Login
[x]
Log in using an account from:
Fedora Account System
Red Hat Associate
Red Hat Customer
Or login using a Red Hat Bugzilla account
Forgot Password
Login:
Hide Forgot
Create an Account
Red Hat Bugzilla – Attachment 291898 Details for
Bug 429024
After establish trust with AD, wbinfo -u does not work
[?]
New
Simple Search
Advanced Search
My Links
Browse
Requests
Reports
Current State
Search
Tabular reports
Graphical reports
Duplicates
Other Reports
User Changes
Plotly Reports
Bug Status
Bug Severity
Non-Defaults
|
Product Dashboard
Help
Page Help!
Bug Writing Guidelines
What's new
Browser Support Policy
5.0.4.rh83 Release notes
FAQ
Guides index
User guide
Web Services
Contact
Legal
This site requires JavaScript to be enabled to function correctly, please enable it.
wb-LINR51VD1 log on level 10
wb-LINR51VD1.log (text/plain), 166.40 KB, created by
Lin Li
on 2008-01-16 21:58:57 UTC
(
hide
)
Description:
wb-LINR51VD1 log on level 10
Filename:
MIME Type:
Creator:
Lin Li
Created:
2008-01-16 21:58:57 UTC
Size:
166.40 KB
patch
obsolete
>[2008/01/16 03:39:29, 1] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625) > cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from remote machine LINR5164VS1 pipe \lsarpc fnum 0x71e7! >[2008/01/16 15:43:59, 1] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625) > cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from remote machine LINR5164VS1 pipe \lsarpc fnum 0x7267! >[2008/01/16 15:57:43, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 15:57:55, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 15:58:08, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 16:03:18, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 16:03:31, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 16:03:43, 0] libsmb/clientgen.c:cli_receive_smb(112) > Receiving SMB: Server stopped responding >[2008/01/16 16:40:38, 4] nsswitch/winbindd_dual.c:fork_domain_child(1054) > child daemon request 47 >[2008/01/16 16:40:38, 10] nsswitch/winbindd_dual.c:child_process_request(479) > process_request: request fn INIT_CONNECTION >[2008/01/16 16:40:38, 8] nsswitch/winbindd_cm.c:connection_ok(1434) > connection_ok: Connection to for domain LINR51VD1 has NULL cli! >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_get(226) > Returning expired cache entry: key = SAF/DOMAIN/LINR51VD1, value = LINR5164VS1, timeout = Wed Jan 16 16:19:54 2008 >[2008/01/16 16:40:38, 5] libsmb/namequery.c:saf_fetch(133) > saf_fetch: failed to find server for "LINR51VD1" domain >[2008/01/16 16:40:38, 10] nsswitch/winbindd_cm.c:cm_open_connection(1304) > cm_open_connection: dcname is '' for domain LINR51VD1 >[2008/01/16 16:40:38, 8] libsmb/namequery.c:get_sorted_dc_list(1626) > get_sorted_dc_list: attempting lookup for name LINR51VD1 (sitename NULL) using [lmhosts host wins bcast] >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = SAF/DOMAIN/LINR51VD1 couldn't be found >[2008/01/16 16:40:38, 5] libsmb/namequery.c:saf_fetch(133) > saf_fetch: failed to find server for "LINR51VD1" domain >[2008/01/16 16:40:38, 3] libsmb/namequery.c:get_dc_list(1489) > get_dc_list: preferred server list: ", *" >[2008/01/16 16:40:38, 10] libsmb/namequery.c:internal_resolve_name(1166) > internal_resolve_name: looking up LINR51VD1#1c (sitename (null)) >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_get(226) > Returning expired cache entry: key = NBT/LINR51VD1#1C, value = 192.168.122.1:0,172.16.9.21:0, timeout = Wed Jan 16 16:06:10 2008 >[2008/01/16 16:40:38, 5] libsmb/namecache.c:namecache_fetch(210) > no entry for LINR51VD1#1C found. >[2008/01/16 16:40:38, 3] libsmb/namequery.c:resolve_lmhosts(966) > resolve_lmhosts: Attempting lmhosts lookup for name LINR51VD1<0x1c> >[2008/01/16 16:40:38, 4] libsmb/namequery.c:getlmhostsent(717) > getlmhostsent: lmhost entry: 127.0.0.1 localhost >[2008/01/16 16:40:38, 5] libsmb/namequery.c:resolve_hosts(1022) > resolve_hosts: not appropriate for name type <0x1c> >[2008/01/16 16:40:38, 3] libsmb/namequery.c:resolve_wins(863) > resolve_wins: Attempting wins lookup for name LINR51VD1<0x1c> >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = WINS_SRV_DEAD/172.16.3.1,0.0.0.0 couldn't be found >[2008/01/16 16:40:38, 4] lib/wins_srv.c:wins_srv_is_dead(111) > wins_srv_is_dead: 172.16.3.1 is alive >[2008/01/16 16:40:38, 6] lib/wins_srv.c:wins_srv_ip_tag(311) > Current wins server for tag '*' with source 0.0.0.0 is 172.16.3.1 >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = WINS_SRV_DEAD/172.16.3.1,0.0.0.0 couldn't be found >[2008/01/16 16:40:38, 4] lib/wins_srv.c:wins_srv_is_dead(111) > wins_srv_is_dead: 172.16.3.1 is alive >[2008/01/16 16:40:38, 3] libsmb/namequery.c:resolve_wins(902) > resolve_wins: using WINS server 172.16.3.1 and tag '*' >[2008/01/16 16:40:38, 10] lib/util_sock.c:open_socket_in(839) > bind succeeded on port 0 >[2008/01/16 16:40:38, 5] libsmb/nmblib.c:send_udp(777) > Sending a packet of len 50 to (172.16.3.1) on port 137 >[2008/01/16 16:40:38, 10] lib/util_sock.c:read_udp_socket(294) > read_udp_socket: lastip 172.16.3.1 lastport 137 read: 74 >[2008/01/16 16:40:38, 10] libsmb/nmblib.c:parse_nmb(506) > parse_nmb: packet id = 18779 >[2008/01/16 16:40:38, 5] libsmb/nmblib.c:read_packet(755) > Received a packet of len 74 from (172.16.3.1) port 137 >[2008/01/16 16:40:38, 4] libsmb/nmblib.c:debug_nmb_packet(112) > nmb packet from 172.16.3.1(137) header: id=18779 opcode=Query(0) response=Yes > header: flags: bcast=No rec_avail=Yes rec_des=Yes trunc=No auth=Yes > header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 > answers: nmb_name=LINR51VD1<1c> rr_type=32 rr_class=1 ttl=0 > answers 0 char ....z........... hex 8000C0A87A018000AC1009158000C0A8 > answers 10 char z. hex 7A01 >[2008/01/16 16:40:38, 2] libsmb/namequery.c:name_query(604) > Got a positive name query response from 172.16.3.1 ( 192.168.122.1 172.16.9.21 192.168.122.1 ) >[2008/01/16 16:40:38, 10] libsmb/namequery.c:remove_duplicate_addrs2(435) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2008/01/16 16:40:38, 5] libsmb/namecache.c:namecache_store(135) > namecache_store: storing 2 addresses for LINR51VD1#1c: 192.168.122.1:0,172.16.9.21:0 >[2008/01/16 16:40:38, 10] lib/gencache.c:gencache_set(140) > Adding cache entry with key = NBT/LINR51VD1#1C; value = 192.168.122.1:0,172.16.9.21:0 and timeout = Wed Jan 16 16:51:38 2008 > (660 seconds ahead) >[2008/01/16 16:40:38, 10] libsmb/namequery.c:internal_resolve_name(1293) > internal_resolve_name: returning 2 addresses: 192.168.122.1:0 172.16.9.21:0 >[2008/01/16 16:40:38, 8] libsmb/namequery.c:get_dc_list(1505) > Adding 2 DC's from auto lookup >[2008/01/16 16:40:38, 10] libsmb/namequery.c:remove_duplicate_addrs2(435) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2008/01/16 16:40:38, 4] libsmb/namequery.c:get_dc_list(1599) > get_dc_list: returning 2 ip addresses in an unordered list >[2008/01/16 16:40:38, 4] libsmb/namequery.c:get_dc_list(1600) > get_dc_list: 192.168.122.1:0 172.16.9.21:0 >[2008/01/16 16:40:38, 8] lib/util.c:fcntl_lock(2011) > fcntl_lock fd=18 op=6 offset=0 count=1 type=0 >[2008/01/16 16:40:38, 3] lib/util.c:fcntl_lock(2024) > fcntl_lock: lock failed at offset 0 count 1 op 6 type 0 (Resource temporarily unavailable) >[2008/01/16 16:40:38, 4] libsmb/clidgram.c:cli_send_mailslot(103) > send_mailslot: Sending to mailslot \MAILSLOT\NET\NTLOGON from LINR5164VS1<00> to LINR51VD1<1c> IP 192.168.122.1 >[2008/01/16 16:40:38, 5] nsswitch/winbindd_cm.c:receive_getdc_response(954) > Did not receive packet for \MAILSLOT\NET\GETDC17AA8C0 >[2008/01/16 16:40:39, 5] nsswitch/winbindd_cm.c:receive_getdc_response(954) > Did not receive packet for \MAILSLOT\NET\GETDC17AA8C0 >[2008/01/16 16:40:39, 5] nsswitch/winbindd_cm.c:receive_getdc_response(954) > Did not receive packet for \MAILSLOT\NET\GETDC17AA8C0 >[2008/01/16 16:40:40, 5] nsswitch/winbindd_cm.c:receive_getdc_response(954) > Did not receive packet for \MAILSLOT\NET\GETDC17AA8C0 >[2008/01/16 16:40:40, 5] nsswitch/winbindd_cm.c:receive_getdc_response(954) > Did not receive packet for \MAILSLOT\NET\GETDC17AA8C0 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:name_status_find(303) > name_status_find: looking up LINR51VD1#1c at 192.168.122.1 >[2008/01/16 16:40:41, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = NBT/LINR51VD1#1C.20.192.168.122.1 couldn't be found >[2008/01/16 16:40:41, 5] libsmb/namecache.c:namecache_status_fetch(346) > namecache_status_fetch: no entry for NBT/LINR51VD1#1C.20.192.168.122.1 found. >[2008/01/16 16:40:41, 10] lib/util_sock.c:open_socket_in(839) > bind succeeded on port 0 >[2008/01/16 16:40:41, 5] libsmb/nmblib.c:send_udp(777) > Sending a packet of len 50 to (192.168.122.1) on port 137 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_udp_socket(294) > read_udp_socket: lastip 192.168.122.1 lastport 137 read: 265 >[2008/01/16 16:40:41, 10] libsmb/nmblib.c:parse_nmb(506) > parse_nmb: packet id = 8640 >[2008/01/16 16:40:41, 5] libsmb/nmblib.c:read_packet(755) > Received a packet of len 265 from (192.168.122.1) port 137 >[2008/01/16 16:40:41, 4] libsmb/nmblib.c:debug_nmb_packet(112) > nmb packet from 192.168.122.1(137) header: id=8640 opcode=Query(0) response=Yes > header: flags: bcast=No rec_avail=No rec_des=No trunc=No auth=Yes > header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 > answers: nmb_name=LINR51VD1<1c> rr_type=33 rr_class=1 ttl=0 > answers 0 char .LINR5164VS1 hex 094C494E523531363456533120202020 > answers 10 char .d.LINR5164VS1 hex 0064004C494E52353136345653312020 > answers 20 char .d.LINR5164VS1 hex 20200364004C494E5235313634565331 > answers 30 char d...__MSBRO hex 2020202020640001025F5F4D5342524F > answers 40 char WSE__....LINR51V hex 5753455F5F0201E4004C494E52353156 > answers 50 char D1 .d.LINR5 hex 44312020202020201D64004C494E5235 > answers 60 char 1VD1 .d.LIN hex 315644312020202020201B64004C494E > answers 70 char R51VD1 ...L hex 5235315644312020202020201CE4004C > answers 80 char INR51VD1 .. hex 494E5235315644312020202020201EE4 > answers 90 char .LINR51VD1 hex 004C494E523531564431202020202020 > answers a0 char ................ hex 00E40000000000000000000000000000 > answers b0 char ................ hex 00000000000000000000000000000000 > answers c0 char ................ hex 00000000000000000000000000000000 > answers d0 char . hex 00 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR5164VS1#00: flags = 0x64 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR5164VS1#03: flags = 0x64 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR5164VS1#20: flags = 0x64 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > __MSBROWSE__#01: flags = 0xe4 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR51VD1#1d: flags = 0x64 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR51VD1#1b: flags = 0x64 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR51VD1#1c: flags = 0xe4 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR51VD1#1e: flags = 0xe4 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:parse_node_status(185) > LINR51VD1#00: flags = 0xe4 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:name_status_find(342) > name_status_find: name found, name LINR5164VS1 ip address is 192.168.122.1 >[2008/01/16 16:40:41, 5] libsmb/namecache.c:namecache_store(135) > namecache_store: storing 1 address for LINR5164VS1#20: 192.168.122.1:0 >[2008/01/16 16:40:41, 10] lib/gencache.c:gencache_set(140) > Adding cache entry with key = NBT/LINR5164VS1#20; value = 192.168.122.1:0 and timeout = Wed Jan 16 16:51:41 2008 > (660 seconds ahead) >[2008/01/16 16:40:41, 10] nsswitch/winbindd_cm.c:cm_prepare_connection(612) > cm_prepare_connection: connecting to DC LINR5164VS1 for domain LINR51VD1 >[2008/01/16 16:40:41, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(507) > cm_get_ipc_userpass: No auth-user defined >[2008/01/16 16:40:41, 10] passdb/secrets.c:secrets_named_mutex(930) > secrets_named_mutex: got mutex for LINR5164VS1 >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,194) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,194) wrote 194 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 127 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]= 4864 (0x1300) > smb_vwv[ 8]= 103 (0x67) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]=32896 (0x8080) > smb_vwv[12]=47250 (0xB892) > smb_vwv[13]=34928 (0x8870) > smb_vwv[14]=51288 (0xC858) > smb_vwv[15]=11265 (0x2C01) > smb_vwv[16]= 1 (0x1) > smb_bcc=58 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 6C 69 6E 72 35 31 36 34 76 73 31 00 00 00 00 00 linr5164 vs1..... > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]= 4864 (0x1300) > smb_vwv[ 8]= 103 (0x67) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]=32896 (0x8080) > smb_vwv[12]=47250 (0xB892) > smb_vwv[13]=34928 (0x8870) > smb_vwv[14]=51288 (0xC858) > smb_vwv[15]=11265 (0x2C01) > smb_vwv[16]= 1 (0x1) > smb_bcc=58 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 6C 69 6E 72 35 31 36 34 76 73 31 00 00 00 00 00 linr5164 vs1..... > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2008/01/16 16:40:41, 5] nsswitch/winbindd_cm.c:cm_prepare_connection(723) > connecting to LINR5164VS1 from LINR5164VS1 with username [LINR51VD1]\[LINR5164VS1$] >[2008/01/16 16:40:41, 3] libsmb/cliconnect.c:cli_session_setup_spnego(789) > Doing spnego session setup (blob length=58) >[2008/01/16 16:40:41, 3] libsmb/cliconnect.c:cli_session_setup_spnego(814) > got OID=1 3 6 1 4 1 311 2 2 10 >[2008/01/16 16:40:41, 3] libsmb/cliconnect.c:cli_session_setup_spnego(822) > got principal=NONE >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,172) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,172) wrote 172 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 274 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=274 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=100 > smb_mid=2 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 156 (0x9C) > smb_bcc=231 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] A1 81 99 30 81 96 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 80 04 7E 4E 54 .....7.. .....~NT > [020] 4C 4D 53 53 50 00 02 00 00 00 12 00 12 00 30 00 LMSSP... ......0. > [030] 00 00 15 82 89 60 DF D5 15 78 34 67 16 CF 00 00 .....`.. .x4g.... > [040] 00 00 00 00 00 00 3C 00 3C 00 42 00 00 00 4C 00 ......<. <.B...L. > [050] 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 00 I.N.R.5. 1.V.D.1. > [060] 02 00 12 00 4C 00 49 00 4E 00 52 00 35 00 31 00 ....L.I. N.R.5.1. > [070] 56 00 44 00 31 00 01 00 16 00 4C 00 49 00 4E 00 V.D.1... ..L.I.N. > [080] 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 00 R.5.1.6. 4.V.S.1. > [090] 04 00 00 00 03 00 00 00 00 00 00 00 00 55 00 6E ........ .....U.n > [0A0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0B0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 35 00 62 . .3...0 ...2.5.b > [0C0] 00 2D 00 30 00 2E 00 65 00 6C 00 35 00 2E 00 34 .-.0...e .l.5...4 > [0D0] 00 00 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 ...L.I.N .R.5.1.V > [0E0] 00 44 00 31 00 00 00 .D.1... >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=274 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=100 > smb_mid=2 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 156 (0x9C) > smb_bcc=231 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] A1 81 99 30 81 96 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 80 04 7E 4E 54 .....7.. .....~NT > [020] 4C 4D 53 53 50 00 02 00 00 00 12 00 12 00 30 00 LMSSP... ......0. > [030] 00 00 15 82 89 60 DF D5 15 78 34 67 16 CF 00 00 .....`.. .x4g.... > [040] 00 00 00 00 00 00 3C 00 3C 00 42 00 00 00 4C 00 ......<. <.B...L. > [050] 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 00 I.N.R.5. 1.V.D.1. > [060] 02 00 12 00 4C 00 49 00 4E 00 52 00 35 00 31 00 ....L.I. N.R.5.1. > [070] 56 00 44 00 31 00 01 00 16 00 4C 00 49 00 4E 00 V.D.1... ..L.I.N. > [080] 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 00 R.5.1.6. 4.V.S.1. > [090] 04 00 00 00 03 00 00 00 00 00 00 00 00 55 00 6E ........ .....U.n > [0A0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0B0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 35 00 62 . .3...0 ...2.5.b > [0C0] 00 2D 00 30 00 2E 00 65 00 6C 00 35 00 2E 00 34 .-.0...e .l.5...4 > [0D0] 00 00 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 ...L.I.N .R.5.1.V > [0E0] 00 44 00 31 00 00 00 .D.1... >[2008/01/16 16:40:41, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1018) > Got challenge flags: >[2008/01/16 16:40:41, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60898215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_CHAL_TARGET_INFO > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:40:41, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1040) > NTLMSSP: Set final flags: >[2008/01/16 16:40:41, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:40:41, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1112) > NTLMSSP challenge set by NTLM2 >[2008/01/16 16:40:41, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1113) > challenge is: >[2008/01/16 16:40:41, 5] lib/util.c:dump_data(2283) > [000] 26 FC 2D 10 91 51 68 FC &.-..Qh. >[2008/01/16 16:40:41, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338) > NTLMSSP Sign/Seal - Initialising with flags: >[2008/01/16 16:40:41, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,290) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,290) wrote 290 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 126 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=126 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=101 > smb_mid=3 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=83 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 35 00 62 00 2D 00 30 ...0...2 .5.b.-.0 > [030] 00 2E 00 65 00 6C 00 35 00 2E 00 34 00 00 00 4C ...e.l.5 ...4...L > [040] 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 .I.N.R.5 .1.V.D.1 > [050] 00 00 00 ... >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=126 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=101 > smb_mid=3 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=83 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 35 00 62 00 2D 00 30 ...0...2 .5.b.-.0 > [030] 00 2E 00 65 00 6C 00 35 00 2E 00 34 00 00 00 4C ...e.l.5 ...4...L > [040] 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 .I.N.R.5 .1.V.D.1 > [050] 00 00 00 ... >[2008/01/16 16:40:41, 10] libsmb/clientgen.c:cli_init_creds(254) > cli_init_creds: user LINR5164VS1$ domain LINR51VD1 >[2008/01/16 16:40:41, 10] libsmb/namequery.c:saf_store(74) > saf_store: domain = [LINR51VD1], server = [LINR5164VS1], expire = [1200520541] >[2008/01/16 16:40:41, 10] lib/gencache.c:gencache_set(140) > Adding cache entry with key = SAF/DOMAIN/LINR51VD1; value = LINR5164VS1 and timeout = Wed Jan 16 16:55:41 2008 > (900 seconds ahead) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,90) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,90) wrote 90 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 56 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=56 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=4 > smt_wct=7 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_vwv[ 3]= 511 (0x1FF) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 511 (0x1FF) > smb_vwv[ 6]= 0 (0x0) > smb_bcc=7 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 49 50 43 00 00 00 00 IPC.... >[2008/01/16 16:40:41, 10] passdb/secrets.c:secrets_named_mutex_release(942) > secrets_named_mutex: released mutex for LINR5164VS1 >[2008/01/16 16:40:41, 10] nsswitch/winbindd_cache.c:set_global_winbindd_state_online(2686) > set_global_winbindd_state_online: online requested. >[2008/01/16 16:40:41, 10] nsswitch/winbindd_cache.c:set_global_winbindd_state_online(2689) > set_global_winbindd_state_online: rejecting. >[2008/01/16 16:40:41, 10] nsswitch/winbindd_cm.c:set_domain_online(359) > set_domain_online: called for domain LINR51VD1 >[2008/01/16 16:40:41, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1527) > set_dc_type_and_flags: domain LINR51VD1 >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,104) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,104) wrote 104 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=5 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=51712 (0xCA00) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[76ca]: \lsarpc auth_type 0, auth_level 0 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 j(.9.... ....O... > [010] 00 00 00 00 .... >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0b >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0048 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0018 num_contexts: 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 001c context_id : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 001e num_transfer_syntaxes: 01 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0020 data : 3919286a >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0024 data : b10c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0026 data : 11d0 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0028 data : 9b a8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 002a data : 00 c0 4f d9 2e f5 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 version: 00000000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 data : 8a885d04 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0038 data : 1ceb >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 003a data : 11c9 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003c data : 9f e8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003e data : 08 00 2b 10 48 60 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0044 version: 00000002 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76ca >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=154 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30410 (0x76CA) > smb_bcc=87 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 .......H ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 6A ........ .......j > [030] 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 00 (.9..... ...O.... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 .H`.... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,158) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,158) wrote 158 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 124 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000001 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 68 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76ca returned 68 bytes. >[2008/01/16 16:40:41, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76ca bind request returned ok. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 000053f0 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0018 len: 000c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 001a str: \PIPE\lsass. >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0028 num_results: 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002c result : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002e reason : 0000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 data : 8a885d04 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0034 data : 1ceb >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0036 data : 11c9 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0038 data : 9f e8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003a data : 08 00 2b 10 48 60 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0040 version: 00000002 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2277) > cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine LINR5164VS1 and bound anonymously. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 ds_io_q_getprimdominfo >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0000 level: 0001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 001a >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 0000 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76ca >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=108 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 26 (0x1A) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 26 (0x1A) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30410 (0x76CA) > smb_bcc=41 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 1A 00 00 00 02 00 00 00 02 ........ ........ > [020] 00 00 00 00 00 00 00 01 00 ........ . >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,112) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,112) wrote 112 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 160 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=160 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 104 (0x68) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 104 (0x68) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=105 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 68 00 00 00 02 00 00 ........ .h...... > [010] 00 50 00 00 00 00 00 00 00 01 00 00 00 01 00 00 .P...... ........ > [020] 00 05 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ........ ........ > [030] 00 00 00 00 00 0E BF E4 84 5F 86 52 44 BF 79 BA ........ ._.RD.y. > [040] 9C 3F 59 46 E7 0A 00 00 00 00 00 00 00 0A 00 00 .?YF.... ........ > [050] 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 .L.I.N.R .5.1.V.D > [060] 00 31 00 00 00 00 00 00 00 .1...... . >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=160 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 104 (0x68) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 104 (0x68) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=105 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 68 00 00 00 02 00 00 ........ .h...... > [010] 00 50 00 00 00 00 00 00 00 01 00 00 00 01 00 00 .P...... ........ > [020] 00 05 00 00 00 00 00 00 01 01 00 00 00 00 00 00 ........ ........ > [030] 00 00 00 00 00 0E BF E4 84 5F 86 52 44 BF 79 BA ........ ._.RD.y. > [040] 9C 3F 59 46 E7 0A 00 00 00 00 00 00 00 0A 00 00 .?YF.... ........ > [050] 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 .L.I.N.R .5.1.V.D > [060] 00 31 00 00 00 00 00 00 00 .1...... . >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0068 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000050 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 104, data_len 80, ss_len 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 104 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76ca returned 160 bytes. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 ds_io_r_getprimdominfo >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 ptr: 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0004 level: 0001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0006 unknown0: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 machine_role: 0005 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c flags: 01000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 netbios_ptr: 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 dnsname_ptr: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0018 forestname_ptr: 00000000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001c smb_io_uuid domain_guid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 001c data : 84e4bf0e >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0020 data : 865f >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0022 data : 4452 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0024 data : bf 79 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0026 data : ba 9c 3f 59 46 e7 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00002c smb_io_unistr2 netbios_domain >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 002c uni_max_len: 0000000a >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 offset : 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 uni_str_len: 0000000a >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0038 buffer : L.I.N.R.5.1.V.D.1... >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00004c smb_io_unistr2 - NULL dns_domain >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00004c smb_io_unistr2 - NULL forest_domain >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 004c status: NT_STATUS_OK >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,45) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,45) wrote 45 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=8 > smt_wct=0 > smb_bcc=0 >[2008/01/16 16:40:41, 10] libsmb/clientgen.c:cli_rpc_pipe_close(395) > cli_rpc_pipe_close: closed pipe \lsarpc to machine LINR5164VS1 >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,104) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,104) wrote 104 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=9 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=51968 (0xCB00) > smb_vwv[ 3]= 374 (0x176) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[76cb]: \lsarpc auth_type 0, auth_level 0 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB xW4.4... ...#Eg.. > [010] 00 00 00 00 .... >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0b >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0048 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000003 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0018 num_contexts: 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 001c context_id : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 001e num_transfer_syntaxes: 01 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0020 data : 12345778 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0024 data : 1234 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0026 data : abcd >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0028 data : ef 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 002a data : 01 23 45 67 89 ab >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 version: 00000000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 data : 8a885d04 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0038 data : 1ceb >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 003a data : 11c9 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003c data : 9f e8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003e data : 08 00 2b 10 48 60 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0044 version: 00000002 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=154 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30411 (0x76CB) > smb_bcc=87 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 48 00 00 00 03 00 00 00 B8 .......H ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x > [030] 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 W4.4.... ..#Eg... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 .H`.... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,158) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,158) wrote 158 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 124 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 03 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000003 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 68 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb returned 68 bytes. >[2008/01/16 16:40:41, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb bind request returned ok. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000003 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 000053f0 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0018 len: 000c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 001a str: \PIPE\lsass. >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0028 num_results: 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002c result : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002e reason : 0000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 data : 8a885d04 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0034 data : 1ceb >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0036 data : 11c9 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0038 data : 9f e8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003a data : 08 00 2b 10 48 60 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0040 version: 00000002 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2277) > cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine LINR5164VS1 and bound anonymously. >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_lsa_sec_qos(185) > init_lsa_sec_qos >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_q_open_pol2(368) > init_q_open_pol2: attr:0 da:33554432 >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_lsa_obj_attr(236) > init_lsa_obj_attr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_q_open_pol2 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 ptr : 00000001 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 uni_max_len: 0000000e >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0008 offset : 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c uni_str_len: 0000000e >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0010 buffer : \.