Re: [Wireshark-users] Strange packet nbns

2007-02-18 Thread Jon Knight
Thanks for your ideas. I searched the registry and deleted references to it and it still occurs. I turned off WINS on the server and it still tries to hit the bps-ntserver1. I turned off netbios over TCP/IP in the control panel and then it stopped. I don't know where else to look in windows if

Re: [Wireshark-users] Strange packet nbns

2007-02-18 Thread Bill Meier
> > On Sun, 18 Feb 2007 20:25:40 +1100, "Jon Knight" <[EMAIL PROTECTED]> > said: > > Hi all > > > > > > > > Hope you can help. I tried Wireshark on my network and once a winxp > > client > > logs into my network (Win 2003 server as DC) I see NBNS name query nb > > bps-ntserver1 > > The foll

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Hi Guy, Ya it seems I am really pointing my finger now at the os or card to find out if I can change this. Thanks for your input anyway William -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guy Harris Sent: 18 February 2007 22:51 To: Community suppor

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread Guy Harris
William Murphy wrote: > Luis Ontanon wrote: > >> does snoop work in promiscuous mode? > > Supposedly Try snoop on your V440, capturing traffic on the interface connected to the switch's monitored port (i.e., the same port on which you tried tcpdump and *shark), and see if you see any traff

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread Luis Ontanon
http://docs.sun.com/app/docs/doc/817-3947/6mjgnrl80?a=view says that ce does actually support promiscuous mode. You might have to change something in /kernel/drv/ce.conf but honestly I do not knopw what. Luis On 2/18/07, William Murphy <[EMAIL PROTECTED]> wrote: > Supposedlyi have tried w

Re: [Wireshark-users] Strange packet nbns

2007-02-18 Thread Hans Nilsson
Have you tried doing a search in the registry for "ntserver1" or similar? On Sun, 18 Feb 2007 20:25:40 +1100, "Jon Knight" <[EMAIL PROTECTED]> said: > Hi all > > > > Hope you can help. I tried Wireshark on my network and once a winxp > client > logs into my network (Win 2003 server as DC) I s

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Supposedlyi have tried with tethereal also and it has same effect.No traffic captured -Original Message- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Luis Ontanon Sent: 18 February 2007 21:12 To: Community support list for Wireshark Subject: Re: [Wireshark-users] List

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread Luis Ontanon
does snoop work in promiscuous mode? On 2/18/07, William Murphy <[EMAIL PROTECTED]> wrote: > Hi, >Ok changed the rights on the file > > crw-rw-rw- 1 root sys 11, 80 May 14 2006 [EMAIL PROTECTED]:ce > > but this still does not make a difference. I did not restart the system. > Just

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Hi, Ok changed the rights on the file crw-rw-rw- 1 root sys 11, 80 May 14 2006 [EMAIL PROTECTED]:ce but this still does not make a difference. I did not restart the system. Just changed rights and made trace which did not work. Will -Original Message- From: [EMAIL PROTEC

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Hi I cant seem to snoop as root. Makes no difference. [EMAIL PROTECTED] # ls -la /dev/ce lrwxrwxrwx 1 root root 28 May 14 2006 /dev/ce -> ../devices/pseudo/[EMAIL PROTECTED]:ce [EMAIL PROTECTED] # ls -la ../devices/pseudo/[EMAIL PROTECTED]:ce crw--- 1 root sys 11, 8

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread Luis Ontanon
I used to capture promiscous on sun boxen without any problem. So it might be an issue with permissions of the /dev/ node for the interface which I remember I had to change myself. . Can you capture as root? If so which are the permissions on /dev/ifname? What happens if you change permissions on

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Hi , Thanks for getting back to metcpdump does not capture eitheri have been reading up on this and here it is. The laptop I use is not as secure as Sun server and the nic card can be turned into promiscuous mode easily by software, But on the Sun server I don't think the software can t

Re: [Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread Luis Ontanon
What about tcpdump, does it capture? What happen if you run it as root, can you capture? is /dev/ifname readable by the user you are trying to capture with? On 2/18/07, William Murphy <[EMAIL PROTECTED]> wrote: > Hi All, > >Don't know if this is the correct board to put this too but hear goes

[Wireshark-users] Listening on Port mirrored interface

2007-02-18 Thread William Murphy
Hi All, Don't know if this is the correct board to put this too but hear goes anyway. I am having problems listening for packets on my Sun Machine. I have a F5 BIGIP switch on which I mirrored the traffic port(i.e.9) to another port 16 for listening and tracing. In port 16 bi run a cabl

[Wireshark-users] Listening on port mirrored interface

2007-02-18 Thread William Murphy
Hi All, Don't know if this is the correct board to put this too but hear goes anyway. I am having problems listening for packets on my Sun Machine. I have a F5 BIGIP switch on which I mirrored the traffic port(i.e.9) to another port 16 for listening and tracing. In port 16 bi run a cabl

[Wireshark-users] Strange packet nbns

2007-02-18 Thread Jon Knight
Hi all Hope you can help. I tried Wireshark on my network and once a winxp client logs into my network (Win 2003 server as DC) I see NBNS name query nb bps-ntserver1 The bps-ntserver1 was an old NT 4 server but I have since built a new domain. I have a feeling a reg key or something is still