[Samba] Intermittent stalling in file transfers / server connections

[Philip Pemberton]

Samba version 3.2.3, in PDC mode

Client PC is Windows XP SP3 32-bit

Server is a standard Intel Atom230 PC, four Ethernet ports, running Ubuntu
Server 8.10. It provides Internet access (routing/perimeter firewall, dnsmasq
DNS/DHCP server), email (Fetchmail, Postfix and Procmail), printing (CUPS) and
Apache+PHP+MySQL for webapp testing.


I'm trying to track down an issue with my Samba server. Basically, I can be
happily transferring files to/from it for a couple of hours, then suddenly
(and seemingly randomly), the transfer will stall for about 30 seconds. This
is typified by Winamp's audio output stopping for 30 seconds, then restarting
from where it left off (or sometimes 30 seconds further on). Usually the apps
that are running on the XP box will continue running, but Explorer won't allow
access to Start->Run or start any more apps until after the 30-second wait.

I've done all the network tests -- swapping ports on the server (and client)
sides, swapping cables, pinging back and forth... Even during the 30-second
wait, I can still access the server and other machines on the LAN (ping, SSH,
you name it). Just that Samba itself doesn't seem to work properly...

Here's my smb.conf:

=======================================

[global]
netbios name = wolf
workgroup = MILKYWAY
server string = Fileserver

# socket options = TCP_NODELAY SO_RCVBUF=8192 SO_SNDBUF=8192
SO_KEEPALIVE
# only bind to internal LAN and loopback -- security precaution (stops nosey
# parkers talking to Samba even if the firewall is down)
interfaces = br0 lo
bind interfaces only = yes
# only provide SMB service on port 139
smb ports = 139

# Make nmbd periodically announce itself to the LAN
# remote announce = 10.255.255.255

# CHANGE BACK TO 50 WHEN FINISHED DEBUGGING!
max log size = 1024
# CHANGE BACK TO 1 WHEN FINISHED DEBUGGING!
log level = 10
log file = /var/log/samba/log.%m

# Basically, this makes Samba lookup unregistered netbios names against the
# DNS server (dnsmasq). In our case, this does a lookup against /etc/hosts
# and whatever machines have registered a hostname with dnsmasq's DHCP
# backend.
dns proxy = yes

# Use user-level security
security = user

# Act as a PDC for this workgroup
domain logons = yes
domain master = yes

# Make sure the Samba server maintains the role of master browser.
# NOTE: No other Samba server should have its OS level set higher than
# this server.
local master = yes
preferred master = yes
os level = 99

# A file that maps Windows usernames to Unix ones
username map = /etc/samba/smbusers

# logon path tells Samba where to put Windows NT/2000/XP roaming profiles.
# Problem is, it takes bloody ages to sync roaming profiles across the LAN
# (even a 100MBit LAN). Ergo, this is set to a blank string, which disables
# roaming profiles.
; logon path = \\%L\profiles\%u\%m
; logon path = \\%L\profiles\%U
logon path =

# Run \\%L\netlogon\logon.bat on the client machine when a user logs onto
# the domain
logon script = logon.bat

# Tell NT/2K/XP boxen where to mount the Home Directory
# This basically makes NT/2K/XP run "NET USE Z: /HOME" at logon.
logon drive = Z:
logon home = \\%L\%U
; logon home = \\%L\%U\.win_profile

# Act as a time server
time server = yes

# Dynamically create UNIX users and machines to match existing NT accounts
# and machines that are added to the domain.
add user script = /usr/sbin/useradd -d /dev/null -g 100 -s
/bin/false -M %u
add machine script = /usr/sbin/useradd -d /dev/null -g machines
-c Machine -s /bin/false %u

# This server uses CUPS to provide printing functionality to the network.
printing = cups

;;;;;;;;;; Networking / roaming profiles ;;;;;;;;;;

[netlogon]
path = /samba/netlogon
comment = Logon scripts and policies
create mask = 0644
write list = root, philpem
writable = no
browsable = no

[homes]
comment = Home directories
browsable = no
writable = yes
valid users = %S
read only = no
create mask = 0644
directory mask = 0755

;;;;;;;;;; Printing ;;;;;;;;;;

[printers]
comment = Printers
path = /var/spool/samba
guest ok = yes
printable = yes
browsable = no

[print$]
comment = Printer drivers
path = /etc/samba/drivers
write list = root, philpem

;;;;;;;;;; Shares ;;;;;;;;;;

[public]
comment = Public share
path = /samba/public
read only = no
guest ok = no
create mask = 0666
directory mask = 0777

[music]
comment = Music
path = /samba/music
read only = no
guest ok = yes
create mask = 0666
directory mask = 0777

[riscos]
comment = RISC OS files
path = /samba/riscos
read only = no
guest ok = no
create mask = 0666
directory mask = 0777

[torrents]
comment = BitTorrent
path = /samba/torrents
read only = no
guest ok = no
create mask = 0666
directory mask = 0777

[cds]
comment = CDs
path = /samba/cds
read only = yes
write list = root, philpem
guest ok = no

=======================================

I added the 'smb ports = 139', 'max log size' and 'log level' lines to try and
track down the issue -- the log files are pretty massive, but contain very
little that makes any sense to me :(

Can anyone help?

Thanks,

[Volker Lendecke]

Post by Philip Pemberton
I added the 'smb ports = 139', 'max log size' and 'log level' lines to
try and track down the issue -- the log files are pretty massive, but
contain very little that makes any sense to me :(

Well, we could possibly make more sense of them if we saw
them. In particular the part where the timeout happens. A
couple of 100 lines before that and some 100's of lines
after that timeout is necessary.

Volker

[Philip Pemberton]

Post by Volker Lendecke
Well, we could possibly make more sense of them if we saw
them. In particular the part where the timeout happens. A
couple of 100 lines before that and some 100's of lines
after that timeout is necessary.

Problem is, they're over the posting limit for the list...

OK, here we go -- shoved in the /temp area of my website:

Samba log (smbd.log): http://www.philpem.me.uk/temp/samba/smbd_log.txt
Samba log (cheetah.log): http://www.philpem.me.uk/temp/samba/cheetah_log.txt
Wireshark trace: http://www.philpem.me.uk/temp/samba/wireshark_log.txt

The machines are:
Wolf (10.0.0.1) -- Server. Ubuntu Server 8.10. MAC=Jetway.
Cheetah (10.0.0.8) -- Client. Windows XP SP3. MAC=ASUSTeK.

The stalling starts at around packet 8882 in the Wireshark log (the gap
between 8882 and 8883 *is* the stall), which equates to 11:25:43 AM. The stall
seems to end at 11:26:02 AM (packet 8883). Both machines sync their clocks on
boot, so the timing should be within a second or so of each other.

Thanks,

[Philip Pemberton]

Post by Philip Pemberton
Samba log (smbd.log): http://www.philpem.me.uk/temp/samba/smbd_log.txt
Samba log (cheetah.log): http://www.philpem.me.uk/temp/samba/cheetah_log.txt
Wireshark trace: http://www.philpem.me.uk/temp/samba/wireshark_log.txt

My fault: I should have pointed you at
http://wiki.samba.org/index.php/Capture_Packets.
The stdout of tcpdump or wireshark is unfortunately not very
helpful.

Here's the Wireshark trace in pcap format, including payload data:
http://www.philpem.me.uk/temp/samba/wireshark_log.pcap

Thanks,

[Volker Lendecke]

Post by Philip Pemberton

Post by Philip Pemberton
Samba log (smbd.log): http://www.philpem.me.uk/temp/samba/smbd_log.txt
Samba log (cheetah.log): http://www.philpem.me.uk/temp/samba/cheetah_log.txt
Wireshark trace: http://www.philpem.me.uk/temp/samba/wireshark_log.txt

My fault: I should have pointed you at
http://wiki.samba.org/index.php/Capture_Packets.
The stdout of tcpdump or wireshark is unfortunately not very
helpful.

http://www.philpem.me.uk/temp/samba/wireshark_log.pcap

[2009/07/01 11:25:54, 10] auth/token_util.c:create_local_nt_token(302)
Create local NT token for S-1-5-352321536-2508637403-2619729926-3515545951-501
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-544

Hmm. That is strange. Your Samba server is a domain member
with winbind? Can you find out what winbind is doing while
such a timeout happens?

Volker

[Philip Pemberton]

Post by Volker Lendecke
[2009/07/01 11:25:54, 10] auth/token_util.c:create_local_nt_token(302)
Create local NT token for

S-1-5-352321536-2508637403-2619729926-3515545951-501

Post by Volker Lendecke
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-544
Hmm. That is strange. Your Samba server is a domain member
with winbind?

No, the Samba server is supposed to be a PDC for my network. The WinXP box is
a domain member.

Post by Volker Lendecke
Can you find out what winbind is doing while
such a timeout happens?

Here's the Winbind log, starting roughly where the Samba daemon and cheetah
logs start, but running to the end:
http://www.philpem.me.uk/temp/samba/winbind_log.txt

Thanks,

[Volker Lendecke]

Post by Volker Lendecke

Post by Volker Lendecke
[2009/07/01 11:25:54, 10] auth/token_util.c:create_local_nt_token(302)
Create local NT token for

S-1-5-352321536-2508637403-2619729926-3515545951-501

Post by Volker Lendecke
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-544
Hmm. That is strange. Your Samba server is a domain member
with winbind?

No, the Samba server is supposed to be a PDC for my network. The WinXP
box is a domain member.

Does your domain trust another domain? This would be the
only scenario that makes winbind on a PDC necessary.

If not, if I was you I would try to just stop winbind.

Volker

[Philip Pemberton]

Post by Volker Lendecke
Does your domain trust another domain? This would be the
only scenario that makes winbind on a PDC necessary.

Nope, it's a single standalone domain.

The domain is "MILKYWAY" (a throwback to an earlier network); the DNS suffix
is set to "homenet.philpem.me.uk".

Post by Volker Lendecke
If not, if I was you I would try to just stop winbind.

I was going to say something along the lines of "but it's not turned on in
smb.conf", but it seems the Ubuntu boot scripts start it by default... I've
stopped winbindd (via 'sudo /etc/init.d/winbind stop'). In about two hours
I'll know whether it's worked...

Thanks,

[Philip Pemberton]

Post by Volker Lendecke
Does your domain trust another domain? This would be the
only scenario that makes winbind on a PDC necessary.
If not, if I was you I would try to just stop winbind.

Winbind's been stopped, and my network is working!

All the stalling seems to have vanished, and as an extra bonus, network
browsing seems to be a lot snappier. Winbind is now on my "things to turn off
after an Ubuntu Server installation" list...

Thanks!

[Volker Lendecke]

Post by Philip Pemberton

Post by Volker Lendecke
Well, we could possibly make more sense of them if we saw
them. In particular the part where the timeout happens. A
couple of 100 lines before that and some 100's of lines
after that timeout is necessary.

Problem is, they're over the posting limit for the list...
Samba log (smbd.log): http://www.philpem.me.uk/temp/samba/smbd_log.txt
Samba log (cheetah.log): http://www.philpem.me.uk/temp/samba/cheetah_log.txt
Wireshark trace: http://www.philpem.me.uk/temp/samba/wireshark_log.txt

My fault: I should have pointed you at
http://wiki.samba.org/index.php/Capture_Packets.
The stdout of tcpdump or wireshark is unfortunately not very
helpful.

Sorry,

Volker

[Philip Pemberton]

Post by Volker Lendecke
Well, we could possibly make more sense of them if we saw
them. In particular the part where the timeout happens. A
couple of 100 lines before that and some 100's of lines
after that timeout is necessary.

OK, I've got a Wireshark (tcpdump/Ethereal) trace of the time around the error
(+/- 100 packets or so), and the logs. The server is "10.0.0.1" aka "wolf" and
has a Jetway MAC address, the client is "10.0.0.8" aka "cheetah" and has the
ASUSTeK MAC. The stall starts at around packet #8882 in the WS log, which
equates to around 11:25:43 AM; transfer resumes around 11:26:02. It looks to
me like either the client is stalling out, or Samba is (for some reason)
stopping sending data. I can't make head nor tail of the Samba log, and the XP
box is keeping tight-lipped (there's nothing in the system error log)...


I'll start with the Samba logs:

--------------------------------- log.smbd
[2009/07/01 11:25:40, 6] param/loadparm.c:lp_file_list_changed(6724)
lp_file_list_changed()
file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Jun 19
22:00:21 2009

[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:25:40, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:25:50, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_KEEPALIVE = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_REUSEADDR = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_BROADCAST = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_NODELAY = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPCNT = 9
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPIDLE = 7200
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option TCP_KEEPINTVL = 75
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_LOWDELAY = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option IPTOS_THROUGHPUT = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDBUF = 50688
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVBUF = 87504
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDLOWAT = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVLOWAT = 1
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_SNDTIMEO = 0
[2009/07/01 11:26:03, 5] lib/util_sock.c:print_socket_options(781)
socket option SO_RCVTIMEO = 0
---------------------------------

The above repeats every couple of minutes...

