Re: Novell Server node address change [7:55264]

2002-10-11 Thread The Long and Winding Road

Priscilla Oppenheimer  wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
 The number after network.node is the IPX socket number, not an SPX socket
snip for clarity

 Were those numbers you told us made up to hide the details for security
 reasons? Can you tell us the actual numbers?


CL: just to improve my own understanding of things  ( well, OK, and to be a
smart ass too ),  why would one consider sanitizing MAC addresses for
security reasons?  :-  maybe on a wireless network?



snip some more




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55345t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



Re: Novell Server node address change [7:55264]

2002-10-11 Thread Ole D Jensen

You're right, but it was easier to type a made up 8+12+4 digit number than 
to walk between my server and workstation memorising at part of it 
everytime :-)

But, however, had I specified in my Novell user configuration that the 
admin could only login from the PC I have in my bullet/sound proof box 
with 7 combinations keys on it, you could by knowing my MAC address (and 
of course the admin's password) hardcode your NIC to have the same MAC, 
break into our office, connect your PC to our network, and login as admin.

A little bit far out, but you'll never know :-)

Ole


 Ole Drews Jensen
 Systems Network Manager
 CCNP, MCSE, MCP+I
 RWR Enterprises, Inc.
 [EMAIL PROTECTED]

 http://www.RouterChief.com







The Long and Winding Road 
Sent by: [EMAIL PROTECTED]
10/11/2002 01:57 AM
Please respond to The Long and Winding Road

 
To: [EMAIL PROTECTED]
cc: 
Subject:Re: Novell Server node address change [7:55264]


Priscilla Oppenheimer  wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
 The number after network.node is the IPX socket number, not an SPX 
socket
snip for clarity

 Were those numbers you told us made up to hide the details for security
 reasons? Can you tell us the actual numbers?


CL: just to improve my own understanding of things  ( well, OK, and to be 
a
smart ass too ),  why would one consider sanitizing MAC addresses for
security reasons?  :-  maybe on a wireless network?



snip some more




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55404t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



RE: Novell Server node address change [7:55264]

2002-10-10 Thread Williams, Dave

You might try and clear the routing and network tables (I believe the
command is clear routes although it's been a while) on the server.  This
will cause the server to resend SAPs to populate its tables.  Sometimes the
routing tables on a Novell Server (especially 4.10) gets messed up and won't
dump the corrupted information.

Dave Williams, CCDA, CCNA, CCSA
Senior Network Engineer
(402) 661-2143


-Original Message-
From: Ole D Jensen [mailto:[EMAIL PROTECTED]]
Sent: Thursday, October 10, 2002 8:40 AM
To: [EMAIL PROTECTED]
Subject: OT: Novell Server node address change [7:55264]


This is a good step off the Cisco topic, but since it is in the network 
world, I'm sure at least one person on this list knows the answer.

I have an old Novell NetWare 4.10 running, and sometimes it start changing 
the address of one specific workstation. I have looked over and over at 
the workstation to find a possible bug, but everything lookes fine, and 
reinstalling the Novell Client has not changed anything.

Every 30 seconds, the Novell Server changes the node address back and 
forth:

10-10-028:20:00 am:Server-4.10-3191
Server WORKSTATION_27
Address has changed from 0040:123456789012:1234
to 0040:123456789012:3412
Information came from router at 123456789012

10-10-028:20:01 am:Server-4.10-3191

Server WORKSTATION_27
Address has changed from 0040:123456789012:3412
to 0040:123456789012:1234
Information came from router at 123456789012

To avoid misunderstandings, the WORKSTATION_27 is the workstation that it 
keeps changing the address on. I am not sure if it's the workstation 
itself that changes this address or the server, but it also says that the 
information came from router 123456789012 which is the workstation.

I'm sure there's a logical explanation for this.

