I've tried to log dropped packets, but on a big network there are too many
to
sort out. In putting conditions on the logging, I've found that the dropped
packets do not have a source address of an individual machine, or a unicast
address, or a broadcast address. I know something is being dropped
No, it does not appear to be webclient. There seems to be no such service
on even the latest Win2K.
It appears there is some kind of anti-worm change in the MS-RPC code
contained in the latest security patches.
Samba 2.2.8a will hang for about a minute. Samba 3.0.2a will hang for
about three
What are your default IP tables rules? Do you Drop instead of Reject?
If so, try chanding your policies to Reject connections from the local
network that you don't accept. Optionally, log the rejected
connections to see what port Window is trying to talk to, and later,
reject rather than drop