This is the Samba log for comms with the client machine:

--------------------------------- log.cheetah
[2009/07/01 11:25:40, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:40, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:40, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:40, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2355200 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:40, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2355200, size = 4096, returned 4096
[2009/07/01 11:25:40, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:40, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:40, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6465
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:40, 10] lib/util.c:dump_data(2223)
[000] E7 EB 19 4B 73 8B AC FD 33 80 0F 74 5C 03 00 BB ...Ks... 3..t\...
[010] E7 1D F0 02 EC 07 80 63 5E 14 50 0A 98 2E 20 40 .......c ^.P... @
[020] 73 87 9B 9C B3 C4 11 93 C4 DA 44 02 00 80 6E 96 s....... ..D...n.
[030] CA ED 6C 3D 43 70 98 4A 81 F8 D4 F4 40 CA FF 73 ..l=Cp.J ***@..s
[040] 6A 62 A7 76 A8 B6 CE 1C 66 EC 2D 44 29 71 4C CA jb.v.... f.-D)qL.
[050] 6C FC 5B 38 E4 33 22 D4 D0 D2 1E D9 8B 02 40 53 l.[8.3". ***@S
[060] AE 10 DD E0 F9 89 10 FC 08 0C 00 CD BE 8D 91 00 ........ ........
[070] 32 48 FB 7C 2A 4E BE 0E 98 83 B2 70 D6 0E 7D B3 2H.|*N.. ...p..}.
[080] 26 AB C2 91 8D AB DD 1C B9 F2 B7 FD 36 A6 19 0C &....... ....6...
[090] 92 05 CD 04 54 07 CA D1 DC 13 40 E6 A7 C4 E3 77 ....T... ***@....w
[0A0] 00 30 62 9E 81 67 D4 98 67 9E 9D 2F F3 D0 58 C3 .0b..g.. g../..X.
[0B0] ED 62 D8 F5 7A 8C 20 8D 2E 2A FA 1B 55 14 CE 4B .b..z. . .*..U..K
[0C0] 26 EE 39 8B 2E 56 C0 7A F4 AA A3 55 B5 B1 41 07 &.9..V.z ...U..A.
[0D0] EB 84 8F 31 91 27 CF 98 94 93 C3 58 2F AB 36 66 ...1.'.. ...X/.6f
[0E0] 61 40 2B D8 0C BF B4 05 27 E3 85 DA F5 61 1D 2C a@+..... '....a.,
[0F0] 8B 20 2C 3B 2D 91 53 C0 99 C2 46 D8 60 C2 87 77 . ,;-.S. ..F.`..w
[100] 9C 5C B2 82 48 0C FA 35 AC 10 C3 6D 9A 66 08 10 .\..H..5 ...m.f..
[110] A7 1B 74 B4 A3 CB 53 40 78 78 0B A1 14 88 60 8C ..t...S@ xx....`.
[120] E9 61 8D 13 81 8E A0 DE EE 29 2A 11 2A 0D 19 54 .a...... .)*.*..T
[130] 99 98 DC 33 F6 7B BB 33 4E A7 41 C5 04 86 DA 0C ...3.{.3 N.A.....
[140] 0D 9B 7B BF 85 A6 A1 46 2F AC 21 80 07 71 55 6E ..{....F /.!..qUn
[150] 1C 81 86 A2 9B BA 94 B7 10 45 26 0F CB 40 20 CE ........ .E&..@ .
[160] 75 24 27 B8 61 10 21 FB 09 0C ED 46 13 41 0E 63 u$'.a.!. ...F.A.c
[170] 07 B3 C9 69 62 17 1F 11 4E B7 81 AC 85 99 07 B9 ...ib... N.......
[180] 36 B4 45 DA 28 97 C0 A1 42 E9 61 FA BD 6F 9F B8 6.E.(... B.a..o..
[190] 10 FD 10 83 1E F5 8F CD FF 9B FC 27 8F E4 00 5E ........ ...'...^
[1A0] 1B 1D 4D 8D 7A 22 E8 75 30 CF 42 93 1F 03 0E E8 ..M.z".u 0.B.....
[1B0] 60 AF CA B6 9D 4E C1 19 93 65 7B 36 2E 28 CA F7 `....N.. .e{6.(..
[1C0] D3 12 F5 C0 03 2F DC 5B 00 30 BE 07 E0 12 0B E3 ...../.[ .0......
[1D0] 4F 07 E8 69 03 0A 37 55 C2 9D 98 62 62 93 00 00 O..i..7U ...bb...
[1E0] C0 D0 CB 1D 37 F3 0A 09 0D 57 2A 17 4A 7B DD 19 ....7... .W*.J{..
[1F0] F5 49 B5 5F 66 97 67 8D 5A 48 70 E6 7A 94 B5 DA .I._f.g. ZHp.z...
[2009/07/01 11:25:40, 10] lib/events.c:run_events(263)
Running event "idle_evt(deadtime)" b8263ca0
[2009/07/01 11:25:40, 10] lib/events.c:timed_event_destructor(65)
Destroying timed event b8263ca0 "idle_evt(deadtime)"
[2009/07/01 11:25:40, 10] lib/events.c:event_add_timed(128)
Added timed event "idle_evt(deadtime)": b8264770
[2009/07/01 11:25:42, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:42, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:42, 3] smbd/process.c:process_smb(1549)
Transaction 10960 of length 63 (0 toread)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6529
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 36 (0x24)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:42, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:42, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:42, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:42, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2359296 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:42, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2359296, size = 61440, returned 61440
[2009/07/01 11:25:42, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6529
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:25:42, 10] lib/util.c:dump_data(2223)
[000] 1C CE E2 E6 03 2B 68 90 00 BE 5A 75 30 8E 54 05 .....+h. ..Zu0.T.
[010] 62 25 B4 81 CE A9 56 0D 4A 52 25 89 D8 D1 34 18 b%....V. JR%...4.
[020] C8 BD 86 0A ED CD 42 B6 0E CC 27 D0 0C 99 F9 55 ......B. ..'....U
[030] 51 43 06 3F B0 55 06 00 A2 2A 03 B0 41 F1 D9 07 QC.?.U.. .*..A...
[040] B0 20 60 27 41 8F 33 D5 CD 2D 8E E2 2C 25 89 04 . `'A.3. .-..,%..
[050] 00 E0 26 9B A3 F8 61 DC 21 6C 6D CF C5 CF 2C 3C ..&...a. !lm...,<
[060] D9 7D 78 4E F0 57 8C 88 24 D4 79 C9 DC 0D 11 BE .}xN.W.. $.y.....
[070] B0 38 12 09 CF 56 19 C2 E5 E0 7F 6A EE D5 A4 27 .8...V.. ...j...'
[080] 40 38 A8 AA 24 C0 EF 4E 12 AC 22 2A 4A 02 40 A7 @8..$..N .."****@.
[090] 02 1C E9 BB BF B5 6A 3E 43 24 99 50 8C 50 80 C8 ......j> C$.P.P..
[0A0] 62 22 14 61 26 20 C6 48 C3 5C C2 FD 2F 05 49 60 b".a& .H .\../.I`
[0B0] 4B 00 87 55 44 C7 69 53 CD 9C A5 61 0F 39 13 B9 K..UD.iS ...a.9..
[0C0] A5 0B 90 CB 4C A8 52 55 A0 32 C4 63 EA A6 F1 7D ....L.RU .2.c...}
[0D0] EB 66 5D D5 2C 47 C8 0C 70 56 51 38 26 20 CC 56 .f].,G.. pVQ8& .V
[0E0] 8B 5D 86 A9 2D E1 92 61 56 87 DE A9 0C A6 3A 04 .]..-..a V.....:.
[0F0] 15 D0 C6 3A C5 76 A6 53 27 11 55 04 45 2C 56 45 ...:.v.S '.U.E,VE
[100] 07 20 08 A3 5B 2E F0 B4 8C 54 87 32 2A 8A A5 9B . ..[... .T.2*...
[110] 3D 02 01 28 30 77 7C 18 8E 19 39 80 7A D4 08 40 =..(0w|. ..9.z..@
[120] 7A 62 38 DA 58 2D 83 22 AA AE 05 CF BE 3D AF 2B zb8.X-." .....=.+
[130] 00 33 FC 55 D4 25 91 40 40 9A CC 57 D3 FC 10 6D .3.U.%.@ @..W...m
[140] 4E 50 7B DB C9 ED 3C 45 29 A4 63 D1 EB C1 4C 88 NP{...<E ).c...L.
[150] 43 26 E8 5D 86 52 00 11 C6 AF 5C 17 63 A4 DD 9D C&.].R.. ..\.c...
[160] 16 57 39 5D 51 0C 53 97 FD DA 30 F7 C2 4C 05 21 .W9]Q.S. ..0..L.!
[170] BA 24 6C DC 79 2D BC BA 48 B6 28 17 C7 D6 BA C5 .$l.y-.. H.(.....
[180] 93 48 19 EF 8E 88 6C E9 83 30 DB AF 6F 1D 4D B5 .H....l. .0..o.M.
[190] 06 88 BC 02 E5 2E 3A 4A A7 D7 87 F0 80 20 3C 2A ......:J ..... <*
[1A0] 0B F7 D2 23 94 9D 58 98 01 F8 0D 52 C4 0C FB C7 ...#..X. ...R....
[1B0] 4C 46 13 FA FF 8F F5 2A 6D C1 4C 6B 21 8A F2 58 LF.....* m.Lk!..X
[1C0] 05 12 00 9E 4A 95 20 85 5E 20 E4 CE 62 20 A9 BC ....J. . ^ ..b ..
[1D0] 5A 95 A0 85 96 20 D5 8A 01 B3 F4 55 14 59 D1 51 Z.... .. ...U.Y.Q
[1E0] B9 32 AA 24 23 C8 B5 9A 4A 05 AE 30 AC 75 E8 4C .2.$#... J..0.u.L
[1F0] 00 59 54 57 02 1C 70 03 2C FB 82 AD EC 90 D8 4D .YTW..p. ,......M
[2009/07/01 11:25:42, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:42, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:42, 3] smbd/process.c:process_smb(1549)
Transaction 10961 of length 63 (0 toread)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6529
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]=61440 (0xF000)
smb_vwv[ 4]= 36 (0x24)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 4096 (0x1000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 4096 (0x1000)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:42, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:42, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:42, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:42, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2420736 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:42, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2420736, size = 4096, returned 4096
[2009/07/01 11:25:42, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:42, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6529
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:42, 10] lib/util.c:dump_data(2223)
[000] EB 76 9E AF D6 E1 BB 35 B5 C5 A3 31 67 33 1E 8E .v.....5 ...1g3..
[010] 5F C2 CC CA E2 9E 52 0F 39 89 83 0D F9 66 4F DE _.....R. 9....fO.
[020] 27 B6 7F 24 3F 29 FC 59 4B 7C 06 3D 78 02 11 DD '..$?).Y K|.=x...
[030] 5F 6B B7 F7 72 E1 78 DA B4 3C DC DD 99 10 79 2B _k..r.x. .<....y+
[040] BF 39 E1 72 D9 D4 F6 CA 0A 62 13 93 64 B6 7A 3C .9.r.... .b..d.z<
[050] 93 F6 8C 44 B7 B9 A7 FB 7B 06 5B 77 8A 37 53 BF ...D.... {.[w.7S.
[060] FD 99 DB F8 E8 63 57 7E 9C DC DB 4E CE 7C D3 F3 .....cW~ ...N.|..
[070] EF EA 94 1F BB 7D 4F BD 2A 52 B6 75 01 BC 62 33 .....}O. *R.u..b3
[080] 56 6C 53 FD 1A F1 A0 D4 6F AB 56 45 18 25 3D E7 VlS..... o.VE.%=.
[090] 9E 26 4D 1A 9D E6 B5 C7 2F 53 BC 35 1F 8E ED 6A .&M..... /S.5...j
[0A0] 6E BB 76 70 1E 8B 3D FD 64 90 B8 52 69 02 12 96 n.vp..=. d..Ri...
[0B0] C5 67 19 C2 7F 08 F0 D5 C3 71 76 6B F2 49 23 DC .g...... .qvk.I#.
[0C0] F0 28 A8 3C E8 24 9D F6 AE BB 22 7E 46 B6 CE DD .(.<.$.. .."~F...
[0D0] BF F8 F2 52 01 CF 97 53 EF EC 9E F6 F4 AD 97 4A ...R...S .......J
[0E0] 9D B6 9D 77 71 B3 7B 98 A9 93 8C 13 75 C2 F6 89 ...wq.{. ....u...
[0F0] 5D 9A 6E D5 DA C8 5B A0 7C 4A D0 51 00 CC 5E 89 ].n...[. |J.Q..^.
[100] 12 AD B8 4B 77 6F A8 E7 B5 5C 64 D5 1D 06 7D 9C ...Kwo.. .\d...}.
[110] 63 7D 4C E4 00 81 D8 0B 05 66 FF BE D5 23 8E 42 c}L..... .f...#.B
[120] 9D 67 29 F8 18 FE 6B 79 BF 7F F8 DF 90 27 5E F1 .g)...ky .....'^.
[130] DB 8F FB F7 B1 D4 DF BA 3B 53 AE D6 FE 65 FB F2 ........ ;S...e..
[140] C5 0F 44 17 AD 6E 3E 65 6E 52 71 BC DC 6F C5 44 ..D..n>e nRq..o.D
[150] DF 7B 5E 0D C4 82 57 69 10 83 6C BF CC F8 8A 75 .{^...Wi ..l....u
[160] 7D 8D 5A F0 A1 0C 74 BA BD 43 01 26 C3 28 DD F2 }.Z...t. .C.&.(..
[170] CF 89 6B 40 3C D6 BF AA 6B F7 DE EF 57 EF FA 6F ..k@<... k...W..o
[180] EE 69 7C AA 3C DA EE AF CF 63 AD AB B0 D5 AF 83 .i|.<... .c......
[190] 95 F1 1A 13 93 57 7F 4F 19 11 F5 4D 9B 4F 90 A1 .....W.O ...M.O..
[1A0] DA 19 26 21 94 26 B5 1E 0F 47 0B C7 E9 7A E8 B4 ..&!.&.. .G...z..
[1B0] AF 25 FF E9 9A FB 2B 01 CC 6D C4 D7 CD FF 11 66 .%....+. .m.....f
[1C0] 3A DE 4E 14 BE 99 C7 80 D8 B0 EC EE 1A 2B BB 1D :.N..... .....+..
[1D0] B8 AE 2E F6 93 99 F3 37 DB 71 96 AD 4A 72 10 AF .......7 .q..Jr..
[1E0] A8 09 E9 1C 39 E9 7F 99 FC F3 9C 29 FF 7F E6 FF ....9... ...)....
[1F0] FE 3D B7 ED E0 53 56 5C 4B 00 D4 62 6F D0 BE 3F .=...SV\ K..bo..?
[2009/07/01 11:25:45, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:45, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:45, 3] smbd/process.c:process_smb(1549)
Transaction 10962 of length 63 (0 toread)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6593
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 37 (0x25)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:45, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:45, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:45, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:45, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2424832 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:45, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2424832, size = 61440, returned 61440
[2009/07/01 11:25:45, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6593
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:25:45, 10] lib/util.c:dump_data(2223)
[000] 6F 9E 11 DC 88 E7 9B 71 0C 3F EC E7 FE C6 66 6F o......q .?....fo
[010] 1E C0 0E 46 00 18 A8 2D FE 7E 7F 46 CB 52 CC D2 ...F...- .~.F.R..
[020] D0 6E 94 80 43 CC 59 52 D1 E9 E4 F8 24 A0 9B 15 .n..C.YR ....$...
[030] 48 FA 81 03 00 1E EB 4C 86 85 E5 00 D0 C6 3E A3 H......L ......>.
[040] 14 A9 65 00 D0 3D D9 12 05 33 55 F2 8C B6 59 11 ..e..=.. .3U...Y.
[050] EF 43 D0 FF 7E 12 95 F2 49 D8 7F 7B 67 C8 22 01 .C..~... I..{g.".
[060] 30 8E 63 B3 01 EF 38 9F 8E 35 24 04 38 00 C0 9F 0.c...8. .5$.8...