Thanks in advance for any comments,

Ole


 Ole Drews Jensen
 Systems Network Manager
 CCNP, MCSE, MCP+I
 RWR Enterprises, Inc.
 [EMAIL PROTECTED]

 http://www.RouterChief.com





Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55268t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



RE: Novell Server node address change [7:55264]

2002-10-10 Thread Ole D Jensen

Thanks Dave,

I have tried that without any luck.

The command is reset router.

Thanks,

Ole


 Ole Drews Jensen
 Systems Network Manager
 CCNP, MCSE, MCP+I
 RWR Enterprises, Inc.
 [EMAIL PROTECTED]

 http://www.RouterChief.com







Williams, Dave 
10/10/2002 09:40 AM

 
To: 'Ole D Jensen' , [EMAIL PROTECTED]
cc: 
Subject:RE: Novell Server node address change [7:55264]


You might try and clear the routing and network tables (I believe the 
command is clear routes although it's been a while) on the server.  This 
will cause the server to resend SAPs to populate its tables.  Sometimes 
the routing tables on a Novell Server (especially 4.10) gets messed up and 
won't dump the corrupted information.
Dave Williams, CCDA, CCNA, CCSA 
Senior Network Engineer 
(402) 661-2143 

-Original Message- 
From: Ole D Jensen [mailto:[EMAIL PROTECTED]] 
Sent: Thursday, October 10, 2002 8:40 AM 
To: [EMAIL PROTECTED] 
Subject: OT: Novell Server node address change [7:55264] 

This is a good step off the Cisco topic, but since it is in the network 
world, I'm sure at least one person on this list knows the answer. 
I have an old Novell NetWare 4.10 running, and sometimes it start changing 

the address of one specific workstation. I have looked over and over at 
the workstation to find a possible bug, but everything lookes fine, and 
reinstalling the Novell Client has not changed anything. 
Every 30 seconds, the Novell Server changes the node address back and 
forth: 
10-10-028:20:00 am:Server-4.10-3191 
Server WORKSTATION_27 
Address has changed from 0040:123456789012:1234 
to 0040:123456789012:3412 
Information came from router at 123456789012 
10-10-028:20:01 am:Server-4.10-3191 
Server WORKSTATION_27 
Address has changed from 0040:123456789012:3412 
to 0040:123456789012:1234 
Information came from router at 123456789012 
To avoid misunderstandings, the WORKSTATION_27 is the workstation that it 
keeps changing the address on. I am not sure if it's the workstation 
itself that changes this address or the server, but it also says that the 
information came from router 123456789012 which is the workstation. 
I'm sure there's a logical explanation for this. 
Thanks in advance for any comments, 
Ole 
 
 Ole Drews Jensen 
 Systems Network Manager 
 CCNP, MCSE, MCP+I 
 RWR Enterprises, Inc. 
 [EMAIL PROTECTED] 
 
 http://www.RouterChief.com 





Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55270t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



Re: Novell Server node address change [7:55264]

2002-10-10 Thread The Long and Winding Road

Ole, it's been a long time for me as well, but isn't that last set of
numbers - the four after the : ( colon ) the SPX socket number? That is the
thing that appears to be changing.


Not that I would know what the change signifies. what's running on that
workstation?
--

!



Ole D Jensen  wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
 Thanks Dave,

 I have tried that without any luck.

 The command is reset router.

 Thanks,

 Ole

 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 






 Williams, Dave
 10/10/2002 09:40 AM


 To: 'Ole D Jensen' , [EMAIL PROTECTED]
 cc:
 Subject:    RE: Novell Server node address change [7:55264]


 You might try and clear the routing and network tables (I believe the
 command is clear routes although it's been a while) on the server.  This
 will cause the server to resend SAPs to populate its tables.  Sometimes
 the routing tables on a Novell Server (especially 4.10) gets messed up and
 won't dump the corrupted information.
 Dave Williams, CCDA, CCNA, CCSA
 Senior Network Engineer
 (402) 661-2143