\.L.I.N.R.5.1.6.4.V.S.1... >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00002c lsa_io_obj_attr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 002c len : 00000018 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 ptr_root_dir: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 ptr_obj_name: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0038 attributes : 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 003c ptr_sec_desc: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0040 ptr_sec_qos : 00000001 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000044 lsa_io_obj_qos sec_qos >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0044 len : 0000000c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0048 sec_imp_level : 0002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 004a sec_ctxt_mode : 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 004b effective_only: 00 >[2008/01/16 16:40:41, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(224) > lsa_io_sec_qos: length c does not match size 8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 004c des_access: 02000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0068 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000004 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000050 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 002c >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=186 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=11 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 104 (0x68) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 104 (0x68) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30411 (0x76CB) > smb_bcc=119 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 68 00 00 00 04 00 00 00 50 .......h .......P > [020] 00 00 00 00 00 2C 00 01 00 00 00 0E 00 00 00 00 .....,.. ........ > [030] 00 00 00 0E 00 00 00 5C 00 5C 00 4C 00 49 00 4E .......\ .\.L.I.N > [040] 00 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 .R.5.1.6 .4.V.S.1 > [050] 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [060] 00 00 00 00 00 00 00 01 00 00 00 0C 00 00 00 02 ........ ........ > [070] 00 01 00 00 00 00 02 ....... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,190) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,190) wrote 190 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 104 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=11 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ > [020] 00 00 00 00 00 8E 47 D9 79 13 67 00 00 00 00 00 ......G. y.g..... > [030] 00 . >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=11 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 04 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 01 00 00 ........ ........ > [020] 00 00 00 00 00 8E 47 D9 79 13 67 00 00 00 00 00 ......G. y.g..... > [030] 00 . >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0030 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000004 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000018 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 48 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb returned 48 bytes. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_r_open_pol2 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 handle_type: 00000000 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 data : 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000c data : 8e 47 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000e data : d9 79 13 67 00 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 0014 status: NT_STATUS_OK >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_q_query2(3141) > init_q_query2 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_q_query_info2 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd pol >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 handle_type: 00000000 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 data : 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000c data : 8e 47 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000e data : d9 79 13 67 00 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 info_class: 000c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 002e >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000005 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000016 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 002e >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=12 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 46 (0x2E) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 46 (0x2E) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30411 (0x76CB) > smb_bcc=61 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 2E 00 00 00 05 00 00 00 16 ........ ........ > [020] 00 00 00 00 00 2E 00 00 00 00 00 01 00 00 00 00 ........ ........ > [030] 00 00 00 8E 47 D9 79 13 67 00 00 0C 00 ....G.y. g.... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,132) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,132) wrote 132 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 88 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=88 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=12 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 32 (0x20) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 32 (0x20) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=33 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 03 23 10 00 00 00 20 00 00 00 05 00 00 ....#... . ...... > [010] 00 00 00 00 00 00 00 00 00 02 00 01 1C 00 00 00 ........ ........ > [020] 00 . >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=88 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=12 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 32 (0x20) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 32 (0x20) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=33 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 03 23 10 00 00 00 20 00 00 00 05 00 00 ....#... . ...... > [010] 00 00 00 00 00 00 00 00 00 02 00 01 1C 00 00 00 ........ ........ > [020] 00 . >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 23 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0020 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000005 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_hdr_fault fault >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_dcerpc_status(799) > 0018 status : DCERPC_FAULT_OP_RNG_ERROR >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 001c reserved: 00000000 >[2008/01/16 16:40:41, 1] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625) > cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb! >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 32 at offset 0 >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_lsa_sec_qos(185) > init_lsa_sec_qos >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_q_open_pol(304) > init_open_pol: attr:0 da:33554432 >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_lsa_obj_attr(236) > init_lsa_obj_attr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_q_open_pol >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 ptr : 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0004 system_name: 005c >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 lsa_io_obj_attr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0008 len : 00000018 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c ptr_root_dir: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 ptr_obj_name: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 attributes : 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0018 ptr_sec_desc: 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 001c ptr_sec_qos : 00000001 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 lsa_io_obj_qos sec_qos >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0020 len : 0000000c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0024 sec_imp_level : 0002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0026 sec_ctxt_mode : 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0027 effective_only: 00 >[2008/01/16 16:40:41, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(224) > lsa_io_sec_qos: length c does not match size 8 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0028 des_access: 02000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000006 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 0000002c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 0006 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=150 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=13 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 68 (0x44) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30411 (0x76CB) > smb_bcc=83 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 44 00 00 00 06 00 00 00 2C .......D ......., > [020] 00 00 00 00 00 06 00 01 00 00 00 5C 00 00 00 18 ........ ...\.... > [030] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ........ ........ > [040] 00 00 00 01 00 00 00 0C 00 00 00 02 00 01 00 00 ........ ........ > [050] 00 00 02 ... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,154) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,154) wrote 154 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 104 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=13 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [020] 00 00 00 00 00 8E 47 D9 79 13 67 00 00 00 00 00 ......G. y.g..... > [030] 00 . >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=104 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=13 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 48 (0x30) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 48 (0x30) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=49 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 30 00 00 00 06 00 00 ........ .0...... > [010] 00 18 00 00 00 00 00 00 00 00 00 00 00 02 00 00 ........ ........ > [020] 00 00 00 00 00 8E 47 D9 79 13 67 00 00 00 00 00 ......G. y.g..... > [030] 00 . >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0030 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000006 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000018 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 48 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb returned 48 bytes. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_r_open_pol >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 handle_type: 00000000 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 data : 00000002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000c data : 8e 47 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000e data : d9 79 13 67 00 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 0014 status: NT_STATUS_OK >[2008/01/16 16:40:41, 5] rpc_parse/parse_lsa.c:init_q_query(488) > init_q_query >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_q_query >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_pol_hnd >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 handle_type: 00000000 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_uuid uuid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 data : 00000002 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a data : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000c data : 8e 47 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 000e data : d9 79 13 67 00 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 info_class: 0005 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 002e >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000007 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000016 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 0007 >[2008/01/16 16:40:41, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=128 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=14 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 46 (0x2E) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 46 (0x2E) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=30411 (0x76CB) > smb_bcc=61 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 2E 00 00 00 07 00 00 00 16 ........ ........ > [020] 00 00 00 00 00 07 00 00 00 00 00 02 00 00 00 00 ........ ........ > [030] 00 00 00 8E 47 D9 79 13 67 00 00 05 00 ....G.y. g.... >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,132) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,132) wrote 132 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 164 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=14 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 07 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 00 00 00 22 05 00 00 .T...... ...."... > [020] 00 12 00 14 00 01 00 00 00 01 00 00 00 0A 00 00 ........ ........ > [030] 00 00 00 00 00 09 00 00 00 4C 00 49 00 4E 00 52 ........ .L.I.N.R > [040] 00 35 00 31 00 56 00 44 00 31 00 00 00 04 00 00 .5.1.V.D .1...... > [050] 00 01 04 00 00 00 00 00 05 15 00 00 00 D7 9E 9E ........ ........ > [060] 55 01 91 5F 89 CE 9C 0C 7A 00 00 00 00 U.._.... z.... >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=164 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=14 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 108 (0x6C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 108 (0x6C) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=109 >[2008/01/16 16:40:41, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 6C 00 00 00 07 00 00 ........ .l...... > [010] 00 54 00 00 00 00 00 00 00 00 00 00 22 05 00 00 .T...... ...."... > [020] 00 12 00 14 00 01 00 00 00 01 00 00 00 0A 00 00 ........ ........ > [030] 00 00 00 00 00 09 00 00 00 4C 00 49 00 4E 00 52 ........ .L.I.N.R > [040] 00 35 00 31 00 56 00 44 00 31 00 00 00 04 00 00 .5.1.V.D .1...... > [050] 00 01 04 00 00 00 00 00 05 15 00 00 00 D7 9E 9E ........ ........ > [060] 55 01 91 5F 89 CE 9C 0C 7A 00 00 00 00 U.._.... z.... >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 006c >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000007 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000054 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 108, data_len 84, ss_len 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 108 at offset 0 >[2008/01/16 16:40:41, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x76cb returned 168 bytes. >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 lsa_io_r_query >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 dom_ptr: 22000000 >[2008/01/16 16:40:41, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 lsa_io_query_info_ctr >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0004 info_class: 0005 >[2008/01/16 16:40:41, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000008 lsa_io_dom_query_3 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 uni_dom_max_len: 0012 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a uni_dom_str_len: 0014 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c buffer_dom_name: 00000001 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 buffer_dom_sid : 00000001 >[2008/01/16 16:40:41, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000014 smb_io_unistr2 unistr2 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 uni_max_len: 0000000a >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0018 offset : 00000000 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 001c uni_str_len: 00000009 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0020 buffer : L.I.N.R.5.1.V.D.1. >[2008/01/16 16:40:41, 8] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_dom_sid2 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 num_auths: 00000004 >[2008/01/16 16:40:41, 9] rpc_parse/parse_prs.c:prs_debug(84) > 000038 smb_io_dom_sid sid >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0038 sid_rev_num: 01 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0039 num_auths : 04 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003a id_auth[0] : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003b id_auth[1] : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003c id_auth[2] : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003d id_auth[3] : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003e id_auth[4] : 00 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 003f id_auth[5] : 05 >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_uint32s(997) > 0040 sub_auths : 00000015 559e9ed7 895f9101 7a0c9cce >[2008/01/16 16:40:41, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 0050 status: NT_STATUS_OK >[2008/01/16 16:40:41, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1633) > set_dc_type_and_flags: domain LINR51VD1 is NOT in native mode. >[2008/01/16 16:40:41, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1636) > set_dc_type_and_flags: domain LINR51VD1 is NOT running active directory. >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,45) >[2008/01/16 16:40:41, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,45) wrote 45 >[2008/01/16 16:40:41, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(506) >[2008/01/16 16:40:41, 5] lib/util.c:show_msg(516) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=15 > smt_wct=0 > smb_bcc=0 >[2008/01/16 16:40:41, 10] libsmb/clientgen.c:cli_rpc_pipe_close(395) > cli_rpc_pipe_close: closed pipe \lsarpc to machine LINR5164VS1 >[2008/01/16 16:40:41, 10] nsswitch/winbindd_cache.c:cache_store_response(2259) > Storing response for pid 26386, len 3240 >[2008/01/16 16:52:00, 4] nsswitch/winbindd_dual.c:fork_domain_child(1054) > child daemon request 19 >[2008/01/16 16:52:00, 10] nsswitch/winbindd_dual.c:child_process_request(479) > process_request: request fn LIST_TRUSTDOM >[2008/01/16 16:52:00, 3] nsswitch/winbindd_misc.c:winbindd_dual_list_trusted_domains(121) > [26384]: list trusted domains >[2008/01/16 16:52:00, 5] passdb/secrets.c:secrets_trusted_domains(907) > secrets_get_trusted_domains: got 1 domains >[2008/01/16 16:52:00, 10] nsswitch/winbindd_cache.c:cache_store_response(2259) > Storing response for pid 26386, len 3300 >[2008/01/16 16:52:00, 10] nsswitch/winbindd_cache.c:cache_store_response(2273) > Storing extra data: len=60 >[2008/01/16 16:52:00, 4] nsswitch/winbindd_dual.c:fork_domain_child(1054) > child daemon request 19 >[2008/01/16 16:52:00, 10] nsswitch/winbindd_dual.c:child_process_request(479) > process_request: request fn LIST_TRUSTDOM >[2008/01/16 16:52:00, 3] nsswitch/winbindd_misc.c:winbindd_dual_list_trusted_domains(121) > [26384]: list trusted domains >[2008/01/16 16:52:00, 5] passdb/secrets.c:secrets_trusted_domains(907) > secrets_get_trusted_domains: got 1 domains >[2008/01/16 16:52:00, 10] nsswitch/winbindd_cache.c:cache_store_response(2259) > Storing response for pid 26386, len 3300 >[2008/01/16 16:52:00, 10] nsswitch/winbindd_cache.c:cache_store_response(2273) > Storing extra data: len=60 >[2008/01/16 16:52:06, 4] nsswitch/winbindd_dual.c:fork_domain_child(1054) > child daemon request 33 >[2008/01/16 16:52:06, 10] nsswitch/winbindd_dual.c:child_process_request(479) > process_request: request fn CHECK_MACHACC >[2008/01/16 16:52:06, 3] nsswitch/winbindd_misc.c:winbindd_dual_check_machine_acct(47) > [26384]: check machine account >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,39) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,39) wrote 39 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=35 > smb_com=0x71 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=16 > smt_wct=0 > smb_bcc=0 >[2008/01/16 16:52:06, 8] nsswitch/winbindd_cm.c:connection_ok(1434) > connection_ok: Connection to LINR5164VS1 for domain LINR51VD1 has NULL cli! >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = SAF/DOMAIN/LINR51VD1 couldn't be found >[2008/01/16 16:52:06, 5] libsmb/namequery.c:saf_fetch(133) > saf_fetch: failed to find server for "LINR51VD1" domain >[2008/01/16 16:52:06, 10] nsswitch/winbindd_cm.c:cm_open_connection(1304) > cm_open_connection: dcname is 'LINR5164VS1' for domain LINR51VD1 >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = AD_SITENAME/DOMAIN/ couldn't be found >[2008/01/16 16:52:06, 5] libads/dns.c:sitename_fetch(676) > sitename_fetch: No stored sitename for >[2008/01/16 16:52:06, 10] libsmb/namequery.c:internal_resolve_name(1166) > internal_resolve_name: looking up LINR5164VS1#20 (sitename (null)) >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_get(226) > Returning expired cache entry: key = NBT/LINR5164VS1#20, value = 192.168.122.1:0, timeout = Wed Jan 16 16:52:06 2008 >[2008/01/16 16:52:06, 5] libsmb/namecache.c:namecache_fetch(210) > no entry for LINR5164VS1#20 found. >[2008/01/16 16:52:06, 3] libsmb/namequery.c:resolve_lmhosts(966) > resolve_lmhosts: Attempting lmhosts lookup for name LINR5164VS1<0x20> >[2008/01/16 16:52:06, 4] libsmb/namequery.c:getlmhostsent(717) > getlmhostsent: lmhost entry: 127.0.0.1 localhost >[2008/01/16 16:52:06, 3] libsmb/namequery.c:resolve_hosts(1029) > resolve_hosts: Attempting host lookup for name LINR5164VS1<0x20> >[2008/01/16 16:52:06, 3] libsmb/namequery.c:resolve_wins(863) > resolve_wins: Attempting wins lookup for name LINR5164VS1<0x20> >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = WINS_SRV_DEAD/172.16.3.1,0.0.0.0 couldn't be found >[2008/01/16 16:52:06, 4] lib/wins_srv.c:wins_srv_is_dead(111) > wins_srv_is_dead: 172.16.3.1 is alive >[2008/01/16 16:52:06, 6] lib/wins_srv.c:wins_srv_ip_tag(311) > Current wins server for tag '*' with source 0.0.0.0 is 172.16.3.1 >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_get(212) > Cache entry with key = WINS_SRV_DEAD/172.16.3.1,0.0.0.0 couldn't be found >[2008/01/16 16:52:06, 4] lib/wins_srv.c:wins_srv_is_dead(111) > wins_srv_is_dead: 172.16.3.1 is alive >[2008/01/16 16:52:06, 3] libsmb/namequery.c:resolve_wins(902) > resolve_wins: using WINS server 172.16.3.1 and tag '*' >[2008/01/16 16:52:06, 10] lib/util_sock.c:open_socket_in(839) > bind succeeded on port 0 >[2008/01/16 16:52:06, 5] libsmb/nmblib.c:send_udp(777) > Sending a packet of len 50 to (172.16.3.1) on port 137 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_udp_socket(294) > read_udp_socket: lastip 172.16.3.1 lastport 137 read: 68 >[2008/01/16 16:52:06, 10] libsmb/nmblib.c:parse_nmb(506) > parse_nmb: packet id = 11895 >[2008/01/16 16:52:06, 5] libsmb/nmblib.c:read_packet(755) > Received a packet of len 68 from (172.16.3.1) port 137 >[2008/01/16 16:52:06, 4] libsmb/nmblib.c:debug_nmb_packet(112) > nmb packet from 172.16.3.1(137) header: id=11895 opcode=Query(0) response=Yes > header: flags: bcast=No rec_avail=Yes rec_des=Yes trunc=No auth=Yes > header: rcode=0 qdcount=0 ancount=1 nscount=0 arcount=0 > answers: nmb_name=LINR5164VS1<20> rr_type=32 rr_class=1 ttl=0 > answers 0 char `...z.`..... hex 6000C0A87A016000AC100915 >[2008/01/16 16:52:06, 2] libsmb/namequery.c:name_query(604) > Got a positive name query response from 172.16.3.1 ( 192.168.122.1 172.16.9.21 ) >[2008/01/16 16:52:06, 10] libsmb/namequery.c:remove_duplicate_addrs2(435) > remove_duplicate_addrs2: looking for duplicate address/port pairs >[2008/01/16 16:52:06, 5] libsmb/namecache.c:namecache_store(135) > namecache_store: storing 2 addresses for LINR5164VS1#20: 192.168.122.1:0,172.16.9.21:0 >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_set(140) > Adding cache entry with key = NBT/LINR5164VS1#20; value = 192.168.122.1:0,172.16.9.21:0 and timeout = Wed Jan 16 17:03:06 2008 > (660 seconds ahead) >[2008/01/16 16:52:06, 10] libsmb/namequery.c:internal_resolve_name(1293) > internal_resolve_name: returning 2 addresses: 192.168.122.1:0 172.16.9.21:0 >[2008/01/16 16:52:06, 10] nsswitch/winbindd_cm.c:cm_prepare_connection(612) > cm_prepare_connection: connecting to DC LINR5164VS1 for domain LINR51VD1 >[2008/01/16 16:52:06, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(507) > cm_get_ipc_userpass: No auth-user defined >[2008/01/16 16:52:06, 10] passdb/secrets.c:secrets_named_mutex(930) > secrets_named_mutex: got mutex for LINR5164VS1 >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,194) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,194) wrote 194 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 127 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=20992 (0x5200) > smb_vwv[ 8]= 103 (0x67) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]= 128 (0x80) > smb_vwv[12]= 839 (0x347) > smb_vwv[13]=35337 (0x8A09) > smb_vwv[14]=51288 (0xC858) > smb_vwv[15]=11265 (0x2C01) > smb_vwv[16]= 1 (0x1) > smb_bcc=58 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 6C 69 6E 72 35 31 36 34 76 73 31 00 00 00 00 00 linr5164 vs1..... > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=127 > smb_com=0x72 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=0 > smb_mid=1 > smt_wct=17 > smb_vwv[ 0]= 8 (0x8) > smb_vwv[ 1]=12803 (0x3203) > smb_vwv[ 2]= 256 (0x100) > smb_vwv[ 3]= 1024 (0x400) > smb_vwv[ 4]= 65 (0x41) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 256 (0x100) > smb_vwv[ 7]=20992 (0x5200) > smb_vwv[ 8]= 103 (0x67) > smb_vwv[ 9]=64768 (0xFD00) > smb_vwv[10]=33011 (0x80F3) > smb_vwv[11]= 128 (0x80) > smb_vwv[12]= 839 (0x347) > smb_vwv[13]=35337 (0x8A09) > smb_vwv[14]=51288 (0xC858) > smb_vwv[15]=11265 (0x2C01) > smb_vwv[16]= 1 (0x1) > smb_bcc=58 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 6C 69 6E 72 35 31 36 34 76 73 31 00 00 00 00 00 linr5164 vs1..... > [010] 60 28 06 06 2B 06 01 05 05 02 A0 1E 30 1C A0 0E `(..+... ....0... > [020] 30 0C 06 0A 2B 06 01 04 01 82 37 02 02 0A A3 0A 0...+... ..7..... > [030] 30 08 A0 06 1B 04 4E 4F 4E 45 0.....NO NE >[2008/01/16 16:52:06, 5] nsswitch/winbindd_cm.c:cm_prepare_connection(723) > connecting to LINR5164VS1 from LINR5164VS1 with username [LINR51VD1]\[LINR5164VS1$] >[2008/01/16 16:52:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(789) > Doing spnego session setup (blob length=58) >[2008/01/16 16:52:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(814) > got OID=1 3 6 1 4 1 311 2 2 10 >[2008/01/16 16:52:06, 3] libsmb/cliconnect.c:cli_session_setup_spnego(822) > got principal=NONE >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,172) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,172) wrote 172 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 274 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=274 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=100 > smb_mid=2 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 156 (0x9C) > smb_bcc=231 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] A1 81 99 30 81 96 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 80 04 7E 4E 54 .....7.. .....~NT > [020] 4C 4D 53 53 50 00 02 00 00 00 12 00 12 00 30 00 LMSSP... ......0. > [030] 00 00 15 82 89 60 25 E5 A1 82 44 D2 0B 17 00 00 .....`%. ..D..... > [040] 00 00 00 00 00 00 3C 00 3C 00 42 00 00 00 4C 00 ......<. <.B...L. > [050] 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 00 I.N.R.5. 1.V.D.1. > [060] 02 00 12 00 4C 00 49 00 4E 00 52 00 35 00 31 00 ....L.I. N.R.5.1. > [070] 56 00 44 00 31 00 01 00 16 00 4C 00 49 00 4E 00 V.D.1... ..L.I.N. > [080] 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 00 R.5.1.6. 4.V.S.1. > [090] 04 00 00 00 03 00 00 00 00 00 00 00 00 55 00 6E ........ .....U.n > [0A0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0B0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 35 00 62 . .3...0 ...2.5.b > [0C0] 00 2D 00 30 00 2E 00 65 00 6C 00 35 00 2E 00 34 .-.0...e .l.5...4 > [0D0] 00 00 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 ...L.I.N .R.5.1.V > [0E0] 00 44 00 31 00 00 00 .D.1... >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=274 > smb_com=0x73 > smb_rcls=22 > smb_reh=0 > smb_err=49152 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=100 > smb_mid=2 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 156 (0x9C) > smb_bcc=231 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] A1 81 99 30 81 96 A0 03 0A 01 01 A1 0C 06 0A 2B ...0.... .......+ > [010] 06 01 04 01 82 37 02 02 0A A2 81 80 04 7E 4E 54 .....7.. .....~NT > [020] 4C 4D 53 53 50 00 02 00 00 00 12 00 12 00 30 00 LMSSP... ......0. > [030] 00 00 15 82 89 60 25 E5 A1 82 44 D2 0B 17 00 00 .....`%. ..D..... > [040] 00 00 00 00 00 00 3C 00 3C 00 42 00 00 00 4C 00 ......<. <.B...L. > [050] 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 00 I.N.R.5. 1.V.D.1. > [060] 02 00 12 00 4C 00 49 00 4E 00 52 00 35 00 31 00 ....L.I. N.R.5.1. > [070] 56 00 44 00 31 00 01 00 16 00 4C 00 49 00 4E 00 V.D.1... ..L.I.N. > [080] 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 00 R.5.1.6. 4.V.S.1. > [090] 04 00 00 00 03 00 00 00 00 00 00 00 00 55 00 6E ........ .....U.n > [0A0] 00 69 00 78 00 00 00 53 00 61 00 6D 00 62 00 61 .i.x...S .a.m.b.a > [0B0] 00 20 00 33 00 2E 00 30 00 2E 00 32 00 35 00 62 . .3...0 ...2.5.b > [0C0] 00 2D 00 30 00 2E 00 65 00 6C 00 35 00 2E 00 34 .-.0...e .l.5...4 > [0D0] 00 00 00 4C 00 49 00 4E 00 52 00 35 00 31 00 56 ...L.I.N .R.5.1.V > [0E0] 00 44 00 31 00 00 00 .D.1... >[2008/01/16 16:52:06, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1018) > Got challenge flags: >[2008/01/16 16:52:06, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60898215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_CHAL_TARGET_INFO > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:52:06, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1040) > NTLMSSP: Set final flags: >[2008/01/16 16:52:06, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:52:06, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1112) > NTLMSSP challenge set by NTLM2 >[2008/01/16 16:52:06, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1113) > challenge is: >[2008/01/16 16:52:06, 5] lib/util.c:dump_data(2283) > [000] 01 30 7D 9A B8 A8 B9 43 .0}....C >[2008/01/16 16:52:06, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338) > NTLMSSP Sign/Seal - Initialising with flags: >[2008/01/16 16:52:06, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63) > Got NTLMSSP neg_flags=0x60088215 > NTLMSSP_NEGOTIATE_UNICODE > NTLMSSP_REQUEST_TARGET > NTLMSSP_NEGOTIATE_SIGN > NTLMSSP_NEGOTIATE_NTLM > NTLMSSP_NEGOTIATE_ALWAYS_SIGN > NTLMSSP_NEGOTIATE_NTLM2 > NTLMSSP_NEGOTIATE_128 > NTLMSSP_NEGOTIATE_KEY_EXCH >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,290) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,290) wrote 290 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 126 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=126 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=101 > smb_mid=3 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=83 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 35 00 62 00 2D 00 30 ...0...2 .5.b.-.0 > [030] 00 2E 00 65 00 6C 00 35 00 2E 00 34 00 00 00 4C ...e.l.5 ...4...L > [040] 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 .I.N.R.5 .1.V.D.1 > [050] 00 00 00 ... >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=126 > smb_com=0x73 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=0 > smb_pid=26386 > smb_uid=101 > smb_mid=3 > smt_wct=4 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 9 (0x9) > smb_bcc=83 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] A1 07 30 05 A0 03 0A 01 00 55 00 6E 00 69 00 78 ..0..... .U.n.i.x > [010] 00 00 00 53 00 61 00 6D 00 62 00 61 00 20 00 33 ...S.a.m .b.a. .3 > [020] 00 2E 00 30 00 2E 00 32 00 35 00 62 00 2D 00 30 ...0...2 .5.b.