[070] 73 84 04 B8 B9 7D D7 3B 00 A0 02 1F 80 1E 8F 0D s....}.; ........
[080] 00 B0 EE A1 AB CB 1C 5B C4 2C 33 49 02 00 88 AB .......[ .,3I....
[090] 25 73 8B B5 6A 3F 4D F5 47 DD 4D 56 DA 2C B2 E3 %s..j?M. G.MV.,..
[0A0] 22 18 E4 B7 25 D5 E0 73 5F E1 04 23 B0 F6 32 79 "...%..s _..#..2y
[0B0] 19 22 81 50 82 F7 1A 84 90 C6 85 5E 2B 4B D2 53 .".P.... ...^+K.S
[0C0] 3F 40 38 B8 3C 93 97 11 92 E2 C0 CE D2 CF D6 08 ?@8.<... ........
[0D0] 83 01 10 9F F8 4C 50 5A 9A 09 D7 E9 2F 4A 99 C6 .....LPZ ..../J..
[0E0] D9 99 DC 20 CF 79 C3 92 C5 4C 0D 0D CC 00 27 34 ... .y.. .L....'4
[0F0] 77 97 15 40 C2 00 10 06 20 C1 90 9C A5 53 92 92 ***@.... ....S..
[100] A4 82 27 00 36 71 C2 37 95 57 9A 75 1F 2E 20 18 ..'.6q.7 .W.u.. .
[110] 1C 7B 79 C9 8B 19 2D 44 8C 44 1B 2E 93 AA 0B 7B .{y...-D .D.....{
[120] 41 AD C1 30 30 B7 8E 4F A9 9B 04 70 0C 70 64 14 A..00..O ...p.pd.
[130] 71 89 5C 45 63 34 10 29 D4 D5 A9 77 E8 1E 72 8D q.\Ec4.) ...w..r.
[140] 64 AE 58 A4 1D 72 BC 26 B9 04 8B 83 8B C9 6E CC d.X..r.& ......n.
[150] 2F 04 02 61 88 88 1A 77 37 73 29 D9 15 02 E2 AB /..a...w 7s).....
[160] 33 98 32 61 A6 BF 1F F3 08 80 47 7B 20 63 55 62 3.2a.... ..G{ cUb
[170] E6 0A CC 53 9A 9C 25 9E C5 BE 18 05 C2 6C 28 05 ...S..%. .....l(.
[180] 00 4A FB AD 6C 10 3E D8 A9 1A 00 A0 BB 38 BC 43 .J..l.>. .....8.C
[190] 27 D9 D8 D1 7B 52 F7 C4 48 FF D1 53 F4 43 3F F8 '...{R.. H..S.C?.
[1A0] D3 DC E8 F5 00 AE BC 91 E9 F7 3B 9A 36 91 1C C3 ........ ..;.6...
[1B0] 0A 91 44 8F 8D BF 3D 75 BB D1 08 61 75 BB 37 94 ..D...=u ...au.7.
[1C0] 40 3C 15 D1 64 3A D2 F3 DA 56 FB 4E 28 3B 85 D3 @<..d:.. .V.N(;..
[1D0] 61 69 5D 51 7C 16 C2 E6 73 B1 B3 16 D5 4F ED A9 ai]Q|... s....O..
[1E0] 38 AA 0C 94 54 3E 5E D9 E8 05 24 40 E2 00 1E 0B 8...T>^. ..$@....
[1F0] 8D AC 25 AA C0 04 F6 AA 33 01 1F 70 40 84 77 E4 ..%..... ***@.w.
[2009/07/01 11:25:45, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:45, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:45, 3] smbd/process.c:process_smb(1549)
Transaction 10963 of length 63 (0 toread)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6593
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]=61440 (0xF000)
smb_vwv[ 4]= 37 (0x25)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 4096 (0x1000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 4096 (0x1000)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:45, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:45, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:45, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:45, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2486272 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:45, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2486272, size = 4096, returned 4096
[2009/07/01 11:25:45, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:45, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6593
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:45, 10] lib/util.c:dump_data(2223)
[000] 7F 27 65 90 0C B6 04 92 30 98 04 C1 D1 56 5E 75 .'e..... 0....V^u
[010] 92 D3 4B AC 08 46 C1 A0 D3 C1 2D 61 8D F1 99 CE ..K..F.. ..-a....
[020] 2A 2A 80 60 22 64 87 AC C4 30 08 96 D6 09 C4 FC **.`"d.. .0......
[030] F2 29 8A 62 94 D6 2E C8 7A 0C 1C BB 91 AB F6 4A .).b.... z......J
[040] 06 32 99 A9 03 B3 18 2D 1E 11 C0 97 27 D5 02 B0 .2.....- ....'...
[050] 5E 68 90 69 79 11 35 73 39 45 C3 42 AF C8 FA 76 ^h.iy.5s 9E.B...v
[060] 40 18 FD FF 29 1D 48 98 0D 7F 7E 37 CB A5 3B 6D @...).H. ..~7..;m
[070] 85 0D 30 50 0C 85 E1 DD EB 19 E0 EA EE 77 54 E3 ..0P.... .....wT.
[080] 14 D1 13 EA D1 BA 43 F2 2A 08 FD 1A A6 F7 1E 54 ......C. *......T
[090] D1 15 0E FA 0E 8F FA A4 25 63 A8 C1 2D EA 8A 5C ........ %c..-..\
[0A0] 7F 4F ED 06 E4 08 55 70 1A 3A BD 45 BD B6 D7 16 .O....Up .:.E....
[0B0] CF D5 58 D3 5C E1 C4 69 BA 86 EB 2E 8F 96 38 DC ..X.\..i ......8.
[0C0] EA 66 59 47 15 69 F3 E4 97 D0 69 DB 74 54 4A C3 .fYG.i.. ..i.tTJ.
[0D0] 26 F4 9D 67 3A 84 45 36 29 0C 63 CF E8 D4 DF E8 &..g:.E6 ).c.....
[0E0] F4 AA BF 21 EC 0C 47 40 90 D4 D6 E6 8C 15 A6 F2 ...!..G@ ........
[0F0] A4 03 48 C9 7C 9B DA 0F 83 86 6B FB 33 11 7C 3A ..H.|... ..k.3.|:
[100] 77 94 3D 4F 01 15 34 E1 E0 B4 2A 5A 6F 9B 5B E7 w.=O..4. ..*Zo.[.
[110] 07 71 F3 D4 C7 2F 82 0F 22 17 78 5A 14 55 39 0A .q.../.. ".xZ.U9.
[120] 00 D6 D9 44 C6 47 36 47 EF 3E E0 EF 7C 22 ED 23 ...D.G6G .>..|".#
[130] 2A 48 8B BD C1 77 76 96 59 59 66 CF 94 11 B5 12 *H...wv. YYf.....
[140] 85 7E E9 61 10 78 43 62 1E 97 BC EE 0E 35 1C 1F .~.a.xCb .....5..
[150] 00 3D 60 47 8D B2 E9 01 B4 0F 2A 5C 00 00 F7 1D .=`G.... ..*\....
[160] 0F E8 2E 36 39 63 8E 62 92 00 00 40 71 D0 9D 22 ...69c.b ***@q.."
[170] 9E 05 24 64 73 93 5A 54 84 C8 AB 0B D6 EF C3 D5 ..$ds.ZT ........
[180] 8C E4 F9 62 96 CE CC 94 1B 1B 6F D9 CE E7 F7 BF ...b.... ..o.....
[190] 2E DA 59 7F 37 5A 5F EB 59 77 5E 8F 0A F2 FA 60 ..Y.7Z_. Yw^....`
[1A0] CE 59 82 83 34 E7 99 2A 25 85 8A A6 48 85 97 99 .Y..4..* %...H...
[1B0] 72 28 98 FD F6 14 2D 32 15 04 EC 03 FC D2 12 39 r(....-2 .......9
[1C0] 79 CE 5F 62 E4 FF 7F 87 01 28 A8 00 80 04 00 82 y._b.... .(......
[1D0] D8 DE BC 57 22 51 68 95 82 88 38 C1 6E 05 01 6B ...W"Qh. ..8.n..k
[1E0] 8B E3 C7 9B C1 10 60 24 18 BE 7D 46 A5 06 4A 11 ......`$ ..}F..J.
[1F0] 34 5F 87 2C 6F 3F 04 66 8B 55 8B 6A BA 56 3B 60 4_.,o?.f .U.j.V;`
[2009/07/01 11:25:48, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:48, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:48, 3] smbd/process.c:process_smb(1549)
Transaction 10964 of length 63 (0 toread)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6657
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 38 (0x26)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:48, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:48, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:48, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:48, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2490368 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:48, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2490368, size = 61440, returned 61440
[2009/07/01 11:25:48, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6657
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:25:48, 10] lib/util.c:dump_data(2223)
[000] 2F 26 FC 84 E0 EC C4 A1 67 73 1C FC 58 B3 42 AB /&...... gs..X.B.
[010] 46 2F 6B 55 D3 16 AD 5E 57 B3 AF AE A1 F3 EA 84 F/kU...^ W.......
[020] 38 6B DB 2B FB DA 7B C2 82 37 14 BA C9 84 55 0D 8k.+..{. .7....U.
[030] 5B 07 BB 4C 73 40 6B 68 99 4D D2 91 A9 D1 51 9D [***@kh .M....Q.
[040] 32 4C C1 AE A1 FD 25 65 FB 8A 32 B2 9C 8A 55 1D 2L....%e ..2...U.
[050] D9 E7 11 C7 47 17 19 3D F8 24 76 92 91 FF 81 65 ....G..= .$v....e
[060] E5 EA EB F3 F0 21 7D C1 29 B1 00 EA 47 07 60 03 .....!}. )...G.`.
[070] 54 47 AF 5C A8 A5 98 24 E6 12 87 25 01 00 78 05 TG.\...$ ...%..x.
[080] 41 E1 6B AE 7D 5A B2 2D E8 4B FF CE C0 6E 71 DB A.k.}Z.- .K...nq.
[090] 09 19 F5 52 E1 E0 C3 81 B3 57 D3 72 B8 E2 C4 D7 ...R.... .W.r....
[0A0] C5 C4 D9 BF 0E 27 11 77 1F EB F3 BC BB 77 94 20 .....'.w .....w.
[0B0] 9E AF CE 1F 79 55 80 E0 E4 BE 74 10 7D 61 59 A5 ....yU.. ..t.}aY.
[0C0] C8 9D C3 89 3B 67 00 50 90 00 AE 87 DA 47 14 2D ....;g.P .....G.-
[0D0] FF 68 8E 2D AE DA 01 33 C6 EB 94 A1 DF 0E 83 88 .h.-...3 ........
[0E0] 9B 02 03 E2 A3 8D 3E A0 C2 42 1C D7 5C C7 E3 A4 ......>. .B..\...
[0F0] 23 19 0E 72 D2 30 4D 5B 15 15 01 01 05 E4 43 86 #..r.0M[ ......C.
[100] D7 05 93 2D 1D 62 2C 18 14 46 6D 48 43 74 88 B0 ...-.b,. .FmHCt..
[110] EC EE B6 90 BF F6 38 ED FA E6 05 33 59 30 B2 09 ......8. ...3Y0..
[120] 78 84 25 2C B5 07 47 00 62 1D 43 1A CB 90 1E 22 x.%,..G. b.C...."
[130] A6 2F 2B 4C F8 92 F0 6D D8 95 D5 1D 47 BE 14 85 ./+L...m ....G...
[140] CC 45 EE F8 1D 22 8A 91 A3 14 24 13 4C 1A 93 5A .E...".. ..$.L..Z
[150] E8 78 99 98 10 26 0D 45 42 DD 5C 23 A4 85 5C 38 .x...&.E B.\#..\8
[160] 14 69 64 D3 E7 EE 29 74 4D C7 3C DA BD 9A CF 8D .id...)t M.<.....
[170] EE 73 1B E4 DC ED 58 1D AB 4C 4C 44 AC 69 A9 7F .s....X. .LLD.i..
[180] 27 99 F2 6C 0C 3A 8D 89 F7 E7 E9 86 73 56 A7 36 '..l.:.. ....sV.6
[190] 31 31 F1 07 0F 46 6E 08 E2 75 B0 31 DB 2B 3C 87 11...Fn. .u.1.+<.
[1A0] D1 5D 21 D0 77 4B 43 B4 DA 18 10 45 35 E3 2D 5A .]!.wKC. ...E5.-Z
[1B0] 42 C6 3C EA 9D B4 34 A3 FE 00 CA 4F BD F6 2C BA B.<...4. ...O..,.
[1C0] 79 33 72 DE D2 B2 22 11 56 77 0A 01 8A B0 D9 D8 y3r...". Vw......
[1D0] C0 B2 63 52 9B B4 D1 A9 ED 50 94 4C 21 81 E4 76 ..cR.... .P.L!..v
[1E0] 7E BC 8F 79 C2 45 33 AB 7D 10 D8 B1 A7 A4 1D 6C ~..y.E3. }......l
[1F0] AF C2 9E 05 9E 6A D4 25 13 BD 12 F0 1E F0 B5 A5 .....j.% ........
[2009/07/01 11:25:48, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:48, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:48, 3] smbd/process.c:process_smb(1549)
Transaction 10965 of length 63 (0 toread)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6657
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]=61440 (0xF000)
smb_vwv[ 4]= 38 (0x26)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 4096 (0x1000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 4096 (0x1000)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:48, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:48, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:48, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:48, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2551808 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:48, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2551808, size = 4096, returned 4096
[2009/07/01 11:25:48, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:48, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6657
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:48, 10] lib/util.c:dump_data(2223)
[000] 6D DB C9 A2 A0 E7 27 AE 20 0C 4A CB F9 FF AA 1B m.....'. .J.....
[010] 5E FF B2 2A 0C 54 95 23 47 E8 D1 4F B4 67 3A B5 ^..*.T.# G..O.g:.
[020] 0A 78 EA A5 AF 59 80 80 69 30 34 18 CE 20 CC A9 .x...Y.. i04.. ..
[030] D8 E8 54 4E 0E 52 88 69 F8 E5 8C 28 71 85 89 60 ..TN.R.i ...(q..`
[040] 58 71 5A 3A E9 64 18 26 A6 CD 23 17 CE 4B 2C C6 XqZ:.d.& ..#..K,.
[050] 6E D4 C7 90 81 DA 46 06 D2 CA D3 94 B2 B0 A2 2E n.....F. ........
[060] 6A 33 D7 B0 45 00 AE 27 17 39 46 BB 38 E0 91 53 j3..E..' .9F.8..S
[070] 9B 07 6A 03 B5 3C DF E3 4A F4 22 4F 1B 96 63 F4 ..j..<.. J."O..c.
[080] C8 AE 22 A1 82 03 28 D9 78 36 FA 7D 93 52 CC 7E .."...(. x6.}.R.~
[090] EB F7 98 B2 87 02 E1 76 B8 BB BB 7B E4 08 7E 25 .......v ...{..~%
[0A0] 33 B1 EA 33 A0 BB 97 3C 47 B1 87 45 F5 97 5D 79 3..3...< G..E..]y
[0B0] 48 A5 70 28 97 E2 33 93 72 5E 65 6A 13 24 3A 44 H.p(..3. r^ej.$:D
[0C0] 45 9F DF 04 3D E6 F5 E6 E6 E8 CD 10 8F 99 FE 71 E...=... .......q
[0D0] 2B 73 7B F2 22 AC 30 C9 A4 B8 42 3E 47 B5 BE A5 +s{.".0. ..B>G...
[0E0] 5C 47 D9 35 48 6B 60 3D 2E 75 67 E8 CA 05 0E F7 \G.5Hk`= .ug.....
[0F0] 38 26 F9 1A 6C ED EE CF 72 9E 8B 96 4D 00 40 D1 8&..l... ***@.
[100] 56 E3 2A AD AA D7 EF 74 76 22 56 BD 5C BF F8 25 V.*....t v"V.\..%
[110] 93 E9 7D AA DE 00 12 85 02 2A 5E 2B AD C9 C7 65 ..}..... .*^+...e
[120] 82 5D E1 FC BD 42 93 33 E9 D6 F1 30 32 5C BF 07 .]...B.3 ...02\..
[130] DA 2D C5 CF 71 47 FF F6 F8 77 6F 53 75 1C 98 F5 .-..qG.. .woSu...
[140] A4 A7 78 32 47 D9 AE 36 33 A6 64 FF B6 7F 05 24 ..x2G..6 3.d....$
[150] C1 BA 64 13 EB 43 08 E0 E1 99 00 32 F1 3D 40 14 ..d..C.. ...2.=@.
[160] E0 A0 09 68 82 CE 18 57 AC 24 91 E2 8C 4D 02 00 ...h...W .$...M..
[170] C0 33 F0 9C BD DF 2C 45 8E 32 8E 3F 4D 73 7A B7 .3....,E .2.?Msz.
[180] 99 E2 72 4D E1 3A BB 9D B4 5A E7 41 DF 4D 8D 92 ..rM.:.. .Z.A.M..
[190] 1F 60 93 70 02 D6 E9 E1 F9 A7 BF 2B 0B 4C A0 DD .`.p.... ...+.L..
