The following is a trace of the new behavior of Windows NT 4.0 that allows a client to connect up to a Windows NT-based server via the HOST name rather than the NetBIOS computer name. This is a trace of the following command:
Net Use * \\scottsuPDC.scottsu.com\c$
Query the DNS for the Host name scottsuPDC.scotts.com
1 4.248 SCOTTSU-7 SCOTTSU_NT40 DNS 0x6:Std Qry for SCOTTSUPDC.SCOTTSU.COM IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 UDP: Src Port: Unknown, (1057); Dst Port: DNS (53); Length = 48 (0x30) UDP: Source Port = 0x0421 UDP: Destination Port = DNS UDP: Total length = 48 (0x30) bytes UDP: CheckSum = 0x8FEA UDP: Data: Number of data bytes remaining = 40 (0x0028) DNS: 0x6:Std Qry for SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr. DNS: Query Identifier = 6 (0x6) DNS: DNS Flags = Query, OpCode—Std Qry, RD Bits Set, RCode—No error DNS: 0............... = Query DNS: .0000........... = Standard Query DNS: .....0.......... = Server not authority for domain DNS: ......0......... = Message complete DNS: .......1........ = Recursive query desired DNS: ........0....... = Recursive queries supported by server DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 0 (0x0) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr. DNS: Question Name: SCOTTSUPDC.SCOTTSU.COM DNS: Question Type = Host Address DNS: Question Class = Internet address class
This is the response from the DNS server. The IP address for scottsuPDC.scottsu.com is at the end of the frame
2 4.255 SCOTTSU_NT40 SCOTTSU-7 DNS 0x6:Std Qry Resp. for SCOTTSUPDC.SCOTTSU.COM IP: Source Address = 157.55.100.204 IP: Destination Address = 157.55.102.52 UDP: Src Port: DNS, (53); Dst Port: Unknown (1057); Length = 64 (0x40) UDP: Source Port = DNS UDP: Destination Port = 0x0421 UDP: Total length = 64 (0x40) bytes UDP: CheckSum = 0x4932 UDP: Data: Number of data bytes remaining = 56 (0x0038) DNS: 0x6:Std Qry Resp. for SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr. DNS: Query Identifier = 6 (0x6) DNS: DNS Flags = Response, OpCode—Std Qry, AA RD RA Bits Set, RCode—No error DNS: 1............... = Response DNS: .0000........... = Standard Query DNS: .....1.......... = Server authority for domain DNS: ......0......... = Message complete DNS: .......1........ = Recursive query desired DNS: ........1....... = No recursive queries DNS: .........000.... = Reserved DNS: ............0000 = No error DNS: Question Entry Count = 1 (0x1) DNS: Answer Entry Count = 1 (0x1) DNS: Name Server Count = 0 (0x0) DNS: Additional Records Count = 0 (0x0) DNS: Question Section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr. DNS: Question Name: SCOTTSUPDC.SCOTTSU.COM DNS: Question Type = Host Address DNS: Question Class = Internet address class DNS: Answer section: SCOTTSUPDC.SCOTTSU.COM of type Host Addr on class INET addr. DNS: Resource Name: SCOTTSUPDC.SCOTTSU.COM DNS: Resource Type = Host Address DNS: Resource Class = Internet address class DNS: Time To Live = 0 (0x0) DNS: Resource Data Length = 4 (0x4) DNS: IP address = 157.55.100.204
Then the client does an Adapter Status on the IP address to find what names that machine has registered
3 4.254 SCOTTSU-7 SCOTTSU_NT40 NBT NS: Query req. for *<00...(15)> IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 58 (0x3A) UDP: Source Port = NETBIOS Name Service UDP: Destination Port = NETBIOS Name Service UDP: Total length = 58 (0x3A) bytes UDP: CheckSum = 0x3A63 UDP: Data: Number of data bytes remaining = 50 (0x0032) NBT: NS: Query req. for *<00...(15)> NBT: Transaction ID = 32860 (0x805C) NBT: Flags Summary = 0x0000—Req.; Query; Success NBT: 0............... = Request NBT: .0000........... = Query NBT: .....0.......... = Non-authoritative Answer NBT: ......0......... = Datagram not truncated NBT: .......0........ = Recursion not desired NBT: ........0....... = Recursion not available NBT: .........0...... = Reserved NBT: ..........0..... = Reserved NBT: ...........0.... = Not a broadcast packet NBT: ............0000 = Success NBT: Question Count = 1 (0x1) NBT: Answer Count = 0 (0x0) NBT: Name Service Count = 0 (0x0) NBT: Additional Record Count = 0 (0x0) NBT: Question Name = *<00...(15)> NBT: Question Type = Node Status Request NBT: Question Class = Internet Class
This is the response to the Adapter Status. The machine has a number of NetBIOS names registered.