 -Original Message-
 From: Ole D Jensen [mailto:[EMAIL PROTECTED]]
 Sent: Thursday, October 10, 2002 8:40 AM
 To: [EMAIL PROTECTED]
 Subject: OT: Novell Server node address change [7:55264]

 This is a good step off the Cisco topic, but since it is in the network
 world, I'm sure at least one person on this list knows the answer.
 I have an old Novell NetWare 4.10 running, and sometimes it start changing

 the address of one specific workstation. I have looked over and over at
 the workstation to find a possible bug, but everything lookes fine, and
 reinstalling the Novell Client has not changed anything.
 Every 30 seconds, the Novell Server changes the node address back and
 forth:
 10-10-028:20:00 am:Server-4.10-3191
 Server WORKSTATION_27
 Address has changed from 0040:123456789012:1234
 to 0040:123456789012:3412
 Information came from router at 123456789012
 10-10-028:20:01 am:Server-4.10-3191
 Server WORKSTATION_27
 Address has changed from 0040:123456789012:3412
 to 0040:123456789012:1234
 Information came from router at 123456789012
 To avoid misunderstandings, the WORKSTATION_27 is the workstation that it
 keeps changing the address on. I am not sure if it's the workstation
 itself that changes this address or the server, but it also says that the
 information came from router 123456789012 which is the workstation.
 I'm sure there's a logical explanation for this.
 Thanks in advance for any comments,
 Ole
 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55271t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



Re: Novell Server node address change [7:55264]

2002-10-10 Thread Ole D Jensen

Yeah, I think you're right. I am not spending much time on the NW side of 
my network, so I can't remember all the facts by heart.

The apps installed on that WorkStation are the same as installed on most 
other WorkStations on my networks.

Ole


 Ole Drews Jensen
 Systems Network Manager
 CCNP, MCSE, MCP+I
 RWR Enterprises, Inc.
 [EMAIL PROTECTED]

 http://www.RouterChief.com






The Long and Winding Road 
Sent by: [EMAIL PROTECTED]
10/10/2002 10:03 AM
Please respond to The Long and Winding Road

 
To: [EMAIL PROTECTED]
cc: 
Subject:Re: Novell Server node address change [7:55264]


Ole, it's been a long time for me as well, but isn't that last set of
numbers - the four after the : ( colon ) the SPX socket number? That is 
the
thing that appears to be changing.


Not that I would know what the change signifies. what's running on that
workstation?
--

!



Ole D Jensen  wrote in message
[EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
 Thanks Dave,

 I have tried that without any luck.

 The command is reset router.

 Thanks,

 Ole

 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 






 Williams, Dave
 10/10/2002 09:40 AM


 To: 'Ole D Jensen' , [EMAIL PROTECTED]
 cc:
 Subject:    RE: Novell Server node address change [7:55264]


 You might try and clear the routing and network tables (I believe the
 command is clear routes although it's been a while) on the server. 
This
 will cause the server to resend SAPs to populate its tables.  Sometimes
 the routing tables on a Novell Server (especially 4.10) gets messed up 
and
 won't dump the corrupted information.
 Dave Williams, CCDA, CCNA, CCSA
 Senior Network Engineer
 (402) 661-2143

 -Original Message-
 From: Ole D Jensen [mailto:[EMAIL PROTECTED]]
 Sent: Thursday, October 10, 2002 8:40 AM
 To: [EMAIL PROTECTED]
 Subject: OT: Novell Server node address change [7:55264]