[1A0] 74 02 05 B7 32 AD 75 59 13 04 00 F5 41 00 C2 99 t...2.uY ....A...
[1B0] 5C 2C 07 9C 31 18 C6 3E 33 39 59 BC F5 13 50 30 \,..1..> 39Y...P0
[1C0] 15 14 19 CF EA 34 27 18 C1 56 0B 52 D1 97 75 2D .....4'. .V.R..u-
[1D0] 2F B5 B1 F2 34 6D 56 F3 82 8F 72 0D 38 6E CD 52 /...4mV. ..r.8n.R
[1E0] 9B 38 96 14 83 39 C0 17 B6 BD 5E AD 8F 1A 23 A6 .8...9.. ..^...#.
[1F0] DE AC A3 0C AD 71 52 7A 06 73 87 0F 9D 53 7D B4 .....qRz .s...S}.
[2009/07/01 11:25:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:51, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:51, 3] smbd/process.c:process_smb(1549)
Transaction 10966 of length 63 (0 toread)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6721
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 39 (0x27)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:51, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:51, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:51, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:51, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2555904 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:51, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2555904, size = 61440, returned 61440
[2009/07/01 11:25:51, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6721
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:25:51, 10] lib/util.c:dump_data(2223)
[000] AE B7 AF 3D AF 32 CD BC 2F AE E1 EF 83 7A D2 A0 ...=.2.. /....z..
[010] 84 49 26 C6 2A 1B 65 4C AB 45 63 96 9D 52 87 C5 .I&.*.eL .Ec..R..
[020] 2C 8B C2 AF DA 29 B0 EE 3B A7 4B 77 EB 6C B9 B9 ,....).. ;.Kw.l..
[030] 3F DE B0 99 9D 3B 9E 43 28 94 18 5C FC 14 AA A5 ?....;.C (..\....
[040] 8D 3B D9 6E 28 D3 03 92 F6 90 67 F4 3D B7 C2 8B .;.n(... ..g.=...
[050] B3 6C E7 59 CD CE C4 EC AF 29 09 A3 66 59 C8 FD .l.Y.... .)..fY..
[060] D2 9C 8C E9 3D DC A9 B4 2F B8 72 52 5C B5 7E 1D ....=... /.rR\.~.
[070] EB DF 3D 2E 88 7C 82 02 28 33 6D 47 37 81 FA 32 ..=..|.. (3mG7..2
[080] 7C E9 BB 57 42 B1 FE 41 D2 C2 45 F5 3D 21 DF 2C |..WB..A ..E.=!.,
[090] E6 3C E3 94 C9 29 FD 83 DA E9 7F 6E 79 7F 7C 7B .<...).. ...ny.|{
[0A0] 07 E5 2B EF F7 D7 02 3E 2A F5 50 34 25 0E 93 5C ..+....> *.P4%..\
[0B0] 98 F6 1A 2A 95 D8 B5 9D 66 00 B8 3F 04 44 53 B4 ...*.... f..?.DS.
[0C0] 65 1C BE 30 05 71 48 74 3E EF 9B 88 44 00 7F 1E e..0.qHt >...D...
[0D0] BF D2 60 4A E0 E3 C6 06 80 7B B0 00 38 A9 02 FA ..`J.... .{..8...
[0E0] 6D 00 01 C6 9E AA E3 BA 88 6D A2 4B 9C 44 00 00 m....... .m.K.D..
[0F0] 80 37 85 3E 48 4C C6 5D 6E 69 F1 79 7C A0 FC CC .7.>HL.] ni.y|...
[100] 20 26 6D E9 44 05 17 02 A5 4A BD 7D 5D BC 74 61 &m.D... .J.}].ta
[110] 85 C3 74 D4 53 CA 5D 41 79 9F 5B B0 D0 9C 8F 2D ..t.S.]A y.[....-
[120] 6F 2B 7B 65 A4 E5 2C 90 F8 35 E3 E0 43 C4 B0 E5 o+{e..,. .5..C...
[130] FD F4 44 CF 0A 06 4A CE A5 FD 79 10 80 00 88 F4 ..D...J. ..y.....
[140] FA ED 8B 04 3A 67 FB F6 C1 60 FF 65 AA 30 54 43 ....:g.. .`.e.0TC
[150] B9 62 16 13 D7 86 50 7F 46 58 BC 56 A5 B6 45 F2 .b....P. FX.V..E.
[160] 51 3B 35 0A 53 CE 5A 3D 92 23 10 AD F0 CD 87 4B Q;5.S.Z= .#.....K
[170] A3 40 D3 B2 AE EC 19 46 69 85 C9 58 E6 FF AE E0 ***@.....F i..X....
[180] B6 D1 03 63 B8 E8 23 D7 B0 81 91 A8 35 A2 EE 9A ...c..#. ....5...
[190] 57 6C 59 71 4F 5B D9 2B 4B D4 EA 51 A8 56 90 78 WlYqO[.+ K..Q.V.x
[1A0] 70 9F FC 31 C8 DF 7A 4B FB 32 1D AB DF 56 7D A8 p..1..zK .2...V}.
[1B0] 66 59 0D 4E BD 12 80 EA 14 83 55 F0 94 B8 A1 D2 fY.N.... ..U.....
[1C0] 6A 97 36 19 6E F8 AD 12 95 B2 74 65 36 4B 99 4E j.6.n... ..te6K.N
[1D0] 97 6E 10 E3 DE 41 D7 68 01 04 06 08 83 F0 E5 24 .n...A.h .......$
[1E0] EE A8 CB A2 5C 03 25 A6 45 E4 78 95 E6 8D D4 38 ....\.%. E.x....8
[1F0] 91 72 CB 42 88 F5 B1 F6 E4 0E 3A 66 81 06 51 6A .r.B.... ..:f..Qj
[2009/07/01 11:25:51, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:51, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:51, 3] smbd/process.c:process_smb(1549)
Transaction 10967 of length 63 (0 toread)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6721
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]=61440 (0xF000)
smb_vwv[ 4]= 39 (0x27)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 4096 (0x1000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 4096 (0x1000)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:51, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:51, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:51, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:51, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2617344 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:51, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2617344, size = 4096, returned 4096
[2009/07/01 11:25:51, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:51, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6721
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:51, 10] lib/util.c:dump_data(2223)
[000] CA 9A 0E 0A D3 DD 1C 7F 19 F6 66 EF 6B 24 B7 73 ........ ..f.k$.s
[010] 6B 4B C6 BC 12 C2 96 AF 3B A6 BB FE 56 C4 F7 6B kK...... ;...V..k
[020] 15 93 31 9A 55 F0 F5 A5 EE 1A 6D 70 69 A1 1D F4 ..1.U... ..mpi...
[030] F5 7C 14 A5 4D C7 8D 83 AE 92 4D 97 57 D9 74 0B .|..M... ..M.W.t.
[040] 22 1D 5E 1D DC F9 18 AF 94 04 60 48 3F 50 32 F6 ".^..... ..`H?P2.
[050] D0 AD BE 80 D6 D3 4A 75 D1 7E 08 FD 61 71 A1 B1 ......Ju .~..aq..
[060] 36 D2 46 55 EE 65 4E 5A CA EB 25 BB 31 37 E8 DC 6.FU.eNZ ..%.17..
[070] 6D F7 83 D0 71 95 B8 1C 5E AE 3B 3E 00 32 A2 27 m...q... ^.;>.2.'
[080] 44 4B 1F 0F F6 F9 6D 86 71 42 9A F7 7E E5 7F 7D DK....m. qB..~..}
[090] C0 A9 EF 2F 8C A5 42 21 C6 E9 10 EF FC 57 7B 52 .../..B! .....W{R
[0A0] 84 24 9E 6F 7E D3 6A 03 6A DB 7C 88 19 46 E7 8E .$.o~.j. j.|..F..
[0B0] FF 9E CB A9 39 BD EC F6 28 13 AA 4F DE 13 64 02 ....9... (..O..d.
[0C0] E1 41 50 D9 6F 2B 76 37 4C D8 E9 71 3A 25 03 D1 .AP.o+v7 L..q:%..
[0D0] D7 CD FE D7 77 26 04 4C 1F 75 A1 4E BB E7 4F DF ....w&.L .u.N..O.
[0E0] DE 5F F9 AC E5 51 02 BA FD DD 1B 62 06 AC 6F 4E ._...Q.. ...b..oN
[0F0] 72 DD 5B F8 94 72 A9 9E 7B AD 52 A7 69 02 07 BC r.[..r.. {.R.i...
[100] 5C 6A 14 29 53 14 B0 3B B8 8F 40 45 51 56 C6 6F \j.)S..; ***@EQV.o
[110] 1E 8C 59 48 F2 3A 78 8A 5E 3C 8A D2 7E 6F 04 7D ..YH.:x. ^<..~o.}
[120] 1B AF 0D F6 1A BC 3D D1 01 00 E4 A5 23 24 70 C3 ......=. ....#$p.
[130] 87 60 37 04 9B D3 02 B0 03 6C 35 A0 12 8E 59 C2 .`7..... .l5...Y.
[140] 49 99 09 00 00 11 8D D2 F1 F2 3E B1 D1 E2 CB D7 I....... ..>.....
[150] 78 71 5B E1 8B 15 1A 41 48 58 AD 48 D3 5F 57 96 xq[....A HX.H._W.
[160] B3 FB 02 D0 A4 47 55 08 89 ED 9D 0A 62 BA 41 8E .....GU. ....b.A.
[170] 5E B7 B2 FB 83 72 01 A5 BE 92 78 09 DE ED 69 03 ^....r.. ..x...i.
[180] 55 2F 96 84 A3 AC 1F 93 AD 3A 35 74 64 55 7C 4C U/...... .:5tdU|L
[190] 0A 03 B4 19 AF EA 00 05 93 4D C1 19 A0 07 17 D8 ........ .M......
[1A0] 10 FD E9 38 D6 9D BF C1 58 AB 46 9A 46 40 91 B0 ...8.... ***@..
[1B0] 76 79 23 3F 0D 0D 01 54 7E 31 57 40 2D 18 0E E4 vy#?...T ~1W@-...
[1C0] AD A3 68 9F 21 50 82 93 61 82 B2 14 DE 87 19 56 ..h.!P.. a......V
[1D0] 2F 0B 18 76 C5 A7 0F 04 1D E9 38 FD 7A DE 98 CA /..v.... ..8.z...
[1E0] 55 8B 41 23 BF A8 25 0D 41 CF 57 DC FD 8D BA 54 U.A#..%. A.W....T
[1F0] 15 D5 F2 D9 2C 07 25 BE 4D 0C 32 31 89 0C DC 7A ....,.%. M.21...z
[2009/07/01 11:25:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:53, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:53, 3] smbd/process.c:process_smb(1549)
Transaction 10968 of length 63 (0 toread)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6785
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 40 (0x28)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:53, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:53, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:53, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:53, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2621440 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:53, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2621440, size = 61440, returned 61440
[2009/07/01 11:25:53, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6785
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:25:53, 10] lib/util.c:dump_data(2223)
[000] 00 1E F1 48 68 D0 A2 DB E5 15 D2 B2 84 C5 A7 62 ...Hh... .......b
[010] 71 C1 93 9D 3D 2B EF E8 2C B9 ED 23 F6 EF C4 BE q...=+.. ,..#....
[020] CC C3 E0 79 1D D0 68 D5 DF 72 91 AF 2F CB B3 BD ...y..h. .r../...
[030] 56 00 06 8B 8D 80 12 80 89 43 60 DD 13 14 89 46 V....... .C`....F
[040] D3 4B 5F E0 70 0C 25 42 92 14 8B 43 C4 E5 79 C5 .K_.p.%B ...C..y.
[050] 54 D6 99 86 E2 5E 76 7F 71 D7 17 CD 82 EF EF FA T....^v. q.......
[060] C6 FA 36 69 AB 6B 8B CA 5A 1D 8B 96 DA 16 AB 52 ..6i.k.. Z......R
[070] 74 D6 BE 23 F2 FD 5B 28 61 7D EA BA A6 90 51 F7 t..#..[( a}....Q.
[080] 37 2A 8A A8 BD 67 FA 98 3E BE 7C 97 08 4C 94 54 7*...g.. >.|..L.T
[090] BA 60 0B 73 AC A6 6E 15 EB 97 0D 0A 00 EE 77 3B .`.s..n. ......w;
[0A0] 8E 1A 04 22 04 CE DE BA 83 F7 CD BA F4 F4 7C 79 ...".... ......|y
[0B0] 73 BE FF C2 B4 A0 32 D7 2F 22 A1 18 67 DF 7B 43 s.....2. /"..g.{C
[0C0] FD 0A E6 17 D1 13 98 11 25 DE 65 5E 6E 5B 33 36 ........ %.e^n[36
[0D0] F4 4B 4D 6D 16 72 0D 3A A7 11 39 DD 94 2B B4 C2 .KMm.r.: ..9..+..
[0E0] CC E9 15 6D 1E 5B 42 AA BA E6 C8 18 D4 DE 5E FA ...m.[B. ......^.
[0F0] 15 6B 1E 8A 31 11 C4 36 85 AC BE 85 A3 00 0A 6D .k..1..6 .......m
[100] 01 C6 6C BB 45 2F 4C A4 29 8D 6B 7A A7 B8 84 4D ..l.E/L. ).kz...M
[110] A8 14 17 BE 6F 9A A5 BE F3 76 1A 63 91 0B 3F 55 ....o... .v.c..?U
[120] 79 B4 E8 0D 87 A2 B7 54 D2 EF DD 0C 26 C5 86 29 y......T ....&..)
[130] 46 91 96 7B E8 20 60 82 22 94 8F 93 C0 92 38 D1 F..{. `. ".....8.
[140] 4B 86 70 72 2C 96 99 EF BD F5 6D F3 A9 4D 9A 08 K.pr,... ..m..M..
[150] 12 D6 B4 03 FD 8D B8 EB 94 42 A1 70 2A 46 37 76 ........ .B.p*F7v
[160] DE B2 19 D2 6E 37 EE 63 F1 0F 96 3E D3 7F B9 BC ....n7.c ...>....
[170] 7B F2 44 7A EC B9 3A 49 A7 BC 22 E6 C8 FE 5F A5 {.Dz..:I .."..._.
[180] 77 57 C9 38 EC E3 58 EC D5 8B 83 FB E4 ED 55 AE wW.8..X. ......U.
[190] 3E 17 00 AC 4A A9 08 04 31 33 B3 9A 95 52 81 70 >...J... 13...R.p
[1A0] A5 57 E7 58 94 57 FC C8 2D 03 32 78 A1 14 73 4F .W.X.W.. -.2x..sO
[1B0] 8A 47 2C 75 C3 D2 FF 1B C2 BE 60 3D 92 DE D7 EF .G,u.... ..`=....
[1C0] 9A 5E A7 EE 48 F5 F5 25 AA 11 5A 08 73 7A 72 A9 .^..H..% ..Z.szr.
[1D0] 9A 58 06 4A 19 93 5B DC D6 10 AC 04 F5 85 96 44 .X.J..[. .......D
[1E0] 02 C4 36 01 26 83 B2 73 6A D4 29 6A A9 48 00 C1 ..6.&..s j.)j.H..
[1F0] CC 2C C9 36 B7 7E 32 0F 89 40 D4 AB 37 E0 6C F2 .,.6.~2. ***@..7.l.
[2009/07/01 11:25:53, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:25:53, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:25:53, 3] smbd/process.c:process_smb(1549)
Transaction 10969 of length 63 (0 toread)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6785
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]=61440 (0xF000)
smb_vwv[ 4]= 40 (0x28)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 4096 (0x1000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 4096 (0x1000)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:25:53, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:25:53, 4] smbd/uid.c:change_to_user(182)
change_to_user: Skipping user change - already user
[2009/07/01 11:25:53, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:25:53, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2682880 len=4096 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:25:53, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2682880, size = 4096, returned 4096
[2009/07/01 11:25:53, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=4096 nread=4096
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:53, 5] lib/util.c:show_msg(652)
