cc
03-10-04, 17:41
hallo
unsere AS400 maschine hat 2 interfaces:
10.20.1.222 für token ring netz 10.20.0.0
und
10.30.1.333 für ethernet netz 10.30.0.0
gemäss einen sniff fachmann unsere AS400 verhält sich wie ein WINS Server und antwortet auf WINS Broadcasts anfragen.
wie kann man dies unterbinden ?
mit go tcpadm und START/END TCP/IP servers finde ich kein WINS.
sniff log:
651 [10.20.1.222] CHTHL-SNIFF1 100 0:00:46.020
0.001.459 08.09.2004 17:29:50 WINS: R ID=33039 OP=WACK STAT=OK
DLC: ----- DLC Header -----
DLC:
DLC: Frame 651 arrived at 16:29:50.6226; frame size is 100 (0064 hex) bytes.
DLC: Destination = Station 000F1FA2206F
DLC: Source = Station IBM DE4F9D
DLC: Ethertype = 0800 (IP)
DLC:
IP: ----- IP Header -----
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP: 000. .... = routine
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = ECT bit - transport protocol will ignore the CE bit
IP: .... ...0 = CE bit - no congestion
IP: Total length = 86 bytes
IP: Identification = 10770
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = 384F (correct)
IP: Source address = [10.20.1.222]
IP: Destination address = [10.20.2.4], CHTHL-SNIFF1
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 137 (NetBIOS-ns)
UDP: Destination port = 137 (NetBIOS-ns)
UDP: Length = 66
UDP: Checksum = 5DAB (correct)
UDP: [58 byte(s) of data]
UDP:
WINS: ----- WINS Name Service header -----
WINS:
WINS: ID = 33039
WINS: Flags = BC
WINS: 1... .... = Response
WINS: .... .1.. = Authoritative answer
WINS: .011 1... = WACK
WINS: .... ..0. = Not truncated
WINS: Flags = 0X
WINS: ..0. .... = Data NOT verified
WINS: 0... .... = Recursion not available
WINS: Response code = OK (0)
WINS: ...0 .... = Unicast packet
WINS: Question count = 0
WINS: Answer count = 1
WINS: Authority count = 0
WINS: Additional record count = 0
WINS:
WINS: Answer section:
WINS: Name = EU<1C> <Domain Controller>
WINS: Type = NetBIOS name service (WINS) (NetBIOS name,32)
WINS: Class = Internet (IN,1)
WINS: Time-to-live = 10 (seconds)
WINS: Length = 2
WINS:
ADDR HEX ASCII
0000: 00 0f 1f a2 20 6f 00 04 ac de 4f 9d 08 00 45 00 | ...¢ o..¬ÞO..E.
0010: 00 56 2a 12 00 00 40 11 38 4f 0a 29 01 e1 0a 29 | .V*...@.8O.).á.)
0020: 02 04 00 89 00 89 00 42 5d ab 81 0f bc 00 00 00 | ...‰.‰.B]«.¼...
0030: 00 01 00 00 00 00 20 45 46 46 46 43 41 43 41 43 | ...... EFFFCACAC
0040: 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 43 | ACACACACACACACAC
0050: 41 43 41 43 41 42 4d 00 00 20 00 01 00 00 00 0a | ACACABM.. ......
0060: 00 02 01 00 | ....
- - - - - - - - - - - - - - - - - - - - Frame 652 - - - - - - - - - - - - - - - - - - - -
Frame Status Source Destination Bytes Rel Time
Delta Time Abs time Summary
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
652 [10.30.1.333] CHTHL-SNIFF1 98 0:00:46.031
0.010.121 08.09.2004 17:29:50 WINS: R ID=33039 OP=QUERY STAT=Name error
DLC: ----- DLC Header -----
DLC:
DLC: Frame 652 arrived at 16:29:50.6327; frame size is 98 (0062 hex) bytes.
