Hi, Matthieu,
I need some clarification about your question. I have a problem to match
the packets to what you have described.The trace has only 6 packets. The
following are all the packets in the trace:
1 3:28:33 PM 5/17/20110.000 172.16.101.16 172.16.101.1
Hello Hongwei,
So the attached pcap show dfs referral traffic between a S4 and XP hosts.
Where we can see that XP is requesting a level 4 referral and that S4
answers to it with an answer following the specification.
After this XP is blocked or fallback to NTLM auth (not shown in this
captur
Matthieu,
I used your complete trace (dfs2.pcap) to see the entire scenario.The
reason it falls back to NTLM from Kerberos is because it cannot get the TGS
ticket for SPN (cifs/w2k8r2.home.matws.net). The error is
KDC_ERR_S_PRINCIPAL_UNKNOWN. Have you checked if the SPN has been regi
Matthieu,
I confirmed that there is a problem with the Netmon parser when displaying
ReferralEntryFlag. The ReferralEntryFlags should be in little endian. In the
packet, it should be parsed as 0x0004 that has TargetSetBoundary bit set for
the first entry. So this is not the problem. I wi
On 08/06/2011 02:01, Hongwei Sun wrote:
Matthieu,
I confirmed that there is a problem with the Netmon parser when displaying
ReferralEntryFlag. The ReferralEntryFlags should be in little endian. In the
packet, it should be parsed as 0x0004 that has TargetSetBoundary bit set for
the first
:111051779565831] RE: dfs referral for sysvol
and windows XP
Hello Hongwei,
Any news on this ?
Matthieu.
On 08/06/2011 11:22, Matthieu Patou wrote:
> On 08/06/2011 02:01, Hongwei Sun wrote:
>> Matthieu,
>>
>>I confirmed that there is a problem with the Netmon parse
