Network Monitor Capture

Hello,

I am having issue a peculiar issue with a company having domain say 123.com.
My company domain is 345.com. 123.com domain controllers have a trust
relationship with 345.com where they are WINS replication patners.

123.com access a web server in 345.com domain.From machines connected to
123.com domain, an nslookup with IP address and NETBIOS name of web server
resolve with no issues. But 123.com machines cannot access the webserver say
ws.345.com. They need to put the IP address of ws.345.com to gain access.

I tried capturing from 123.com machines to ws.345.com using microsoft
network monitor and I am not seeing any HTTP request from 123.com. I see only
TCP converstaions and I guess this is because the IP address is used. Or
should I see HTTP conversations?

While looking at the capture file I see (scale factor not found) at the end
of every conversation. What does this mean? Where could I get a detailed
technote for Microsoft network monitor?

Tcp: Flags=.S......, SrcPort=1829, DstPort=7001, Len=0, Seq=2772131928,
Ack=0, Win=16384 (scale factor not found)

Thanks all

add 345.com as connection suffix for your 123.com clients (via DHCP or
manually or via GPO)

I never found a really good, detailed doc for Netmon (it should be a book if
you include examples). The best way is to use it and practice. RFCs can
help - you can get information about each packet type there.

here is an MS KB: http://support.microsoft.com/kb/812953

Regards,

-Alex

"TSAM" <(E-Mail Removed)> wrote in message
news:7C858B42-E42C-4CF5-9884-(E-Mail Removed)...
> Hello,
>
> I am having issue a peculiar issue with a company having domain say
> 123.com.
> My company domain is 345.com. 123.com domain controllers have a trust
> relationship with 345.com where they are WINS replication patners.
>
> 123.com access a web server in 345.com domain.From machines connected to
> 123.com domain, an nslookup with IP address and NETBIOS name of web server
> resolve with no issues. But 123.com machines cannot access the webserver
> say
> ws.345.com. They need to put the IP address of ws.345.com to gain access.
>
> I tried capturing from 123.com machines to ws.345.com using microsoft
> network monitor and I am not seeing any HTTP request from 123.com. I see
> only
> TCP converstaions and I guess this is because the IP address is used. Or
> should I see HTTP conversations?
>
> While looking at the capture file I see (scale factor not found) at the
> end
> of every conversation. What does this mean? Where could I get a detailed
> technote for Microsoft network monitor?
>
> Tcp: Flags=.S......, SrcPort=1829, DstPort=7001, Len=0, Seq=2772131928,
> Ack=0, Win=16384 (scale factor not found)
>
> Thanks all