DLC: Destination = Station 000F1FA2206F
DLC: Source = Station 000C85E5BB00
DLC: Ethertype = 0800 (IP)
DLC:
IP: ----- IP Header -----
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP: 000. .... = routine
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = ECT bit - transport protocol will ignore the CE bit
IP: .... ...0 = CE bit - no congestion
IP: Total length = 84 bytes
IP: Identification = 10772
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 62 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = 39C3 (correct)
IP: Source address = [10.30.1.333]
IP: Destination address = [10.20.2.4], CHTHL-SNIFF1
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 137 (NetBIOS-ns)
UDP: Destination port = 137 (NetBIOS-ns)
UDP: Length = 64
UDP: Checksum = 9542 (correct)
UDP: [56 byte(s) of data]
UDP:
WINS: ----- WINS Name Service header -----
WINS:
WINS: ID = 33039
WINS: Flags = 85
WINS: 1... .... = Response
WINS: .... .1.. = Authoritative answer
WINS: .000 0... = Query
WINS: .... ..0. = Not truncated
WINS: Flags = 0X
WINS: ..0. .... = Data NOT verified
WINS: 0... .... = Recursion not available
WINS: Response code = Name error (3)
WINS: ...0 .... = Unicast packet
WINS: Question count = 0
WINS: Answer count = 1
WINS: Authority count = 0
WINS: Additional record count = 0
WINS:
WINS: Answer section:
WINS: Name = EU<1C> <Domain Controller>
WINS: Type = Nop (NULL,10)
WINS: Class = Internet (IN,1)
WINS: Time-to-live = 0 (seconds)
WINS: Length = 0
WINS:
ADDR HEX ASCII
0000: 00 0f 1f a2 20 6f 00 0c 85 e5 bb 00 08 00 45 00 | ...¢ o..…å»...E.
0010: 00 54 2a 14 00 00 3e 11 39 c3 0a b5 01 e1 0a 29 | .T*...>.9Ã.µ.á.)
0020: 02 04 00 89 00 89 00 40 95 42 81 0f 85 03 00 00 | ...‰.‰.@•B.…...
0030: 00 01 00 00 00 00 20 45 46 46 46 43 41 43 41 43 | ...... EFFFCACAC
0040: 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 43 | ACACACACACACACAC
0050: 41 43 41 43 41 42 4d 00 00 0a 00 01 00 00 00 00 | ACACABM.........
0060: 00 00 | ..
unsere AS400 maschine hat 2 interfaces:
10.20.1.222 für token ring netz 10.20.0.0
und
10.30.1.333 für ethernet netz 10.30.0.0
gemäss einen sniff fachmann unsere AS400 verhält sich wie ein WINS Server und antwortet auf WINS Broadcasts anfragen.
wie kann man dies unterbinden ?
mit go tcpadm und START/END TCP/IP servers finde ich kein WINS.
sniff log:
651 [10.20.1.222] CHTHL-SNIFF1 100 0:00:46.020
0.001.459 08.09.2004 17:29:50 WINS: R ID=33039 OP=WACK STAT=OK
DLC: ----- DLC Header -----
DLC:
DLC: Frame 651 arrived at 16:29:50.6226; frame size is 100 (0064 hex) bytes.
DLC: Destination = Station 000F1FA2206F
DLC: Source = Station IBM DE4F9D
DLC: Ethertype = 0800 (IP)
DLC:
IP: ----- IP Header -----
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP: 000. .... = routine
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = ECT bit - transport protocol will ignore the CE bit
IP: .... ...0 = CE bit - no congestion
IP: Total length = 86 bytes
IP: Identification = 10770
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 64 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = 384F (correct)
IP: Source address = [10.20.1.222]
IP: Destination address = [10.20.2.4], CHTHL-SNIFF1
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 137 (NetBIOS-ns)
UDP: Destination port = 137 (NetBIOS-ns)
UDP: Length = 66
UDP: Checksum = 5DAB (correct)
UDP: [58 byte(s) of data]
UDP:
WINS: ----- WINS Name Service header -----
WINS:
WINS: ID = 33039
WINS: Flags = BC
WINS: 1... .... = Response
WINS: .... .1.. = Authoritative answer
WINS: .011 1... = WACK
WINS: .... ..0. = Not truncated
WINS: Flags = 0X
WINS: ..0. .... = Data NOT verified
WINS: 0... .... = Recursion not available
WINS: Response code = OK (0)
WINS: ...0 .... = Unicast packet
WINS: Question count = 0
WINS: Answer count = 1
WINS: Authority count = 0
WINS: Additional record count = 0
WINS:
WINS: Answer section:
WINS: Name = EU<1C> <Domain Controller>
WINS: Type = NetBIOS name service (WINS) (NetBIOS name,32)
WINS: Class = Internet (IN,1)
WINS: Time-to-live = 10 (seconds)
WINS: Length = 2
WINS:
ADDR HEX ASCII
0000: 00 0f 1f a2 20 6f 00 04 ac de 4f 9d 08 00 45 00 | ...¢ o..¬ÞO..E.