4 4.255 SCOTTSU_NT40 SCOTTSU-7 NBT NS: Query (Node Status) resp. for *<00...(15)>, Success IP: Source Address = 157.55.100.204 IP: Destination Address = 157.55.102.52 UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 345 (0x159) UDP: Source Port = NETBIOS Name Service UDP: Destination Port = NETBIOS Name Service UDP: Total length = 345 (0x159) bytes UDP: CheckSum = 0xC551 UDP: Data: Number of data bytes remaining = 337 (0x0151) NBT: NS: Query (Node Status) resp. for *<00...(15)>, Success NBT: Transaction ID = 32860 (0x805C) NBT: Flags Summary = 0x8400—Resp.; Query; Success NBT: 1............... = Response NBT: .0000........... = Query NBT: .....1.......... = Authoritative Answer NBT: ......0......... = Datagram not truncated NBT: .......0........ = Recursion not desired NBT: ........0....... = Recursion not available NBT: .........0...... = Reserved NBT: ..........0..... = Reserved NBT: ...........0.... = Not a broadcast packet NBT: ............0000 = Success NBT: Question Count = 0 (0x0) NBT: Answer Count = 1 (0x1) NBT: Name Service Count = 0 (0x0) NBT: Additional Record Count = 0 (0x0) NBT: Resource Record Name = *<00...(15)> NBT: Resource Record Type = Node Status Request NBT: Resource Record Class = Internet Class NBT: Time To Live = 0 (0x0) NBT: RDATA Length = 263 (0x107) NBT: Number of Names = 12 (0xC) NBT: ASCII Name = SCOTTSU_NT40 NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40 00 NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40D 00 NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40D <1C> NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40D <1B> NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40D <1E> NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40 <03> NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40D <1D> NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = <01><02>__MSBROWSE__<02><01> NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: ASCII Name = INet~Services <1C> NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: ASCII Name = IS~SCOTTSU_NT4000 NBT: Resource Record Flags = 17408 (0x4400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 0............... = Unique NetBIOS Name NBT: ASCII Name = SCOTTSU_NT40żżżż NBT: Resource Record Flags = 50176 (0xC400) NBT: ......0......... = Non-Permanent NBT: .....1.......... = Active Name NBT: ....0........... = Name is not in Conflict NBT: ...0............ = Not Deregistering NBT: .10............. = M Node NBT: 1............... = Group NetBIOS Name NBT: Adapter Address = 00A02463AB22 NBT: Version Major = 0 (0x0) NBT: Version Minor = 0 (0x0) NBT: Duration = 0 (0x0) NBT: FRMRs Received = 0 (0x0) NBT: FRMRs Transmitted = 0 (0x0) NBT: IFrame Receive Errors = 0 (0x0) NBT: Transmit Aborts = 0 (0x0) NBT: Tranmitted = 0 (0x0) NBT: Received = 0 (0x0) NBT: IFrame Transmit Errors = 0 (0x0) NBT: No Receive Buffers = 0 (0x0) NBT: T1 Timeouts = 0 (0x0) NBT: Ti Timeouts = 0 (0x0) NBT: Free NCBS = 0 (0x0) NBT: NCBS = 0 (0x0) NBT: Max NCBS = 0 (0x0) NBT: No Transmit Buffers = 255 (0xFF) NBT: Max Datagram = 799 (0x31F) NBT: Pending Sessions = 32 (0x20) NBT: Max Sessions = 33008 (0x80F0) NBT: Packet Size = 20976 (0x51F0)
Now the client is going to do the TCP 3 way handshake.