size=4155
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6785
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]= 4096 (0x1000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=4096
[2009/07/01 11:25:53, 10] lib/util.c:dump_data(2223)
[000] F6 42 FA 84 99 3C BA 65 BF C5 5B D7 54 D0 62 6B .B...<.e ..[.T.bk
[010] AF 93 53 48 F7 A4 1F 0D 48 73 66 A7 6E 9A 6A 12 ..SH.... Hsf.n.j.
[020] D8 86 6E 7F 91 4C 34 30 32 22 EE 15 7B C3 D7 71 ..n..L40 2"..{..q
[030] 40 7C 10 C1 17 01 72 8B 1E 37 45 F1 B9 64 49 E5 @|....r. .7E..dI.
[040] 6D 6C E1 A1 1B 94 B9 E1 17 79 85 AA 9C CF 8E B4 ml...... .y......
[050] F1 8A 9A 0E B0 A5 E0 58 CE C9 2B C3 79 E6 00 56 .......X ..+.y..V
[060] F9 04 D4 45 28 53 7A 13 68 2F 9B BC AE A1 14 6C ...E(Sz. h/.....l
[070] E0 FF 8A 02 8A 8C C3 1E 4D CF 31 9A D6 17 D4 FB ........ M.1.....
[080] FA B1 D8 8A 48 8F 49 7D DD 7D 31 8D DD 59 8F 5E ....H.I} .}1..Y.^
[090] D3 DA 70 B5 C0 06 88 E3 06 50 05 37 30 F5 63 03 ..p..... .P.70.c.
[0A0] F8 12 D8 00 8E 27 80 27 38 A0 02 80 79 83 3F AA .....'.' 8...y.?.
[0B0] 2B AE 5D CC 5C 38 6C 02 00 DC 52 32 A6 60 CF E4 +.].\8l. ..R2.`..
[0C0] 27 79 7E 43 8F 35 7C AB D8 8C 6E CF 3E F3 C8 9F 'y~C.5|. ..n.>...
[0D0] DF 61 5F AD DE 76 9B CF C2 D9 B7 AD 9F 2E DB F5 .a_..v.. ........
[0E0] AF A9 EA CB DB 37 EF E3 BC 46 CD C4 BE 6B D8 94 .....7.. .F...k..
[0F0] 8F E8 C4 1E 0A EE 55 BC 66 B7 57 18 8F 69 28 78 ......U. f.W..i(x
[100] 98 E6 09 03 60 FB F3 11 E3 F6 39 17 A9 48 78 73 ....`... ..9..Hxs
[110] 3B B4 B3 DC 09 0B 2F 57 FD 1F 6A E3 44 7F C5 67 ;...../W ..j.D..g
[120] 48 91 00 45 0A A4 F5 FF 09 96 AA EC D0 47 DC 1A H..E.... .....G..
[130] 81 01 B4 CF E0 60 A0 39 FC A2 A3 2C C3 E8 09 53 .....`.9 ...,...S
[140] 1F 7E AA 8C ED 7A C7 C4 C5 48 06 83 FE 1F 68 3A .~...z.. .H....h:
[150] D4 8F CB 54 D2 9C 39 24 4B E4 4D 89 21 AC 20 62 ...T..9$ K.M.!. b
[160] FC F1 96 84 9A 22 30 D5 A5 DA B7 B4 24 5D 13 9A ....."0. ....$]..
[170] 46 00 46 0D 7D 7D 1E 50 44 11 31 5D 49 41 6D 9D F.F.}}.P D.1]IAm.
[180] 79 13 45 4A 60 11 6A C3 E8 54 FA F4 1B 08 9B 48 y.EJ`.j. .T.....H
[190] 70 5A 63 A9 9A A1 64 D9 B1 09 E8 CA 17 A7 7A F2 pZc...d. ......z.
[1A0] DE F7 96 81 52 6D 9D 9F FA 4E C3 80 21 6E F6 B1 ....Rm.. .N..!n..
[1B0] A7 8A 09 BD 73 EA B4 42 F1 6B B7 83 6E CB 7A BD ....s..B .k..n.z.
[1C0] A2 3D 53 59 1A BA 47 25 63 40 91 F8 27 2C CC 06 .=SY..G% ***@..',..
[1D0] 03 65 FA 4B 65 BA 53 46 10 18 B4 E9 9D 66 A4 1B .e.Ke.SF .....f..
[1E0] CB A9 54 85 54 B3 36 56 44 AB 13 43 C0 0F 33 44 ..T.T.6V D..C..3D
[1F0] FF 83 BB 23 C7 F4 3D 8F B2 F5 4F 1E 01 57 FC B1 ...#..=. ..O..W..
[2009/07/01 11:25:54, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 236
[2009/07/01 11:25:54, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0xec
[2009/07/01 11:25:54, 3] smbd/process.c:process_smb(1549)
Transaction 10970 of length 240 (0 toread)
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(652)
size=236
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=0
smb_mid=6849
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 236 (0xEC)
smb_vwv[ 2]=16644 (0x4104)
smb_vwv[ 3]= 50 (0x32)
smb_vwv[ 4]= 1 (0x1)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 74 (0x4A)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 212 (0xD4)
smb_vwv[11]=40960 (0xA000)
smb_bcc=177
[2009/07/01 11:25:54, 10] lib/util.c:dump_data(2223)
[000] 60 48 06 06 2B 06 01 05 05 02 A0 3E 30 3C A0 0E `H..+... ...>0<..
[010] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A2 2A 0...+... ..7....*
[020] 04 28 4E 54 4C 4D 53 53 50 00 01 00 00 00 07 82 .(NTLMSS P.......
[030] 08 A2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........
[040] 00 00 05 01 28 0A 00 00 00 0F 00 57 00 69 00 6E ....(... ...W.i.n
[050] 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 00 30 .d.o.w.s . .2.0.0
[060] 00 32 00 20 00 53 00 65 00 72 00 76 00 69 00 63 .2. .S.e .r.v.i.c
[070] 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 .e. .P.a .c.k. .3
[080] 00 20 00 32 00 36 00 30 00 30 00 00 00 57 00 69 . .2.6.0 .0...W.i
[090] 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 00 30 .n.d.o.w .s. .2.0
[0A0] 00 30 00 32 00 20 00 35 00 2E 00 31 00 00 00 00 .0.2. .5 ...1....
[0B0] 00 .
[2009/07/01 11:25:54, 3] smbd/process.c:switch_message(1361)
switch message SMBsesssetupX (pid 18058) conn 0x0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:25:54, 5] smbd/uid.c:change_to_root_user(287)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X(1409)
wct=12 flg2=0xc807
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1173)
Doing spnego session setup
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1208)
NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1]
PrimaryDomain=[]
[2009/07/01 11:25:54, 10] smbd/password.c:register_initial_vuid(188)
register_initial_vuid: allocated vuid = 144
[2009/07/01 11:25:54, 10] smbd/sesssetup.c:check_spnego_blob_complete(1121)
check_spnego_blob_complete: needed_len = 74, pblob->length = 74
[2009/07/01 11:25:54, 5] smbd/sesssetup.c:parse_spnego_mechanisms(749)
parse_spnego_mechanisms: Got OID 1 3 6 1 4 1 311 2 2 10
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_spnego_negotiate(800)
reply_spnego_negotiate: Got secblob of size 40
[2009/07/01 11:25:54, 5] auth/auth.c:make_auth_context_subsystem(485)
Making default auth method list for DC, security=user, encrypt passwords = yes
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(387)
load_auth_module: Attempting to find an auth method to match guest
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(412)
load_auth_module: auth method guest has a valid init
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(387)
load_auth_module: Attempting to find an auth method to match sam
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(412)
load_auth_module: auth method sam has a valid init
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(387)
load_auth_module: Attempting to find an auth method to match
winbind:trustdomain
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(387)
load_auth_module: Attempting to find an auth method to match trustdomain
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(412)
load_auth_module: auth method trustdomain has a valid init
[2009/07/01 11:25:54, 5] auth/auth.c:load_auth_module(412)
load_auth_module: auth method winbind has a valid init
[2009/07/01 11:25:54, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
Got NTLMSSP neg_flags=0xa2088207
NTLMSSP_NEGOTIATE_UNICODE
NTLMSSP_NEGOTIATE_OEM
NTLMSSP_REQUEST_TARGET
NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_ALWAYS_SIGN
NTLMSSP_NEGOTIATE_NTLM2
NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_56
[2009/07/01 11:25:54, 5] auth/auth.c:get_ntlm_challenge(96)
auth_get_challenge: module guest did not want to specify a challenge
[2009/07/01 11:25:54, 5] auth/auth.c:get_ntlm_challenge(96)
auth_get_challenge: module sam did not want to specify a challenge
[2009/07/01 11:25:54, 5] auth/auth.c:get_ntlm_challenge(96)
auth_get_challenge: module winbind did not want to specify a challenge
[2009/07/01 11:25:54, 5] auth/auth.c:get_ntlm_challenge(136)
auth_context challenge created by random
[2009/07/01 11:25:54, 5] auth/auth.c:get_ntlm_challenge(137)
challenge is:
[2009/07/01 11:25:54, 5] lib/util.c:dump_data(2223)
[000] 3D 45 8F DB EF B0 AB E9 =E......
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(652)
size=296
smb_com=0x73
smb_rcls=22
smb_reh=0
smb_err=49152
smb_flg=136
smb_flg2=51201
smb_tid=0
smb_pid=65279
smb_uid=144
smb_mid=6849
smt_wct=4
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 0 (0x0)
smb_vwv[ 3]= 201 (0xC9)
smb_bcc=253
[2009/07/01 11:25:54, 10] lib/util.c:dump_data(2223)
[000] A1 81 C6 30 81 C3 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+
[010] 06 01 04 01 82 37 02 02 0A A2 81 AD 04 81 AA 4E .....7.. .......N
[020] 54 4C 4D 53 53 50 00 02 00 00 00 10 00 10 00 30 TLMSSP.. .......0
[030] 00 00 00 05 82 89 A2 3D 45 8F DB EF B0 AB E9 00 .......= E.......
[040] 00 00 00 00 00 00 00 6A 00 6A 00 40 00 00 00 4D .......j ***@...M
[050] 00 49 00 4C 00 4B 00 59 00 57 00 41 00 59 00 02 .I.L.K.Y .W.A.Y..
[060] 00 10 00 4D 00 49 00 4C 00 4B 00 59 00 57 00 41 ...M.I.L .K.Y.W.A
[070] 00 59 00 01 00 08 00 57 00 4F 00 4C 00 46 00 04 .Y.....W .O.L.F..
[080] 00 1A 00 70 00 68 00 69 00 6C 00 70 00 65 00 6D ...p.h.i .l.p.e.m
[090] 00 2E 00 6D 00 65 00 2E 00 75 00 6B 00 03 00 24 ...m.e.. .u.k...$
[0A0] 00 77 00 6F 00 6C 00 66 00 2E 00 70 00 68 00 69 .w.o.l.f ...p.h.i
[0B0] 00 6C 00 70 00 65 00 6D 00 2E 00 6D 00 65 00 2E .l.p.e.m ...m.e..
[0C0] 00 75 00 6B 00 00 00 00 00 55 00 6E 00 69 00 78 .u.k.... .U.n.i.x
[0D0] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3
[0E0] 00 2E 00 32 00 2E 00 33 00 00 00 4D 00 49 00 4C ...2...3 ...M.I.L
[0F0] 00 4B 00 59 00 57 00 41 00 59 00 00 00 .K.Y.W.A .Y...
[2009/07/01 11:25:54, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 256
[2009/07/01 11:25:54, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x100
[2009/07/01 11:25:54, 3] smbd/process.c:process_smb(1549)
Transaction 10971 of length 260 (0 toread)
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(642)
[2009/07/01 11:25:54, 5] lib/util.c:show_msg(652)
size=256
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=51207
smb_tid=0
smb_pid=65279
smb_uid=144
smb_mid=6913
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 256 (0x100)
smb_vwv[ 2]=16644 (0x4104)
smb_vwv[ 3]= 50 (0x32)
smb_vwv[ 4]= 1 (0x1)
smb_vwv[ 5]= 0 (0x0)
smb_vwv[ 6]= 0 (0x0)
smb_vwv[ 7]= 95 (0x5F)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 212 (0xD4)
smb_vwv[11]=40960 (0xA000)
smb_bcc=197
[2009/07/01 11:25:54, 10] lib/util.c:dump_data(2223)
[000] A1 5D 30 5B A2 59 04 57 4E 54 4C 4D 53 53 50 00 .]0[.Y.W NTLMSSP.
[010] 03 00 00 00 01 00 01 00 56 00 00 00 00 00 00 00 ........ V.......
[020] 57 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 W....... H.......
[030] 48 00 00 00 0E 00 0E 00 48 00 00 00 00 00 00 00 H....... H.......
[040] 57 00 00 00 05 8A 88 A2 05 01 28 0A 00 00 00 0F W....... ..(.....
[050] 43 00 48 00 45 00 45 00 54 00 41 00 48 00 00 57 C.H.E.E. T.A.H..W
[060] 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 00 32 .i.n.d.o .w.s. .2
[070] 00 30 00 30 00 32 00 20 00 53 00 65 00 72 00 76 .0.0.2. .S.e.r.v
[080] 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B .i.c.e. .P.a.c.k
[090] 00 20 00 33 00 20 00 32 00 36 00 30 00 30 00 00 . .3. .2 .6.0.0..
[0A0] 00 57 00 69 00 6E 00 64 00 6F 00 77 00 73 00 20 .W.i.n.d .o.w.s.
[0B0] 00 32 00 30 00 30 00 32 00 20 00 35 00 2E 00 31 .2.0.0.2 . .5...1
[0C0] 00 00 00 00 00 .....
[2009/07/01 11:25:54, 3] smbd/process.c:switch_message(1361)
switch message SMBsesssetupX (pid 18058) conn 0x0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:25:54, 5] smbd/uid.c:change_to_root_user(287)
change_to_root_user: now uid=(0,0) gid=(0,0)
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X(1409)
wct=12 flg2=0xc807
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1173)
Doing spnego session setup
[2009/07/01 11:25:54, 3] smbd/sesssetup.c:reply_sesssetup_and_X_spnego(1208)
NativeOS=[Windows 2002 Service Pack 3 2600] NativeLanMan=[Windows 2002 5.1]
PrimaryDomain=[]
[2009/07/01 11:25:54, 10] smbd/sesssetup.c:check_spnego_blob_complete(1121)
check_spnego_blob_complete: needed_len = 95, pblob->length = 95
[2009/07/01 11:25:54, 3] libsmb/ntlmssp.c:ntlmssp_server_auth(745)
Got user=[] domain=[] workstation=[CHEETAH] len1=1 len2=0
[2009/07/01 11:25:54, 6] param/loadparm.c:lp_file_list_changed(6724)
lp_file_list_changed()
file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Jun 19
22:00:21 2009