 This is a good step off the Cisco topic, but since it is in the network
 world, I'm sure at least one person on this list knows the answer.
 I have an old Novell NetWare 4.10 running, and sometimes it start 
changing

 the address of one specific workstation. I have looked over and over at
 the workstation to find a possible bug, but everything lookes fine, and
 reinstalling the Novell Client has not changed anything.
 Every 30 seconds, the Novell Server changes the node address back and
 forth:
 10-10-028:20:00 am:Server-4.10-3191
 Server WORKSTATION_27
 Address has changed from 0040:123456789012:1234
 to 0040:123456789012:3412
 Information came from router at 123456789012
 10-10-028:20:01 am:Server-4.10-3191
 Server WORKSTATION_27
 Address has changed from 0040:123456789012:3412
 to 0040:123456789012:1234
 Information came from router at 123456789012
 To avoid misunderstandings, the WORKSTATION_27 is the workstation that 
it
 keeps changing the address on. I am not sure if it's the workstation
 itself that changes this address or the server, but it also says that 
the
 information came from router 123456789012 which is the workstation.
 I'm sure there's a logical explanation for this.
 Thanks in advance for any comments,
 Ole
 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 




Message Posted at:
http://www.groupstudy.com/form/read.php?f=7i=55282t=55264
--
FAQ, list archives, and subscription info: http://www.groupstudy.com/list/cisco.html
Report misconduct and Nondisclosure violations to [EMAIL PROTECTED]



Re: Novell Server node address change [7:55264]

2002-10-10 Thread Priscilla Oppenheimer

The number after network.node is the IPX socket number, not an SPX socket
number. Some protocols, such as IPX and DDP, have a socket number at the
network layer.

SPX was used by RCONSOLE. Some SNA gateways used it, though most used
NetBIOS. I think some printing can use SPX. Ordinary client/server traffic
uses NetWare Core Protocol (NCP), however, which resides directly above IPX
and does not use SPX. NCP has its own build-in transport like behavior that
is similar to the old IPX PEP and provides a semi-reliable delivery service
for single packet exchanges (often called a ping/pong protocol). SPX behaves
more like TCP but is way less important and not used by much.

It would be normal for a client's socket number to change if new appliations
were started or restarted. Could you watch this user and see what they do? I
usually blame the users. ;-) Could they be playing a game perhaps?

Were those numbers you told us made up to hide the details for security
reasons? Can you tell us the actual numbers?

You can probably get more detailed info at novell.com, but here's a few
nuggets about IPX sockets:

Socket numbers between 0x4000 and 0x7FFF are dynamic sockets; these are used
by clients to communicate with servers. Socket numbers between 0x8000 and
0x are well-known sockets; these are assigned by Novell to specific
processes. Software developers who write NetWare applications can ask Novell
to reserve a socket number and get on the list of well-known sockets. Novell
also reserves several sockets for use in the NetWare environment. Here's a
partial list of  socket numbers.

Socket  Process
0x0002  Cisco IPX ping
0x0451  NCP server
0x0452  SAP 
0x0453  RIP 
0x0455  Novell NetBIOS 
0x0456  Diagnostics 
0x85BE  EIGRP
0x9001  NLSP 
0x9004  IPXWAN
0x9086  Novell IPX ping
___

Priscilla Oppenheimer
www.troubleshootingnetworks.com
www.priscilla.com

Ole D Jensen wrote:
 
 Yeah, I think you're right. I am not spending much time on the
 NW side of
 my network, so I can't remember all the facts by heart.
 
 The apps installed on that WorkStation are the same as
 installed on most
 other WorkStations on my networks.
 
 Ole
 
 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 
 
 
 
 
 
 The Long and Winding Road 
 Sent by: [EMAIL PROTECTED]
 10/10/2002 10:03 AM
 Please respond to The Long and Winding Road
 
  
 To: [EMAIL PROTECTED]
 cc: 
 Subject:Re: Novell Server node address change
 [7:55264]
 
 
 Ole, it's been a long time for me as well, but isn't that last
 set of
 numbers - the four after the : ( colon ) the SPX socket number?
 That is
 the
 thing that appears to be changing.
 
 
 Not that I would know what the change signifies. what's running
 on that
 workstation?
 --
 
 !
 
 
 
 Ole D Jensen  wrote in message
 [EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
  Thanks Dave,
 
  I have tried that without any luck.
 
  The command is reset router.
 