0010: 00 56 2a 12 00 00 40 11 38 4f 0a 29 01 e1 0a 29 | .V*...@.8O.).á.)
0020: 02 04 00 89 00 89 00 42 5d ab 81 0f bc 00 00 00 | ...‰.‰.B]«.¼...
0030: 00 01 00 00 00 00 20 45 46 46 46 43 41 43 41 43 | ...... EFFFCACAC
0040: 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 43 | ACACACACACACACAC
0050: 41 43 41 43 41 42 4d 00 00 20 00 01 00 00 00 0a | ACACABM.. ......
0060: 00 02 01 00 | ....
- - - - - - - - - - - - - - - - - - - - Frame 652 - - - - - - - - - - - - - - - - - - - -
Frame Status Source Destination Bytes Rel Time
Delta Time Abs time Summary
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
652 [10.30.1.333] CHTHL-SNIFF1 98 0:00:46.031
0.010.121 08.09.2004 17:29:50 WINS: R ID=33039 OP=QUERY STAT=Name error
DLC: ----- DLC Header -----
DLC:
DLC: Frame 652 arrived at 16:29:50.6327; frame size is 98 (0062 hex) bytes.
DLC: Destination = Station 000F1FA2206F
DLC: Source = Station 000C85E5BB00
DLC: Ethertype = 0800 (IP)
DLC:
IP: ----- IP Header -----
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP: 000. .... = routine
IP: ...0 .... = normal delay
IP: .... 0... = normal throughput
IP: .... .0.. = normal reliability
IP: .... ..0. = ECT bit - transport protocol will ignore the CE bit
IP: .... ...0 = CE bit - no congestion
IP: Total length = 84 bytes
IP: Identification = 10772
IP: Flags = 0X
IP: .0.. .... = may fragment
IP: ..0. .... = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live = 62 seconds/hops
IP: Protocol = 17 (UDP)
IP: Header checksum = 39C3 (correct)
IP: Source address = [10.30.1.333]
IP: Destination address = [10.20.2.4], CHTHL-SNIFF1
IP: No options
IP:
UDP: ----- UDP Header -----
UDP:
UDP: Source port = 137 (NetBIOS-ns)
UDP: Destination port = 137 (NetBIOS-ns)
UDP: Length = 64
UDP: Checksum = 9542 (correct)
UDP: [56 byte(s) of data]
UDP:
WINS: ----- WINS Name Service header -----
WINS:
WINS: ID = 33039
WINS: Flags = 85
WINS: 1... .... = Response
WINS: .... .1.. = Authoritative answer
WINS: .000 0... = Query
WINS: .... ..0. = Not truncated
WINS: Flags = 0X
WINS: ..0. .... = Data NOT verified
WINS: 0... .... = Recursion not available
WINS: Response code = Name error (3)
WINS: ...0 .... = Unicast packet
WINS: Question count = 0
WINS: Answer count = 1
WINS: Authority count = 0
WINS: Additional record count = 0
WINS:
WINS: Answer section:
WINS: Name = EU<1C> <Domain Controller>
WINS: Type = Nop (NULL,10)
WINS: Class = Internet (IN,1)
WINS: Time-to-live = 0 (seconds)
WINS: Length = 0
WINS:
ADDR HEX ASCII
0000: 00 0f 1f a2 20 6f 00 0c 85 e5 bb 00 08 00 45 00 | ...¢ o..…å»...E.
0010: 00 54 2a 14 00 00 3e 11 39 c3 0a b5 01 e1 0a 29 | .T*...>.9Ã.µ.á.)
0020: 02 04 00 89 00 89 00 40 95 42 81 0f 85 03 00 00 | ...‰.‰.@•B.…...
0030: 00 01 00 00 00 00 20 45 46 46 46 43 41 43 41 43 | ...... EFFFCACAC
0040: 41 43 41 43 41 43 41 43 41 43 41 43 41 43 41 43 | ACACACACACACACAC
0050: 41 43 41 43 41 42 4d 00 00 0a 00 01 00 00 00 00 | ACACABM.........
0060: 00 00 | ..