[2009/07/01 11:25:54, 5] auth/auth_util.c:make_user_info_map(206)
make_user_info_map: Mapping user []\[] from workstation [CHEETAH]
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:25:54, 5] auth/auth_util.c:is_trusted_domain(2055)
is_trusted_domain: Checking for domain trust with [MILKYWAY]
[2009/07/01 11:25:54, 5]
passdb/secrets.c:secrets_fetch_trusted_domain_password(644)
secrets_fetch failed!
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 10] lib/gencache.c:gencache_get(194)
Cache entry with key = TDOM/MILKYWAY couldn't be found
[2009/07/01 11:25:54, 5] libsmb/trustdom_cache.c:trustdom_cache_fetch(183)
no entry for trusted domain MILKYWAY found.
[2009/07/01 11:25:54, 5] auth/auth_util.c:make_user_info(120)
attempting to make a user_info for ()
[2009/07/01 11:25:54, 5] auth/auth_util.c:make_user_info(130)
making strings for 's user_info struct
[2009/07/01 11:25:54, 5] auth/auth_util.c:make_user_info(162)
making blobs for 's user_info struct
[2009/07/01 11:25:54, 10] auth/auth_util.c:make_user_info(180)
made an encrypted user_info for ()
[2009/07/01 11:25:54, 3] auth/auth.c:check_ntlm_password(220)
check_ntlm_password: Checking password for unmapped user []\[]@[CHEETAH]
with the new password interface
[2009/07/01 11:25:54, 3] auth/auth.c:check_ntlm_password(223)
check_ntlm_password: mapped user is: [MILKYWAY]\[]@[CHEETAH]
[2009/07/01 11:25:54, 10] auth/auth.c:check_ntlm_password(232)
check_ntlm_password: auth_context challenge created by random
[2009/07/01 11:25:54, 10] auth/auth.c:check_ntlm_password(234)
challenge is:
[2009/07/01 11:25:54, 5] lib/util.c:dump_data(2223)
[000] 3D 45 8F DB EF B0 AB E9 =E......
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:25:54, 10] lib/account_pol.c:account_policy_get(332)
account_policy_get: name: password history, val: 0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_username(580)
pdb_set_username: setting username nobody, was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_domain(603)
pdb_set_domain: setting domain MILKYWAY, was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_nt_username(626)
pdb_set_nt_username: setting nt username , was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_fullname(649)
pdb_set_full_name: setting full name nobody, was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_homedir(742)
pdb_set_homedir: setting home dir \\wolf\nobody, was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_dir_drive(718)
pdb_set_dir_drive: setting dir drive Z:, was NULL
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_logon_script(672)
pdb_set_logon_script: setting logon script logon.bat, was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_profile_path(695)
pdb_set_profile_path: setting profile path , was
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_workstations(785)
pdb_set_workstations: setting workstations , was
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:25:54, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:25:54, 10] lib/account_pol.c:account_policy_get(332)
account_policy_get: name: password history, val: 0
[2009/07/01 11:25:54, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:25:54, 10] passdb/pdb_get_set.c:pdb_set_user_sid(509)
pdb_set_user_sid: setting user sid
S-1-5-352321536-2508637403-2619729926-3515545951-501
[2009/07/01 11:25:54, 10] passdb/pdb_compat.c:pdb_set_user_sid_from_rid(72)
pdb_set_user_sid_from_rid:
setting user sid S-1-5-352321536-2508637403-2619729926-3515545951-501 from
rid 501
[2009/07/01 11:25:54, 3] auth/auth.c:check_ntlm_password(269)
check_ntlm_password: guest authentication for user [] succeeded
[2009/07/01 11:25:54, 5] auth/auth.c:check_ntlm_password(308)
check_ntlm_password: guest authentication for user [] -> [] -> [nobody]
succeeded
[2009/07/01 11:25:54, 5] auth/auth_util.c:free_user_info(1985)
attempting to free (and zero) a user_info structure
[2009/07/01 11:25:54, 10] auth/auth_util.c:free_user_info(1989)
structure was created for
[2009/07/01 11:25:54, 10] auth/token_util.c:create_local_nt_token(302)
Create local NT token for S-1-5-352321536-2508637403-2619729926-3515545951-501
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-544
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:26:15, 10] groupdb/mapping.c:pdb_create_builtin_alias(765)
Trying to create builtin alias 544
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_sid(950)
lookup_sid called for SID 'S-1-5-32-544'
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:check_dom_sid_to_level(705)
Accepting SID S-1-5-32 in level 1
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_rids(468)
lookup_rids called for domain sid 'S-1-5-32'
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_sid(985)
Sid S-1-5-32-544 -> BUILTIN\Administrators(4)
[2009/07/01 11:26:15, 3] groupdb/mapping.c:pdb_create_builtin_alias(786)
pdb_create_builtin_alias: Could not get a gid out of winbind
[2009/07/01 11:26:15, 5] auth/token_util.c:create_builtin_administrators(247)
create_builtin_administrators: Failed to create Administrators
[2009/07/01 11:26:15, 2] auth/token_util.c:create_local_nt_token(385)
WARNING: Failed to create BUILTIN\Administrators group! Can Winbind
allocate gids?
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-545
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:26:15, 10] groupdb/mapping.c:pdb_create_builtin_alias(765)
Trying to create builtin alias 545
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_sid(950)
lookup_sid called for SID 'S-1-5-32-545'
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:check_dom_sid_to_level(705)
Accepting SID S-1-5-32 in level 1
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_rids(468)
lookup_rids called for domain sid 'S-1-5-32'
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:lookup_sid(985)
Sid S-1-5-32-545 -> BUILTIN\Users(4)
[2009/07/01 11:26:15, 3] groupdb/mapping.c:pdb_create_builtin_alias(786)
pdb_create_builtin_alias: Could not get a gid out of winbind
[2009/07/01 11:26:15, 5] auth/token_util.c:create_builtin_users(213)
create_builtin_users: Failed to create Users
[2009/07/01 11:26:15, 2] auth/token_util.c:create_local_nt_token(413)
WARNING: Failed to create BUILTIN\Users group! Can Winbind allocate gids?
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:push_sec_ctx(224)
push_sec_ctx(0, 0) : sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 3] smbd/uid.c:push_conn_ctx(357)
push_conn_ctx(0) : conn_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (0, 0) - sec_ctx_stack_ndx = 1
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_nt_user_token(464)
NT user token: (NULL)
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 0
Primary group is 0 and contains 0 supplementary groups
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:pop_sec_ctx(432)
pop_sec_ctx (0, 0) - sec_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 3] lib/privileges.c:get_privileges(63)
get_privileges: No privileges assigned to SID
[S-1-5-352321536-2508637403-2619729926-3515545951-501]
[2009/07/01 11:26:15, 5] lib/privileges.c:get_privileges_for_sids(128)
get_privileges_for_sids: sid = S-1-1-0
Privilege set:
SE_PRIV 0x0 0x0 0x0 0x0
[2009/07/01 11:26:15, 3] lib/privileges.c:get_privileges(63)
get_privileges: No privileges assigned to SID [S-1-5-2]
[2009/07/01 11:26:15, 3] lib/privileges.c:get_privileges(63)
get_privileges: No privileges assigned to SID [S-1-5-32-546]
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-1-0
[2009/07/01 11:26:15, 10] auth/auth_util.c:create_local_token(755)
Could not convert SID S-1-1-0 to gid, ignoring it
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-2
[2009/07/01 11:26:15, 10] auth/auth_util.c:create_local_token(755)
Could not convert SID S-1-5-2 to gid, ignoring it
[2009/07/01 11:26:15, 10] passdb/lookup_sid.c:sid_to_gid(1426)
winbind failed to find a gid for sid S-1-5-32-546
[2009/07/01 11:26:15, 10] auth/auth_util.c:create_local_token(755)
Could not convert SID S-1-5-32-546 to gid, ignoring it
[2009/07/01 11:26:15, 10] auth/token_util.c:debug_nt_user_token(470)
NT user token of user S-1-5-352321536-2508637403-2619729926-3515545951-501
contains 4 SIDs
SID[ 0]: S-1-5-352321536-2508637403-2619729926-3515545951-501
SID[ 1]: S-1-1-0
SID[ 2]: S-1-5-2
SID[ 3]: S-1-5-32-546
SE_PRIV 0x0 0x0 0x0 0x0
[2009/07/01 11:26:15, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(137)
Got NT session key of length 16
[2009/07/01 11:26:15, 10] auth/auth_ntlmssp.c:auth_ntlmssp_check_password(144)
Got LM session key of length 16
[2009/07/01 11:26:15, 10] libsmb/ntlmssp.c:ntlmssp_server_auth(848)
ntlmssp_server_auth: Using unmodified nt session key.
[2009/07/01 11:26:15, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(337)
NTLMSSP Sign/Seal - Initialising with flags:
[2009/07/01 11:26:15, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(62)
Got NTLMSSP neg_flags=0xa2088205
NTLMSSP_NEGOTIATE_UNICODE
NTLMSSP_REQUEST_TARGET
NTLMSSP_NEGOTIATE_NTLM
NTLMSSP_NEGOTIATE_ALWAYS_SIGN
NTLMSSP_NEGOTIATE_NTLM2
NTLMSSP_NEGOTIATE_128
NTLMSSP_NEGOTIATE_56
[2009/07/01 11:26:15, 10] smbd/password.c:register_existing_vuid(310)
register_existing_vuid: (65534,65534) nobody MILKYWAY guest=1
[2009/07/01 11:26:15, 3] smbd/password.c:register_existing_vuid(314)
register_existing_vuid: User name: nobody Real name: nobody
[2009/07/01 11:26:15, 3] smbd/password.c:register_existing_vuid(326)
register_existing_vuid: UNIX uid 65534 is UNIX user nobody, and will be
vuid 144
[2009/07/01 11:26:15, 6] param/loadparm.c:lp_file_list_changed(6724)
lp_file_list_changed()
file /etc/samba/smb.conf -> /etc/samba/smb.conf last mod_time: Fri Jun 19
22:00:21 2009