-.0 > [030] 00 2E 00 65 00 6C 00 35 00 2E 00 34 00 00 00 4C ...e.l.5 ...4...L > [040] 00 49 00 4E 00 52 00 35 00 31 00 56 00 44 00 31 .I.N.R.5 .1.V.D.1 > [050] 00 00 00 ... >[2008/01/16 16:52:06, 10] libsmb/clientgen.c:cli_init_creds(254) > cli_init_creds: user LINR5164VS1$ domain LINR51VD1 >[2008/01/16 16:52:06, 10] libsmb/namequery.c:saf_store(74) > saf_store: domain = [LINR51VD1], server = [LINR5164VS1], expire = [1200521226] >[2008/01/16 16:52:06, 10] lib/gencache.c:gencache_set(140) > Adding cache entry with key = SAF/DOMAIN/LINR51VD1; value = LINR5164VS1 and timeout = Wed Jan 16 17:07:06 2008 > (900 seconds ahead) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,90) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,90) wrote 90 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 56 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=56 > smb_com=0x75 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=4 > smt_wct=7 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]= 1 (0x1) > smb_vwv[ 3]= 511 (0x1FF) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 511 (0x1FF) > smb_vwv[ 6]= 0 (0x0) > smb_bcc=7 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 49 50 43 00 00 00 00 IPC.... >[2008/01/16 16:52:06, 10] passdb/secrets.c:secrets_named_mutex_release(942) > secrets_named_mutex: released mutex for LINR5164VS1 >[2008/01/16 16:52:06, 10] nsswitch/winbindd_cm.c:set_domain_online(359) > set_domain_online: called for domain LINR51VD1 >[2008/01/16 16:52:06, 4] passdb/secrets.c:secrets_fetch_trust_account_password(286) > Using cleartext machine password >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,108) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,108) wrote 108 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=5 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=54272 (0xD400) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[73d4]: \NETLOGON auth_type 0, auth_level 0 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [010] 01 00 00 00 .... >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0b >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0048 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000008 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0018 num_contexts: 01 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 001c context_id : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 001e num_transfer_syntaxes: 01 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0020 data : 12345678 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0024 data : 1234 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0026 data : abcd >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0028 data : ef 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 002a data : 01 23 45 67 cf fb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 version: 00000001 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 data : 8a885d04 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0038 data : 1ceb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 003a data : 11c9 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003c data : 9f e8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003e data : 08 00 2b 10 48 60 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0044 version: 00000002 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=154 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 72 (0x48) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 72 (0x48) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29652 (0x73D4) > smb_bcc=87 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 48 00 00 00 08 00 00 00 B8 .......H ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x > [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 .H`.... >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,158) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,158) wrote 158 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 124 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 08 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=124 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=6 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 68 (0x44) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 68 (0x44) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=69 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 44 00 00 00 08 00 00 ........ .D...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 `.... >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000008 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 68 at offset 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 returned 68 bytes. >[2008/01/16 16:52:06, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 bind request returned ok. >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0044 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000008 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 000053f0 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0018 len: 000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 001a str: \PIPE\lsass. >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0028 num_results: 01 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002c result : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002e reason : 0000 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 data : 8a885d04 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0034 data : 1ceb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0036 data : 11c9 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0038 data : 9f e8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003a data : 08 00 2b 10 48 60 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0040 version: 00000002 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2277) > cli_rpc_pipe_open_noauth: opened pipe \NETLOGON to machine LINR5164VS1 and bound anonymously. >[2008/01/16 16:52:06, 4] rpc_client/cli_netlogon.c:rpccli_net_req_chal(46) > cli_net_req_chal: LSA Request Challenge from LINR5164VS1 to \\LINR5164VS1 >[2008/01/16 16:52:06, 5] rpc_parse/parse_net.c:init_q_req_chal(679) > init_q_req_chal: 679 >[2008/01/16 16:52:06, 5] rpc_parse/parse_net.c:init_q_req_chal(688) > init_q_req_chal: 688 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_q_req_chal >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 undoc_buffer: 00000001 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 uni_max_len: 0000000e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0008 offset : 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c uni_str_len: 0000000e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0010 buffer : \.\.L.I.N.R.5.1.6.4.V.S.1... >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00002c smb_io_unistr2 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 002c uni_max_len: 0000000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 offset : 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 uni_str_len: 0000000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0038 buffer : L.I.N.R.5.1.6.4.V.S.1... >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000050 smb_io_chal >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0050 data: e1 01 22 22 34 39 a4 f4 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0070 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000009 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000058 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 0004 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=194 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 112 (0x70) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 112 (0x70) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29652 (0x73D4) > smb_bcc=127 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 70 00 00 00 09 00 00 00 58 .......p .......X > [020] 00 00 00 00 00 04 00 01 00 00 00 0E 00 00 00 00 ........ ........ > [030] 00 00 00 0E 00 00 00 5C 00 5C 00 4C 00 49 00 4E .......\ .\.L.I.N > [040] 00 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 .R.5.1.6 .4.V.S.1 > [050] 00 00 00 0C 00 00 00 00 00 00 00 0C 00 00 00 4C ........ .......L > [060] 00 49 00 4E 00 52 00 35 00 31 00 36 00 34 00 56 .I.N.R.5 .1.6.4.V > [070] 00 53 00 31 00 00 00 E1 01 22 22 34 39 A4 F4 .S.1.... .""49.. >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,198) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,198) wrote 198 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 92 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=92 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 36 (0x24) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=37 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 09 00 00 ........ .$...... > [010] 00 0C 00 00 00 00 00 00 00 36 B9 DF BA 49 13 E7 ........ .6...I.. > [020] CF 00 00 00 00 ..... >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=92 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=7 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 36 (0x24) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 36 (0x24) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=37 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 24 00 00 00 09 00 00 ........ .$...... > [010] 00 0C 00 00 00 00 00 00 00 36 B9 DF BA 49 13 E7 ........ .6...I.. > [020] CF 00 00 00 00 ..... >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0024 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 00000009 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 0000000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 36, data_len 12, ss_len 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 36 at offset 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 returned 24 bytes. >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_r_req_chal >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_chal >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0000 data: 36 b9 df ba 49 13 e7 cf >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 0008 status: NT_STATUS_OK >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(288) > creds_client_init: neg_flags : 400701ff >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(289) > creds_client_init: client chal : E10122223439A4F4 >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(290) > creds_client_init: server chal : 36B9DFBA4913E7CF >[2008/01/16 16:52:06, 5] libsmb/credentials.c:creds_init_64(119) > creds_init_64 >[2008/01/16 16:52:06, 5] libsmb/credentials.c:creds_init_64(120) > clnt_chal_in: E10122223439A4F4 >[2008/01/16 16:52:06, 5] libsmb/credentials.c:creds_init_64(121) > srv_chal_in : 36B9DFBA4913E7CF >[2008/01/16 16:52:06, 5] libsmb/credentials.c:creds_init_64(122) > clnt+srv : 17BB01DD7D4C8BC4 >[2008/01/16 16:52:06, 5] libsmb/credentials.c:creds_init_64(123) > sess_key_out : 111ED8BAF2CDB859 >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(308) > creds_client_init: clnt : F9DFC0DDA491F7C6 >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(309) > creds_client_init: server : E4B9E51798CFC413 >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_init(310) > creds_client_init: seed : F9DFC0DDA491F7C6 >[2008/01/16 16:52:06, 4] rpc_client/cli_netlogon.c:rpccli_net_auth2(170) > cli_net_auth2: srv:\\LINR5164VS1 acct:LINR5164VS1$ sc:2 mc: LINR5164VS1 neg: 400701ff >[2008/01/16 16:52:06, 5] rpc_parse/parse_net.c:init_q_auth_2(800) > init_q_auth_2: 800 >[2008/01/16 16:52:06, 5] rpc_parse/parse_misc.c:init_log_info(1450) > make_log_info 1450 >[2008/01/16 16:52:06, 5] rpc_parse/parse_net.c:init_q_auth_2(806) > init_q_auth_2: 806 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_q_auth_2 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_log_info >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 undoc_buffer: 00000001 >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000004 smb_io_unistr2 unistr2 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 uni_max_len: 0000000e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0008 offset : 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c uni_str_len: 0000000e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0010 buffer : \.