5 4.257 SCOTTSU-7 SCOTTSU_NT40 TCP ....S., len: 4, seq: 2817881, ack: 0, win: 8192 IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 TCP: ....S., len: 4, seq: 2817881, ack: 0, win: 8192, src: 1056 dst: 139 (NBT Session) 6 4.257 SCOTTSU_NT40 SCOTTSU-7 TCP .A..S., len: 4, seq: 5416017, ack: 2817882, win: 8760, src SCOTTSU_NT40 SCOTTSU-7 IP IP: Source Address = 157.55.100.204 IP: Destination Address = 157.55.102.52 TCP: .A..S., len: 4, seq: 5416017, ack: 2817882, win: 8760, src: 139 (NBT Session) dst: 1056 7 4.258 SCOTTSU-7 SCOTTSU_NT40 TCP .A...., len: 0, seq: 2817882, ack: 5416018, win: 8760 IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 TCP: .A...., len: 0, seq: 2817882, ack: 5416018, win: 8760, src: 1056 dst: 139 (NBT Session)
Now the client will send a NetBT Session Request to the NetBIOS server name (not the HOST name).
8 4.259 SCOTTSU-7 SCOTTSU_NT40 NBT SS: Session Request, Dest: SCOTTSU_NT40 IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 TCP: .AP..., len: 72, seq: 2817882, ack: 5416018, win: 8760, src: 1056 dst: 139 (NBT Session) TCP: Source Port = 0x0420 TCP: Destination Port = NETBIOS Session Service TCP: Sequence Number = 2817882 (0x2AFF5A) TCP: Acknowledgement Number = 5416018 (0x52A452) TCP: Data Offset = 20 (0x14) TCP: Reserved = 0 (0x0000) TCP: Flags = 0x18 : .AP... TCP: ..0..... = No urgent data TCP: ...1.... = Acknowledgement field significant TCP: ....1... = Push function TCP: .....0.. = No Reset TCP: ......0. = No Synchronize TCP: .......0 = No Fin TCP: Window = 8760 (0x2238) TCP: CheckSum = 0x722C TCP: Urgent Pointer = 0 (0x0) TCP: Data: Number of data bytes remaining = 72 (0x0048) NBT: SS: Session Request, Dest: SCOTTSU_NT40 , Source: SCOTTSU-7 <00>, Len: 68 NBT: Packet Type = Session Request NBT: Packet Flags = 0 (0x0) NBT: .......0 = Add 0 to Length NBT: Packet Length = 68 (0x44) NBT: Called Name = SCOTTSU_NT40 NBT: Calling Name = SCOTTSU-7 <00>
This is a positive session response from the server.
9 4.259 SCOTTSU_NT40 SCOTTSU-7 NBT SS: Positive Session Response, Len: 0 IP: Source Address = 157.55.100.204 IP: Destination Address = 157.55.102.52 TCP: .AP..., len: 4, seq: 5416018, ack: 2817954, win: 8688, src: 139 (NBT Session) dst: 1056 TCP: Source Port = NETBIOS Session Service TCP: Destination Port = 0x0420 TCP: Sequence Number = 5416018 (0x52A452) TCP: Acknowledgement Number = 2817954 (0x2AFFA2) TCP: Data Offset = 20 (0x14) TCP: Reserved = 0 (0x0000) TCP: Flags = 0x18 : .AP... TCP: ..0..... = No urgent data TCP: ...1.... = Acknowledgement field significant TCP: ....1... = Push function TCP: .....0.. = No Reset TCP: ......0. = No Synchronize TCP: .......0 = No Fin TCP: Window = 8688 (0x21F0) TCP: CheckSum = 0x5D4C TCP: Urgent Pointer = 0 (0x0) TCP: Data: Number of data bytes remaining = 4 (0x0004) NBT: SS: Positive Session Response, Len: 0 NBT: Packet Type = Positive Session Response NBT: Packet Flags = 0 (0x0) NBT: .......0 = Add 0 to Length NBT: Packet Length = 0 (0x0)
Now we will begin to set up a session between the redirector and the server (application layer). This starts out with a negotiate frame.
