Hi,
On my network I have a few Win2K Pro machines flooding the network with packets going to the DC. I am attaching a couple of packets captured with sniffer. Mainly, I see a packet of CIFS/SMB tpye which contains only a few bytes of actual data and rest is all padding. Then after that, I see 10-11 packets which have even less data and more padding. These additional packets show that they are SMB continuation of the first frame. This continues on and keeps flooding the network.
Could someone please help me find out what these packets are all about and how do I get rid of them?
Thank you.
Frame Status Source
Destination
Bytes Rel
Delta Time Abs time Summary
——————————————————-
1 M [192.168.5.2] [192.168.20.3]
1514 0:00
0.000.000 11/03/2003 05:41:47 PM CIFS/SMB: C Write AndX H=C017
Bytes=16580, Start
DLC: —– DLC Header —–
DLC:
DLC: Frame 1 arrived at 17:41:47.0858; frame size is 1514 (05EA
hex) bytes.
DLC: Destination = Station BellSy4515BE
DLC: Source = Station 333802A2D98D
DLC: Ethertype = 0800 (IP)
DLC:
IP: —– IP Header —–
IP:
IP: Version = 4, header length = 20 bytes
IP: Type of service = 00
IP:000. …. = routine
IP:…0 …. = normal delay
IP:…. 0… = normal throughput
IP:…. .0.. = normal reliability
IP:…. ..0. = ECT bit – transport protocol will ignore the
CE bit
IP:…. …0 = CE bit – no congestion
IP: Total length= 1500 bytes
IP: Identification = 30871
IP: Flags = 4X
IP:.1.. …. = don’t fragment
IP:..0. …. = last fragment
IP: Fragment offset = 0 bytes
IP: Time to live= 128 seconds/hops
IP: Protocol= 6 (TCP)
IP: Header checksum = 272E (correct)
IP: Source address = [192.168.5.2]
IP: Destination address = [192.168.20.3]
IP: No options
IP:
(More of Packet in comments)