  Thanks,
 
  Ole
 
  
   Ole Drews Jensen
   Systems Network Manager
   CCNP, MCSE, MCP+I
   RWR Enterprises, Inc.
   [EMAIL PROTECTED]
  
   http://www.RouterChief.com
  
 
 
 
 
 
 
  Williams, Dave
  10/10/2002 09:40 AM
 
 
  To: 'Ole D Jensen' , [EMAIL PROTECTED]
  cc:
  Subject:    RE: Novell Server node address change
 [7:55264]
 
 
  You might try and clear the routing and network tables (I
 believe the
  command is clear routes although it's been a while) on the
 server.
 This
  will cause the server to resend SAPs to populate its tables. 
 Sometimes
  the routing tables on a Novell Server (especially 4.10) gets
 messed up
 and
  won't dump the corrupted information.
  Dave Williams, CCDA, CCNA, CCSA
  Senior Network Engineer
  (402) 661-2143
 
  -Original Message-
  From: Ole D Jensen [mailto:[EMAIL PROTECTED]]
  Sent: Thursday, October 10, 2002 8:40 AM
  To: [EMAIL PROTECTED]
  Subject: OT: Novell Server node address change [7:55264]
 
  This is a good step off the Cisco topic, but since it is in
 the network
  world, I'm sure at least one person on this list knows the
 answer.
  I have an old Novell NetWare 4.10 running, and sometimes it
 start
 changing
 
  the address of one specific workstation. I have looked over
 and over at
  the workstation to find a possible bug, but everything lookes
 fine, and
  reinstalling the Novell Client has not changed anything.
  Every 30 seconds, the Novell Server changes the node address
 back and
  forth:
  10-10-028:20:00 am:Server-4.10-3191
  Server WORKSTATION_27
  Address has changed from 0040:123456789012:1234
  to 0040:123456789012:3412
  Information came from router at 123456789012
  10-10-028:

Re: Novell Server node address change [7:55264]

2002-10-10 Thread Ole D Jensen

Thanks Priscilla for a very good explanation.

The numbers were just made up, but it keeps changing from 85E8 to E885 and 
back to 85E8 a second later.

As far as I have found out so far, 85E8 is Microsoft Endpoint Mapper for 
RPC, however the workstation is a Windows 98.

I will take a closer look at the workstation, but if anyone have a good 
tip, please let me know.

Thanks,

Ole


 Ole Drews Jensen
 Systems Network Manager
 CCNP, MCSE, MCP+I
 RWR Enterprises, Inc.
 [EMAIL PROTECTED]

 http://www.RouterChief.com















Priscilla Oppenheimer 
Sent by: [EMAIL PROTECTED]
10/10/2002 11:46 AM
Please respond to Priscilla Oppenheimer

 
To: [EMAIL PROTECTED]
cc: 
Subject:Re: Novell Server node address change [7:55264]


The number after network.node is the IPX socket number, not an SPX socket
number. Some protocols, such as IPX and DDP, have a socket number at the
network layer.

SPX was used by RCONSOLE. Some SNA gateways used it, though most used
NetBIOS. I think some printing can use SPX. Ordinary client/server traffic
uses NetWare Core Protocol (NCP), however, which resides directly above 
IPX
and does not use SPX. NCP has its own build-in transport like behavior 
that
is similar to the old IPX PEP and provides a semi-reliable delivery 
service
for single packet exchanges (often called a ping/pong protocol). SPX 
behaves
more like TCP but is way less important and not used by much.

It would be normal for a client's socket number to change if new 
appliations
were started or restarted. Could you watch this user and see what they do? 
I
usually blame the users. ;-) Could they be playing a game perhaps?

Were those numbers you told us made up to hide the details for security
reasons? Can you tell us the actual numbers?

You can probably get more detailed info at novell.com, but here's a few
nuggets about IPX sockets:

Socket numbers between 0x4000 and 0x7FFF are dynamic sockets; these are 
used
by clients to communicate with servers. Socket numbers between 0x8000 and
0x are well-known sockets; these are assigned by Novell to specific
processes. Software developers who write NetWare applications can ask 
Novell
to reserve a socket number and get on the list of well-known sockets. 
Novell
also reserves several sockets for use in the NetWare environment. Here's a
partial list of  socket numbers.