[2009/07/01 11:26:15, 5] lib/util.c:show_msg(642)
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(652)
size=104
smb_com=0x73
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=0
smb_pid=65279
smb_uid=144
smb_mid=6913
smt_wct=4
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]= 1 (0x1)
smb_vwv[ 3]= 9 (0x9)
smb_bcc=61
[2009/07/01 11:26:15, 10] lib/util.c:dump_data(2223)
[000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x
[010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3
[020] 00 2E 00 32 00 2E 00 33 00 00 00 4D 00 49 00 4C ...2...3 ...M.I.L
[030] 00 4B 00 59 00 57 00 41 00 59 00 00 00 .K.Y.W.A .Y...
[2009/07/01 11:26:15, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 59
[2009/07/01 11:26:15, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x3b
[2009/07/01 11:26:15, 3] smbd/process.c:process_smb(1549)
Transaction 10972 of length 63 (0 toread)
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(642)
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(652)
size=59
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=24
smb_flg2=59399
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6978
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]=57054 (0xDEDE)
smb_vwv[ 2]= 9015 (0x2337)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 41 (0x29)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]=61440 (0xF000)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=0
[2009/07/01 11:26:15, 3] smbd/process.c:switch_message(1361)
switch message SMBreadX (pid 18058) conn 0xb826b788
[2009/07/01 11:26:15, 3] smbd/sec_ctx.c:set_sec_ctx(324)
setting sec ctx (1000, 1000) - sec_ctx_stack_ndx = 0
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_nt_user_token(470)
NT user token of user S-1-5-352321536-2508637403-2619729926-3515545951-3000
contains 15 SIDs
SID[ 0]: S-1-5-352321536-2508637403-2619729926-3515545951-3000
SID[ 1]: S-1-22-2-1000
SID[ 2]: S-1-1-0
SID[ 3]: S-1-5-2
SID[ 4]: S-1-5-11
SID[ 5]: S-1-22-2-4
SID[ 6]: S-1-22-2-20
SID[ 7]: S-1-22-2-24
SID[ 8]: S-1-22-2-46
SID[ 9]: S-1-22-2-50
SID[ 10]: S-1-22-2-114
SID[ 11]: S-1-22-2-117
SID[ 12]: S-1-22-2-125
SID[ 13]: S-1-5-352321536-2508637403-2619729926-3515545951-512
SID[ 14]: S-1-22-2-1005
SE_PRIV 0x9f0 0x0 0x0 0x0
[2009/07/01 11:26:15, 5] auth/token_util.c:debug_unix_user_token(490)
UNIX token of user 1000
Primary group is 1000 and contains 10 supplementary groups
Group[ 0]: 1000
Group[ 1]: 4
Group[ 2]: 20
Group[ 3]: 24
Group[ 4]: 46
Group[ 5]: 50
Group[ 6]: 114
Group[ 7]: 117
Group[ 8]: 125
Group[ 9]: 1005
[2009/07/01 11:26:15, 5] smbd/uid.c:change_to_user(272)
change_to_user uid=(1000,1000) gid=(0,1000)
[2009/07/01 11:26:15, 10] locking/locking.c:is_locked(98)
is_locked: optimisation - exclusive oplock on file Eagles/Long Road Out Of
Eden - Disc 2/06-I Love To Watch A Woman Dance.ogg
[2009/07/01 11:26:15, 10] locking/locking.c:is_locked(136)
is_locked: flavour = WINDOWS_LOCK brl start=2686976 len=61440 unlocked for
fnum 9015 file Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A
Woman Dance.ogg
[2009/07/01 11:26:15, 10] smbd/fileio.c:read_file(104)
read_file (Eagles/Long Road Out Of Eden - Disc 2/06-I Love To Watch A Woman
Dance.ogg): pos = 2686976, size = 61440, returned 61440
[2009/07/01 11:26:15, 3] smbd/reply.c:send_file_readX(3249)
send_file_readX fnum=9015 max=61440 nread=61440
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(642)
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(652)
size=61499
smb_com=0x2e
smb_rcls=0
smb_reh=0
smb_err=0
smb_flg=136
smb_flg2=51201
smb_tid=1
smb_pid=65279
smb_uid=100
smb_mid=6978
smt_wct=12
smb_vwv[ 0]= 255 (0xFF)
smb_vwv[ 1]= 0 (0x0)
smb_vwv[ 2]=65535 (0xFFFF)
smb_vwv[ 3]= 0 (0x0)
smb_vwv[ 4]= 0 (0x0)
smb_vwv[ 5]=61440 (0xF000)
smb_vwv[ 6]= 59 (0x3B)
smb_vwv[ 7]= 0 (0x0)
smb_vwv[ 8]= 0 (0x0)
smb_vwv[ 9]= 0 (0x0)
smb_vwv[10]= 0 (0x0)
smb_vwv[11]= 0 (0x0)
smb_bcc=61440
[2009/07/01 11:26:15, 10] lib/util.c:dump_data(2223)
[000] 00 08 A2 FB 3F CB 58 7A 5A 7F A2 36 15 BD A9 1D ....?.Xz Z..6....
[010] F2 AF 41 DF DF E9 7C EB 30 90 7B 45 7A F9 76 5D ..A...|. 0.{Ez.v]
[020] DB C8 53 7F 6C 64 6E B9 B0 1C 94 9E F0 89 37 6B ..S.ldn. ......7k
[030] DE 77 0F 58 A7 F6 F3 EE 4E D1 0A BE 37 CD B8 99 .w.X.... N...7...
[040] 93 E5 C3 72 E4 46 6B 93 7D 0E F6 8B 22 73 22 C7 ...r.Fk. }..."s".
[050] 78 0A A0 B4 76 1C 63 6C D2 40 CD C7 7B 50 8E 03 x...v.cl ***@..{P..
[060] 42 59 C9 CF 18 6F 4F C6 C6 FD 95 5C 2F A4 9D 32 BY...oO. ...\/..2
[070] E9 14 BE 06 73 25 00 A2 9A E7 66 80 50 5B 6B CE ....s%.. ..f.P[k.
[080] 52 C7 C5 C5 DF 80 86 C0 48 96 35 B7 6E 20 C8 DD R....... H.5.n ..
[090] 02 D5 AF EA 74 FF 36 1D 20 C0 22 BD 0D 50 94 15 ....t.6. ."..P..
[0A0] F9 58 BF 7C 33 3B CF 6E 2D AA 52 68 7D B2 02 EB .X.|3;.n -.Rh}...
[0B0] 46 BE 8D 58 23 89 83 AE 86 E7 DD FD 8A 30 A5 93 F..X#... .....0..
[0C0] 54 06 CA 01 11 EB 79 02 98 1E 95 CC BF 5C 20 7F T.....y. .....\ .
[0D0] 71 09 EC 90 A3 E8 11 5A BE AD EC 95 97 DF D3 30 q......Z .......0
[0E0] 1A B5 B5 31 EB 45 72 E9 A5 07 47 73 C2 E0 3F 17 ...1.Er. ..Gs..?.
[0F0] 57 17 17 5A 42 9C FB D7 CF 93 AF FB C6 B0 31 E2 W..ZB... ......1.
[100] 44 0F 39 22 2E C7 1F EA F0 B7 DB 2A 23 73 04 CF D.9".... ...*#s..
[110] F3 8D 86 E9 8B 9A 0F A5 59 D2 96 49 B9 7C 20 81 ........ Y..I.| .
[120] 1F 02 40 AC B7 F3 EF EC D6 83 DC 20 62 85 DD EB ***@..... ... b...
[130] 3E 45 FB 4F 7D BB 65 22 C0 64 C5 56 D2 D1 30 B7 >E.O}.e" .d.V..0.
[140] 12 6C 25 B3 FF 77 DA 0E 12 50 FF 9A 4C B5 9E BA .l%..w.. .P..L...
[150] AC E3 04 EB 41 20 48 0B 80 4C F2 35 04 00 D3 FD ....A H. .L.5....
[160] 60 6B BE 95 CB 87 C0 58 94 DE C7 02 94 EC DD 06 `k.....X ........
[170] FB CC 27 B6 F6 B4 87 A7 FF 36 F7 B4 77 F3 B5 A5 ..'..... .6..w...
[180] 09 22 13 26 C7 AC 3C 2B 9D 71 4F 3A D5 DB DB FE .".&..<+ .qO:....
[190] 53 CD AC B7 B7 5B 9F EA 2F 12 60 4A C9 17 87 0F S....[.. /.`J....
[1A0] 6F 6F E5 A9 C2 05 B6 B9 74 4E 67 C4 00 E0 DF 64 oo...... tNg....d
[1B0] 22 D3 42 33 2C 26 D6 FC 7F 8F A2 B2 2A 73 EA 5E ".B3,&.. ....*s.^
[1C0] 59 CE F5 D6 62 DF 8B C7 B8 FC B4 53 24 8F 21 6B Y...b... ...S$.!k
[1D0] C7 3B C3 6B 76 B1 BE F7 04 A1 5E 6F C1 EE 03 EE .;.kv... ..^o....
[1E0] D6 2C F0 02 0D 40 93 1B A0 7E 97 00 1E AC C1 9B .,***@.. .~......
[1F0] D3 33 00 48 B7 11 80 1D 9E 20 BC 79 F0 47 BB 91 .3.H.... . .y.G..
[2009/07/01 11:26:15, 10] lib/util_sock.c:read_smb_length_return_keepalive(1118)
got smb length of 74
[2009/07/01 11:26:15, 6] smbd/process.c:process_smb(1546)
got message type 0x0 of len 0x4a
[2009/07/01 11:26:15, 3] smbd/process.c:process_smb(1549)
Transaction 10973 of length 78 (0 toread)
[2009/07/01 11:26:15, 5] lib/util.c:show_msg(642)