10 4.262 SCOTTSU-7 SCOTTSU_NT40 SMB C negotiate, Dialect = NT LM 0.12 11 4.276 SCOTTSU_NT40 SCOTTSU-7 SMB R negotiate, Dialect # = 7
Now we are going to set up the session between the redirector and the server. This frame also has a Tree Connect attached to it. Note that the server name in the Tree Connect is the HOST name. The redirector doesn't actually use this name. It only knows about the NetBIOS computer name.
12 4.275 SCOTTSU-7 SCOTTSU_NT40 SMB C session setup & X, and C tree connect IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 TCP: .AP..., len: 314, seq: 2818128, ack: 5416131, win: 8647, src: 1056 dst: 139 (NBT Session) TCP: Source Port = 0x0420 TCP: Destination Port = NETBIOS Session Service TCP: Sequence Number = 2818128 (0x2B0050) TCP: Acknowledgement Number = 5416131 (0x52A4C3) TCP: Data Offset = 20 (0x14) TCP: Reserved = 0 (0x0000) TCP: Flags = 0x18 : .AP... TCP: ..0..... = No urgent data TCP: ...1.... = Acknowledgement field significant TCP: ....1... = Push function TCP: .....0.. = No Reset TCP: ......0. = No Synchronize TCP: .......0 = No Fin TCP: Window = 8647 (0x21C7) TCP: CheckSum = 0x5638 TCP: Urgent Pointer = 0 (0x0) TCP: Data: Number of data bytes remaining = 314 (0x013A) NBT: SS: Session Message, Len: 310 NBT: Packet Type = Session Message NBT: Packet Flags = 0 (0x0) NBT: .......0 = Add 0 to Length NBT: Packet Length = 310 (0x136) NBT: SS Data: Number of data bytes remaining = 310 (0x0136) SMB: C session setup & X, Username = Administrator, and C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\IPC$ SMB: SMB Status = Error Success SMB: Error class = No Error SMB: Error code = No Error SMB: Header: PID = 0xCAFE TID = 0x0000 MID = 0x0000 UID = 0x0000 SMB: Tree ID (TID) = 0 (0x0) SMB: Process ID (PID) = 51966 (0xCAFE) SMB: User ID (UID) = 0 (0x0) SMB: Multiplex ID (MID) = 0 (0x0) SMB: Flags Summary = 24 (0x18) SMB: .......0 = Lock & Read and Write & Unlock not supported SMB: ......0. = Send No Ack not supported SMB: ....1... = Using caseless pathnames SMB: ...1.... = Canonicalized pathnames SMB: ..0..... = No Opportunistic lock SMB: .0...... = No Change Notify SMB: 0....... = Client command SMB: flags2 Summary = 32771 (0x8003) SMB: ...............1 = Understands long filenames SMB: ..............1. = Understands extended attributes SMB: ..0............. = No paging of IO SMB: .0.............. = Using SMB status codes SMB: 1............... = Using UNICODE strings SMB: Command = C session setup & X SMB: Word count = 13 SMB: Word parameters SMB: Next offset = 0x00E8 SMB: Max Buffer Size = 4356 SMB: Max MPX requests = 50 SMB: VC number = 0 SMB: Session Key = 0 SMB: Password length = 24 (0x18) SMB: Unicode Password length = 24 (0x18) SMB: Capabilities = 212 (0xD4) SMB: ...............................0 = No Raw Reads and Writes. SMB: ..............................0. = No support for multiplexed commands. SMB: .............................1.. = Supports UNICODE strings. SMB: ............................0... = Does not support large files. SMB: ...........................1.... = Supports the NT SMB extensions. SMB: ..........................0..... = RPC remote API's not supported. SMB: .........................1...... = Recognizes NT Status codes. SMB: ........................1....... = Supports level II oplocks. SMB: .......................0........ = Does not support Lock and Read. SMB: Byte count = 171 SMB: Byte parameters SMB: Account name = Administrator SMB: Domain name = SCOTTSU_NT40D SMB: Native OS = Windows NT 1307 SMB: Native Lanman = Windows NT 4.0 SMB: Command = C tree connect & X SMB: Word count = 4 SMB: Word parameters SMB: Next offset = 0x0000 SMB: Disconnect flag = 0x0000 SMB: Password length = 1 (0x1) SMB: Byte count = 67 SMB: Byte parameters SMB: Password = SMB: Path name = \\SCOTTSUPDC.SCOTTSU.COM\IPC$ 13 4.289 SCOTTSU_NT40 SCOTTSU-7 TCP ...R.., len: 0, seq: 4933305, ack: 2818128, win: 0 14 4.289 SCOTTSU_NT40 SCOTTSU-7 TCP ...R.., len: 0, seq: 3578897, ack: 2818128, win: 0 15 4.297 SCOTTSU_NT40 SCOTTSU-7 SMB R session setup & X, and R tree connect & X, Type = IPC 16 4.479 SCOTTSU-7 SCOTTSU_NT40 TCP .A...., len: 0, seq: 2818442, ack: 5416289, win: 8489 17 4.637 SCOTTSU-7 SCOTTSU_NT40 SMB C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\C$ IP: Source Address = 157.55.102.52 IP: Destination Address = 157.55.100.204 TCP: .AP..., len: 107, seq: 2818442, ack: 5416289, win: 8489, src: 1056 dst: 139 (NBT Session) TCP: Source Port = 0x0420 TCP: Destination Port = NETBIOS Session Service TCP: Sequence Number = 2818442 (0x2B018A) TCP: Acknowledgement Number = 5416289 (0x52A561) TCP: Data Offset = 20 (0x14) TCP: Reserved = 0 (0x0000) TCP: Flags = 0x18 : .AP... TCP: ..0..... = No urgent data TCP: ...1.... = Acknowledgement field significant TCP: ....1... = Push function TCP: .....0.. = No Reset TCP: ......0. = No Synchronize TCP: .......0 = No Fin TCP: Window = 8489 (0x2129) TCP: CheckSum = 0x99CE TCP: Urgent Pointer = 0 (0x0) TCP: Data: Number of data bytes remaining = 107 (0x006B) NBT: SS: Session Message, Len: 103 NBT: Packet Type = Session Message NBT: Packet Flags = 0 (0x0) NBT: .......0 = Add 0 to Length NBT: Packet Length = 103 (0x67) NBT: SS Data: Number of data bytes remaining = 103 (0x0067) SMB: C tree connect & X, Share = \\SCOTTSUPDC.SCOTTSU.COM\C$ SMB: SMB Status = Error Success SMB: Error class = No Error SMB: Error code = No Error SMB: Header: PID = 0xCAFE TID = 0x0000 MID = 0x0040 UID = 0x0801 SMB: Tree ID (TID) = 0 (0x0) SMB: Process ID (PID) = 51966 (0xCAFE) SMB: User ID (UID) = 2049 (0x801) SMB: Multiplex ID (MID) = 64 (0x40) SMB: Flags Summary = 24 (0x18) SMB: .......0 = Lock & Read and Write & Unlock not supported SMB: ......0. = Send No Ack not supported SMB: ....1... = Using caseless pathnames SMB: ...1.... = Canonicalized pathnames SMB: ..0..... = No Opportunistic lock SMB: .0...... = No Change Notify SMB: 0....... = Client command SMB: flags2 Summary = 32771 (0x8003) SMB: ...............1 = Understands long filenames SMB: ..............1. = Understands extended attributes SMB: ..0............. = No paging of IO SMB: .0.............. = Using SMB status codes SMB: 1............... = Using UNICODE strings SMB: Command = C tree connect & X SMB: Word count = 4 SMB: Word parameters SMB: Next offset = 0x0000 SMB: Disconnect flag = 0x0000 SMB: Password length = 1 (0x1) SMB: Byte count = 60 SMB: Byte parameters SMB: Password = SMB: Path name = \\SCOTTSUPDC.SCOTTSU.COM\C$ 18 4.654 SCOTTSU_NT40 SCOTTSU-7 SMB R tree connect & X, Type = A: