ix.netcom.com.domain > 192.168.2.1.netbios-ns: 393 NXDomain* >0/1/0 > (102) (DF) > > 08:37:30.620816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=38,C) len=73 > > 08:37:30.760816 ns1.ix.netcom.com.domain > 192.168.2.1.netbios-ns: 393 NXDomain* >0/1/0 > (102) (DF) > > 08:37:47.150816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 I (s=0,r=33,C) len=62 > > 08:37:47.150816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 I (s=0,r=33,C) len=62 > > 08:37:47.290816 ns2.ix.netcom.com.domain > 192.168.2.1.2876: 385 NXDomain* 0/1/0 >(102) > (DF) > > 08:37:47.310816 ns2.ix.netcom.com.domain > 192.168.2.1.2877: 385 NXDomain* 0/1/0 >(102) > (DF) > > 08:37:47.310816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=25,P) len=47 > > 08:37:47.310816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=25,P) len=47 > > 08:37:47.450816 ns2.ix.netcom.com.domain > 192.168.2.1.2878: 386 NXDomain* 0/1/0 >(96) > (DF) > > 08:37:47.470816 ns2.ix.netcom.com.domain > 192.168.2.1.2879: 386 NXDomain* 0/1/0 >(96) > (DF) > > 08:37:47.470816 192.168.2.1.netbios-ns > stonyman.collinsnet.com.netbios-ns: > > >>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST > > TrnID=0x18A > > OpCode=0 > > NmFlags=0x10 > > Rcode=0 > > QueryCount=1 > > AnswerCount=0 > > AuthorityCount=0 > > AddressRecCount=0 > > QuestionRecords: > > Name=BALTO NameType=0x00 (Workstation) > > QuestionType= > > A little background info: > - 192.168.2.1 is a Win95 box and it is the only machine on the segment > with my Linux machine > - BALTO is an NT machine that is no longer on the segment > - stonyman.collinsnet.com is my Linux box > - netcom is my isp > > Nowthen, I am using the default (stock) /etc/diald.conf file which contains the > following lines re:netbios > > > # Don't bring up on domain name requests between two running nameds. > > ignore udp udp.dest=udp.domain,udp.source=udp.domain > > # Bring up the network whenever we make a domain request from someplace > > # other than named. > > accept udp 30 udp.dest=udp.domain > > accept udp 30 udp.source=udp.domain > > # Do the same for netbios-ns broadcasts > > # NOTE: your /etc/services file may not define the netbios-ns service > > # in which case you should comment out the next three lines. > > ignore udp udp.source=udp.netbios-ns,udp.dest=udp.netbios-ns > > ignore udp udp.dest=udp.netbios-ns > > ignore udp udp.source=udp.netbios-ns > > Since the above tcpdump trace shows this message over and over again, > and since taking the Win95 box off of the segment makes diald behave as > one would expect, I am led to believe that there is something going on > with netbios broadcasts that is triggering diald to pickup - but I may > be wrong.... that happened once too <grin> > > Any and all help on this will be really, really, appreciated! > > Thanks! > > -- > Brian M. Collins Collins Network Engineering > [EMAIL PROTECTED] www.collinsnet.com > 831-419-0410 fax: 831-338-4171 -- Brian M. Collins Collins Network Engineering [EMAIL PROTECTED] www.collinsnet.com 831-419-0410 fax: 831-338-4171
Last night I installed diald and masquerading on my SuSE 5.3 box. Everything was going just dandy (dialing, routing, ipforwarding, etc) until I realized that diald was constantly picking up and dialing. Now, being a fairly bright boy, I used tcpdump to observe what might be hitting the link and causing the dial. A snippet of the suspect trace is shown below: > > 08:37:28.350816 192.168.2.1.netbios-ns > 192.168.2.255.netbios-ns: > >>> NBT UDP PACKET(137): QUERY; REQUEST; BROADCAST > TrnID=0x189 > OpCode=0 > NmFlags=0x11 > Rcode=0 > QueryCount=1 > AnswerCount=0 > AuthorityCount=0 > AddressRecCount=0 > QuestionRecords: > Name=BALTO NameType=0x00 (Workstation) > QuestionType= > > 08:37:29.120816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=38,C) len=73 > 08:37:29.260816 ns2.ix.netcom.com.domain > 192.168.2.1.netbios-ns: 393 NXDomain* >0/1/0 (102) (DF) > 08:37:30.620816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=38,C) len=73 > 08:37:30.760816 ns1.ix.netcom.com.domain > 192.168.2.1.netbios-ns: 393 NXDomain* >0/1/0 (102) (DF) > 08:37:47.150816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 I (s=0,r=33,C) len=62 > 08:37:47.150816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 I (s=0,r=33,C) len=62 > 08:37:47.290816 ns2.ix.netcom.com.domain > 192.168.2.1.2876: 385 NXDomain* 0/1/0 >(102) (DF) > 08:37:47.310816 ns2.ix.netcom.com.domain > 192.168.2.1.2877: 385 NXDomain* 0/1/0 >(102) (DF) > 08:37:47.310816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=25,P) len=47 > 08:37:47.310816 8:0:9:de:ff:3 null > 8:0:9:de:6d:aa sap 45 rr (r=25,P) len=47 > 08:37:47.450816 ns2.ix.netcom.com.domain > 192.168.2.1.2878: 386 NXDomain* 0/1/0 (96) (DF) > 08:37:47.470816 ns2.ix.netcom.com.domain > 192.168.2.1.2879: 386 NXDomain* 0/1/0 (96) (DF) > 08:37:47.470816 192.168.2.1.netbios-ns > stonyman.collinsnet.com.netbios-ns: > >>> NBT UDP PACKET(137): QUERY; REQUEST; UNICAST > TrnID=0x18A > OpCode=0 > NmFlags=0x10 > Rcode=0 > QueryCount=1 > AnswerCount=0 > AuthorityCount=0 > AddressRecCount=0 > QuestionRecords: > Name=BALTO NameType=0x00 (Workstation) > QuestionType= A little background info: - 192.168.2.1 is a Win95 box and it is the only machine on the segment with my Linux machine - BALTO is an NT machine that is no longer on the segment - stonyman.collinsnet.com is my Linux box - netcom is my isp Nowthen, I am using the default /etc/diald.conf file which contains the following lines re:netbios > # Don't bring up on domain name requests between two running nameds. > ignore udp udp.dest=udp.domain,udp.source=udp.domain > # Bring up the network whenever we make a domain request from someplace > # other than named. > accept udp 30 udp.dest=udp.domain > accept udp 30 udp.source=udp.domain > # Do the same for netbios-ns broadcasts > # NOTE: your /etc/services file may not define the netbios-ns service > # in which case you should comment out the next three lines. > ignore udp udp.source=udp.netbios-ns,udp.dest=udp.netbios-ns > ignore udp udp.dest=udp.netbios-ns > ignore udp udp.source=udp.netbios-ns Since the above tcpdump trace shows this message over and over again, and since taking the Win95 box off of the segment makes diald behave as one would expect, I am led to believe that there is something going on with netbios broadcasts that is triggering diald to pickup - but I may be wrong.... that happened once too <grin> Any and all help on this will be really, really, appreciated! Thanks! -- Brian M. Collins Collins Network Engineering [EMAIL PROTECTED] www.collinsnet.com 831-419-0410 fax: 831-338-4171