---------------------------------


And this is an extract from the Wireshark trace:

---------------------------------
No. Time Source Destination Protocol Info
8850 11:25:40.801825 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8850 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8078172, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8851 11:25:40.801832 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8079632 Win=65535 Len=0

Frame 8851 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8079632, Len: 0

No. Time Source Destination Protocol Info
8852 11:25:40.801949 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8852 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8079632, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8853 11:25:40.802071 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8853 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8081092, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8854 11:25:40.802077 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8082552 Win=65535 Len=0

Frame 8854 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8082552, Len: 0

No. Time Source Destination Protocol Info
8855 11:25:40.802194 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8855 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8082552, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8856 11:25:40.802319 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8856 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8084012, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8857 11:25:40.802327 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8085472 Win=65535 Len=0

Frame 8857 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8085472, Len: 0

No. Time Source Destination Protocol Info
8858 11:25:40.802440 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8858 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8085472, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8859 11:25:40.802563 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8859 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8086932, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8860 11:25:40.802571 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8088392 Win=65535 Len=0

Frame 8860 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8088392, Len: 0

No. Time Source Destination Protocol Info
8861 11:25:40.802687 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8861 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8088392, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8862 11:25:40.802809 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8862 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8089852, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8863 11:25:40.802815 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8091312 Win=65535 Len=0

Frame 8863 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8091312, Len: 0

No. Time Source Destination Protocol Info
8864 11:25:40.802932 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8864 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8091312, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8865 11:25:40.803056 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8865 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8092772, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8866 11:25:40.803064 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8094232 Win=65535 Len=0

Frame 8866 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8094232, Len: 0

No. Time Source Destination Protocol Info
8867 11:25:40.803178 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8867 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8094232, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8868 11:25:40.803302 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8868 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8095692, Ack: 20098, Len: 1460

No. Time Source Destination Protocol Info
8869 11:25:40.803309 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20098 Ack=8097152 Win=65535 Len=0

Frame 8869 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8097152, Len: 0

No. Time Source Destination Protocol Info
8870 11:25:40.803323 10.0.0.1 10.0.0.8 SMB
Read AndX Response, FID: 0x2337, 61440 bytes

Frame 8870 (237 bytes on wire, 237 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8097152, Ack: 20098, Len: 183
[Reassembled TCP Segments (61503 bytes): #8807(1460), #8808(1460),
#8810(1460), #8811(1460), #8813(1460), #8814(1460), #8816(1460), #8817(1460),
#8819(1460), #8820(1460), #8822(1460), #8823(1460), #8825(1460), #8826(1460),
#8828(1460), #882]
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Read AndX Response (0x2e)

No. Time Source Destination Protocol Info
8871 11:25:40.803346 10.0.0.8 10.0.0.1 SMB
Read AndX Request, FID: 0x2337, 4096 bytes at offset 2682880

Frame 8871 (117 bytes on wire, 117 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20098, Ack: 8097335, Len: 63
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Read AndX Request (0x2e)

No. Time Source Destination Protocol Info
8872 11:25:40.808359 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8872 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8097335, Ack: 20161, Len: 1460

No. Time Source Destination Protocol Info
8873 11:25:40.808478 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8873 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8098795, Ack: 20161, Len: 1460

No. Time Source Destination Protocol Info
8874 11:25:40.808486 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20161 Ack=8100255 Win=65535 Len=0

Frame 8874 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20161, Ack: 8100255, Len: 0

No. Time Source Destination Protocol Info
8875 11:25:40.808583 10.0.0.1 10.0.0.8 SMB
Read AndX Response, FID: 0x2337, 4096 bytes

Frame 8875 (1293 bytes on wire, 1293 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8100255, Ack: 20161, Len: 1239
[Reassembled TCP Segments (4159 bytes): #8872(1460), #8873(1460), #8875(1239)]
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Read AndX Response (0x2e)

No. Time Source Destination Protocol Info
8876 11:25:40.991778 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20161 Ack=8101494 Win=64296 Len=0

Frame 8876 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20161, Ack: 8101494, Len: 0

No. Time Source Destination Protocol Info
8877 11:25:42.063305 10.0.0.8 10.0.0.1 SMB
Session Setup AndX Request, NTLMSSP_NEGOTIATE

Frame 8877 (294 bytes on wire, 294 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20161, Ack: 8101494, Len: 240
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Session Setup AndX Request (0x73)

No. Time Source Destination Protocol Info
8878 11:25:42.068932 10.0.0.1 10.0.0.8 SMB
Session Setup AndX Response, NTLMSSP_CHALLENGE, Error:
STATUS_MORE_PROCESSING_REQUIRED

Frame 8878 (354 bytes on wire, 354 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101494, Ack: 20401, Len: 300
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Session Setup AndX Response (0x73)

No. Time Source Destination Protocol Info
8879 11:25:42.069013 10.0.0.8 10.0.0.1 SMB
Session Setup AndX Request, NTLMSSP_AUTH, User: \

Frame 8879 (314 bytes on wire, 314 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20401, Ack: 8101794, Len: 260
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Session Setup AndX Request (0x73)

No. Time Source Destination Protocol Info
8880 11:25:42.102777 10.0.0.1 10.0.0.8 TCP
netbios-ssn > sftdst-port [ACK] Seq=8101794 Ack=20661 Win=65535 Len=0

Frame 8880 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101794, Ack: 20661, Len: 0

No. Time Source Destination Protocol Info
8881 11:25:43.215667 10.0.0.8 10.0.0.1 SMB
Read AndX Request, FID: 0x2337, 61440 bytes at offset 2686976

Frame 8881 (117 bytes on wire, 117 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20661, Ack: 8101794, Len: 63
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Read AndX Request (0x2e)

No. Time Source Destination Protocol Info
8882 11:25:43.215799 10.0.0.1 10.0.0.8 TCP
netbios-ssn > sftdst-port [ACK] Seq=8101794 Ack=20724 Win=65535 Len=0

Frame 8882 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101794, Ack: 20724, Len: 0

No. Time Source Destination Protocol Info
8883 11:26:02.795713 10.0.0.1 10.0.0.8 SMB
Session Setup AndX Response

Frame 8883 (162 bytes on wire, 162 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101794, Ack: 20724, Len: 108
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Session Setup AndX Response (0x73)

No. Time Source Destination Protocol Info
8884 11:26:02.795906 10.0.0.8 10.0.0.1 SMB
Tree Connect AndX Request, Path: \\WOLF\IPC$

Frame 8884 (132 bytes on wire, 132 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20724, Ack: 8101902, Len: 78
NetBIOS Session Service
SMB (Server Message Block Protocol)
SMB Header
Tree Connect AndX Request (0x75)

No. Time Source Destination Protocol Info
8885 11:26:02.796154 10.0.0.1 10.0.0.8 TCP
netbios-ssn > sftdst-port [ACK] Seq=8101902 Ack=20802 Win=65535 Len=0

Frame 8885 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101902, Ack: 20802, Len: 0

No. Time Source Destination Protocol Info
8886 11:26:02.803306 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8886 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8101902, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8887 11:26:02.803427 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8887 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8103362, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8888 11:26:02.803436 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20802 Ack=8104822 Win=65535 Len=0

Frame 8888 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20802, Ack: 8104822, Len: 0

No. Time Source Destination Protocol Info
8889 11:26:02.803551 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8889 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8104822, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8890 11:26:02.803674 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8890 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8106282, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8891 11:26:02.803682 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20802 Ack=8107742 Win=65535 Len=0

Frame 8891 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20802, Ack: 8107742, Len: 0

No. Time Source Destination Protocol Info
8892 11:26:02.803815 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8892 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8107742, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8893 11:26:02.803938 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8893 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8109202, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8894 11:26:02.803945 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20802 Ack=8110662 Win=65535 Len=0

Frame 8894 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20802, Ack: 8110662, Len: 0

No. Time Source Destination Protocol Info
8895 11:26:02.804062 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8895 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8110662, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8896 11:26:02.804184 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8896 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8112122, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8897 11:26:02.804189 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20802 Ack=8113582 Win=65535 Len=0

Frame 8897 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20802, Ack: 8113582, Len: 0

No. Time Source Destination Protocol Info
8898 11:26:02.804307 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8898 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8113582, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8899 11:26:02.804430 10.0.0.1 10.0.0.8 TCP
[TCP segment of a reassembled PDU]

Frame 8899 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: JetwayIn_a9:58:5e (00:30:18:a9:58:5e), Dst:
AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f)
Internet Protocol, Src: 10.0.0.1 (10.0.0.1), Dst: 10.0.0.8 (10.0.0.8)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port:
sftdst-port (3230), Seq: 8115042, Ack: 20802, Len: 1460

No. Time Source Destination Protocol Info
8900 11:26:02.804436 10.0.0.8 10.0.0.1 TCP
sftdst-port > netbios-ssn [ACK] Seq=20802 Ack=8116502 Win=65535 Len=0

Frame 8900 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: AsustekC_dd:ac:5f (00:1f:c6:dd:ac:5f), Dst:
JetwayIn_a9:58:5e (00:30:18:a9:58:5e)
Internet Protocol, Src: 10.0.0.8 (10.0.0.8), Dst: 10.0.0.1 (10.0.0.1)
Transmission Control Protocol, Src Port: sftdst-port (3230), Dst Port:
netbios-ssn (139), Seq: 20802, Ack: 8116502, Len: 0

---------------------------------


Apologies for the length of this email. I wasn't sure if the listserver
allowed attachments, so I pasted the logs inline...

Thanks,