Socket   Process
0x0002   Cisco IPX ping
0x0451   NCP server
0x0452   SAP 
0x0453   RIP 
0x0455   Novell NetBIOS 
0x0456   Diagnostics 
0x85BE   EIGRP
0x9001   NLSP 
0x9004   IPXWAN
0x9086   Novell IPX ping
___

Priscilla Oppenheimer
www.troubleshootingnetworks.com
www.priscilla.com

Ole D Jensen wrote:
 
 Yeah, I think you're right. I am not spending much time on the
 NW side of
 my network, so I can't remember all the facts by heart.
 
 The apps installed on that WorkStation are the same as
 installed on most
 other WorkStations on my networks.
 
 Ole
 
 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 
 
 
 
 
 
 The Long and Winding Road 
 Sent by: [EMAIL PROTECTED]
 10/10/2002 10:03 AM
 Please respond to The Long and Winding Road
 
 
 To: [EMAIL PROTECTED]
 cc: 
 Subject:Re: Novell Server node address change
 [7:55264]
 
 
 Ole, it's been a long time for me as well, but isn't that last
 set of
 numbers - the four after the : ( colon ) the SPX socket number?
 That is
 the
 thing that appears to be changing.
 
 
 Not that I would know what the change signifies. what's running
 on that
 workstation?
 --
 
 !
 
 
 
 Ole D Jensen  wrote in message
 [EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
  Thanks Dave,
 
  I have tried that without any luck.
 
  The command is reset router.
 
  Thanks,
 
  Ole
 
  
   Ole Drews Jensen
   Systems Network Manager
   CCNP, MCSE, MCP+I
   RWR Enterprises, Inc.
   [EMAIL PROTECTED]
  
   http://www.RouterChief.com
  
 
 
 
 
 
 
  Williams, Dave
  10/10/2002 09:40 AM
 
 
  To: 'Ole D Jensen' , [EMAIL PROTECTED]
  cc:
  Subject:    RE: Novell Server node address change
 [7:55264]
 
 
  You might try and clear the routing and network tables (I
 believe the
  command is clear routes although it's been a while) on the
 server.
 This
  will cause the server to resend SAPs to populate its tables. 
 Sometimes
  the routing tables on a Novell Server (especially 4.10) gets
 messed up
 and
  won't dump the corrupted information.
  Dave Williams, CCDA, CCNA, CCSA
  Senior Network Engineer
  (402) 661-2143
 
  -

Re: Novell Server node address change [7:55264]

2002-10-10 Thread Jenny McLeod

This may not be relevant since it's just the socket that changes, but you
don't have another workstation with a duplicate address, do you?  I have
seen similar symptoms from that.

JMcL
Ole D Jensen wrote:
 
 Thanks Priscilla for a very good explanation.
 
 The numbers were just made up, but it keeps changing from 85E8
 to E885 and
 back to 85E8 a second later.
 
 As far as I have found out so far, 85E8 is Microsoft Endpoint
 Mapper for
 RPC, however the workstation is a Windows 98.
 
 I will take a closer look at the workstation, but if anyone
 have a good
 tip, please let me know.
 
 Thanks,
 
 Ole
 
 
  Ole Drews Jensen
  Systems Network Manager
  CCNP, MCSE, MCP+I
  RWR Enterprises, Inc.
  [EMAIL PROTECTED]
 
  http://www.RouterChief.com
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 Priscilla Oppenheimer 
 Sent by: [EMAIL PROTECTED]
 10/10/2002 11:46 AM
 Please respond to Priscilla Oppenheimer
 
  
 To: [EMAIL PROTECTED]
 cc: 
 Subject:Re: Novell Server node address change
 [7:55264]
 
 
 The number after network.node is the IPX socket number, not an
 SPX socket
 number. Some protocols, such as IPX and DDP, have a socket
 number at the
 network layer.
 
