I did a tcpdump to examine the NBT packets going across the LAN which
is causing my Samba clients to log messages about:
query_name_response: Multiple (2) responses received
---
The tcpdump showed the following.
01:41:19.943010 linux.netbios-ns > 192.168.0.255.netbios-ns: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST (D
F)
01:41:19.943124 linux.netbios-ns > 192.168.0.255.netbios-ns: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST (D
F)
01:41:20.033147 lnx04.netbios-ns > linux.netbios-ns: NBT UDP
PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST (
DF)
01:41:20.034283 lnx04.netbios-ns > linux.netbios-ns: NBT UDP
PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST (
DF)
---
At the this exact time I saw in the /var/log/samba/log.nmb
[2006/09/29 01:41:20, 0] nmbd/nmbd_namequery.c:query_name_response(104)
query_name_response: Multiple (2) responses received for a query on
subnet 192.168.0.114 for name LANSYS<1d>
..
This response was from IP 192.168.0.201, reporting an IP address of
192.168.0.201.
[2006/09/29 06:45:25, 0] nmbd/nmbd_namequery.c:query_name_response(104)
query_name_response: Multiple (2) responses received for a query on
subnet 192.168.0.114 for name LANSYS<1d>
..
This response was from IP 192.168.0.201, reporting an IP address of
192.168.0.201.
---
The sequence of events occurred again five hours later. First was the
double query request from machine [ linux ] and then two responses from
the Samba server [ lnx04 ]. In all other queries made by the machine [
linux ] the query received a response before that second query was
made. ie.
04:08:24.545699 linux.netbios-ns > 192.168.0.255.netbios-ns: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST (DF)
04:08:24.552269 lnx04.netbios-ns > linux.netbios-ns: NBT UDP
PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST (DF)
04:13:26.553281 linux.netbios-ns > 192.168.0.255.netbios-ns: NBT UDP
PACKET(137): QUERY; REQUEST; BROADCAST (DF)
04:13:26.639053 lnx04.netbios-ns > linux.netbios-ns: NBT UDP
PACKET(137): QUERY; POSITIVE; RESPONSE; UNICAST (DF)
---
So it appears the multiple response message is bogus. I have no other
machine in the LAN with the
NetBIOS name of LANSYS<1d> acting as the domain master. It appears the
lag in the response
from machine [ lnx04 ] are causing the [ Multiple (2) responses
received ... ] messages.
|