 SPX was used by RCONSOLE. Some SNA gateways used it, though
 most used
 NetBIOS. I think some printing can use SPX. Ordinary
 client/server traffic
 uses NetWare Core Protocol (NCP), however, which resides
 directly above
 IPX
 and does not use SPX. NCP has its own build-in transport like
 behavior
 that
 is similar to the old IPX PEP and provides a semi-reliable
 delivery
 service
 for single packet exchanges (often called a ping/pong
 protocol). SPX
 behaves
 more like TCP but is way less important and not used by much.
 
 It would be normal for a client's socket number to change if
 new
 appliations
 were started or restarted. Could you watch this user and see
 what they do?
 I
 usually blame the users. ;-) Could they be playing a game
 perhaps?
 
 Were those numbers you told us made up to hide the details for
 security
 reasons? Can you tell us the actual numbers?
 
 You can probably get more detailed info at novell.com, but
 here's a few
 nuggets about IPX sockets:
 
 Socket numbers between 0x4000 and 0x7FFF are dynamic sockets;
 these are
 used
 by clients to communicate with servers. Socket numbers between
 0x8000 and
 0x are well-known sockets; these are assigned by Novell to
 specific
 processes. Software developers who write NetWare applications
 can ask
 Novell
 to reserve a socket number and get on the list of well-known
 sockets.
 Novell
 also reserves several sockets for use in the NetWare
 environment. Here's a
 partial list of  socket numbers.
 
 Socket   Process
 0x0002   Cisco IPX ping
 0x0451   NCP server
 0x0452   SAP 
 0x0453   RIP 
 0x0455   Novell NetBIOS 
 0x0456   Diagnostics 
 0x85BE   EIGRP
 0x9001   NLSP 
 0x9004   IPXWAN
 0x9086   Novell IPX ping
 ___
 
 Priscilla Oppenheimer
 www.troubleshootingnetworks.com
 www.priscilla.com
 
 Ole D Jensen wrote:
  
  Yeah, I think you're right. I am not spending much time on the
  NW side of
  my network, so I can't remember all the facts by heart.
  
  The apps installed on that WorkStation are the same as
  installed on most
  other WorkStations on my networks.
  
  Ole
  
  
   Ole Drews Jensen
   Systems Network Manager
   CCNP, MCSE, MCP+I
   RWR Enterprises, Inc.
   [EMAIL PROTECTED]
  
   http://www.RouterChief.com
  
  
  
  
  
  
  The Long and Winding Road 
  Sent by: [EMAIL PROTECTED]
  10/10/2002 10:03 AM
  Please respond to The Long and Winding Road
  
  
  To: [EMAIL PROTECTED]
  cc: 
  Subject:Re: Novell Server node address change
  [7:55264]
  
  
  Ole, it's been a long time for me as well, but isn't that last
  set of
  numbers - the four after the : ( colon ) the SPX socket
 number?
  That is
  the
  thing that appears to be changing.
  
  
  Not that I would know what the change signifies. what's
 running
  on that
  workstation?
  --
  
  !
  
  
  
  Ole D Jensen  wrote in message
  [EMAIL PROTECTED]">news:[EMAIL PROTECTED]...
   Thanks Dave,
  
   I have tried that without any luck.
  
   The command is reset router.
  
   Thanks,
  
   Ole
  
   
Ole Drews Jensen
Systems Network Manager
CCNP, MCSE, MCP+I
RWR Enterprises, Inc.
[EMAIL PROTECTED]
   
http://www.RouterChief.com
   
  
  
  
  
  
  
   Williams, Dave
   10/10/2002 09:40 AM
  
  
   To: 'Ole D Jensen' , [EMAIL PROTECTED]
   cc:
   Subject:    RE: Novell Server node address
 change
  [7:55264]
  
  
   You m