\.L.I.N.R.5.1.6.4.V.S.1... >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 00002c smb_io_unistr2 unistr2 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 002c uni_max_len: 0000000d >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 offset : 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 uni_str_len: 0000000d >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0038 buffer : L.I.N.R.5.1.6.4.V.S.1.$... >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0052 sec_chan: 0002 >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000054 smb_io_unistr2 unistr2 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0054 uni_max_len: 0000000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0058 offset : 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 005c uni_str_len: 0000000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942) > 0060 buffer : L.I.N.R.5.1.6.4.V.S.1... >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000078 smb_io_chal >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0078 data: f9 df c0 dd a4 91 f7 c6 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000080 net_io_neg_flags >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0080 neg_flags: 400701ff >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 009c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 0000000a >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_req hdr_req >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000084 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0016 opnum : 000f >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=238 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=8 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 156 (0x9C) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 156 (0x9C) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29652 (0x73D4) > smb_bcc=171 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 00 03 10 00 00 00 9C 00 00 00 0A 00 00 00 84 ........ ........ > [020] 00 00 00 00 00 0F 00 01 00 00 00 0E 00 00 00 00 ........ ........ > [030] 00 00 00 0E 00 00 00 5C 00 5C 00 4C 00 49 00 4E .......\ .\.L.I.N > [040] 00 52 00 35 00 31 00 36 00 34 00 56 00 53 00 31 .R.5.1.6 .4.V.S.1 > [050] 00 00 00 0D 00 00 00 00 00 00 00 0D 00 00 00 4C ........ .......L > [060] 00 49 00 4E 00 52 00 35 00 31 00 36 00 34 00 56 .I.N.R.5 .1.6.4.V > [070] 00 53 00 31 00 24 00 00 00 02 00 0C 00 00 00 00 .S.1.$.. ........ > [080] 00 00 00 0C 00 00 00 4C 00 49 00 4E 00 52 00 35 .......L .I.N.R.5 > [090] 00 31 00 36 00 34 00 56 00 53 00 31 00 00 00 F9 .1.6.4.V .S.1.... > [0A0] DF C0 DD A4 91 F7 C6 FF 01 07 40 ........ ..@ >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,242) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,242) wrote 242 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 96 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=96 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=8 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=41 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 0A 00 00 ........ .(...... > [010] 00 10 00 00 00 00 00 00 00 E4 B9 E5 17 98 CF C4 ........ ........ > [020] 13 FF 01 00 40 00 00 00 00 ....@... . >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=96 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=8 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 40 (0x28) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 40 (0x28) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=41 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 02 03 10 00 00 00 28 00 00 00 0A 00 00 ........ .(...... > [010] 00 10 00 00 00 00 00 00 00 E4 B9 E5 17 98 CF C4 ........ ........ > [020] 13 FF 01 00 40 00 00 00 00 ....@... . >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 02 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0028 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 0000000a >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_resp rpc_hdr_resp >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0010 alloc_hint: 00000010 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0014 context_id: 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0016 cancel_ct : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0017 reserved : 00 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577) > cli_pipe_validate_current_pdu: got pdu len 40, data_len 16, ss_len 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 40 at offset 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d4 returned 32 bytes. >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 net_io_r_auth_2 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_chal >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0000 data: e4 b9 e5 17 98 cf c4 13 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000008 net_io_neg_flags >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0008 neg_flags: 400001ff >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_ntstatus(769) > 000c status: NT_STATUS_OK >[2008/01/16 16:52:06, 10] libsmb/credentials.c:creds_client_check(327) > creds_client_check: credentials check OK. >[2008/01/16 16:52:06, 5] rpc_client/cli_netlogon.c:rpccli_netlogon_setup_creds(346) > rpccli_netlogon_setup_creds: server LINR5164VS1 credential chain established. >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,108) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,108) wrote 108 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 103 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=103 > smb_com=0xa2 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=9 > smt_wct=34 > smb_vwv[ 0]= 255 (0xFF) > smb_vwv[ 1]= 0 (0x0) > smb_vwv[ 2]=54528 (0xD500) > smb_vwv[ 3]= 371 (0x173) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 0 (0x0) > smb_vwv[11]= 0 (0x0) > smb_vwv[12]= 0 (0x0) > smb_vwv[13]= 0 (0x0) > smb_vwv[14]= 0 (0x0) > smb_vwv[15]= 0 (0x0) > smb_vwv[16]= 0 (0x0) > smb_vwv[17]= 0 (0x0) > smb_vwv[18]= 0 (0x0) > smb_vwv[19]= 0 (0x0) > smb_vwv[20]= 0 (0x0) > smb_vwv[21]=32768 (0x8000) > smb_vwv[22]= 0 (0x0) > smb_vwv[23]= 0 (0x0) > smb_vwv[24]= 0 (0x0) > smb_vwv[25]= 0 (0x0) > smb_vwv[26]= 0 (0x0) > smb_vwv[27]= 0 (0x0) > smb_vwv[28]= 0 (0x0) > smb_vwv[29]= 0 (0x0) > smb_vwv[30]= 0 (0x0) > smb_vwv[31]= 512 (0x200) > smb_vwv[32]=65280 (0xFF00) > smb_vwv[33]= 5 (0x5) > smb_bcc=0 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044) > Bind RPC Pipe[73d5]: \NETLOGON auth_type 2, auth_level 6 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647) > Bind Abstract Syntax: [000] 78 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB xV4.4... ...#Eg.. > [010] 01 00 00 00 .... >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650) > Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 .]...... ....+.H` > [010] 02 00 00 00 .... >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_auth_schannel_neg schannel_neg >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0000 type1: 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0004 type2: 00000003 >[2008/01/16 16:52:06, 6] lib/util.c:dump_data(2283) > [000] 4C 49 4E 52 35 31 56 44 31 LINR51VD 1 >[2008/01/16 16:52:06, 6] lib/util.c:dump_data(2283) > [000] 4C 49 4E 52 35 31 36 34 56 53 31 LINR5164 VS1 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0b >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 006e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 001e >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 0000000b >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_rb >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 00000000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0018 num_contexts: 01 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 001c context_id : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 001e num_transfer_syntaxes: 01 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 00001f smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000020 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0020 data : 12345678 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0024 data : 1234 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0026 data : abcd >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0028 data : ef 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 002a data : 01 23 45 67 cf fb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 version: 00000001 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000034 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0034 data : 8a885d04 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0038 data : 1ceb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 003a data : 11c9 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003c data : 9f e8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003e data : 08 00 2b 10 48 60 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0044 version: 00000002 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000048 smb_io_rpc_hdr_auth hdr_auth >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0048 auth_type : 44 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0049 auth_level : 06 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 004a auth_pad_len : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 004b auth_reserved: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 004c auth_context_id: 00000001 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d5 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=192 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=8 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=16 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 110 (0x6E) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 4280 (0x10B8) > smb_vwv[ 4]= 0 (0x0) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 0 (0x0) > smb_vwv[ 7]= 0 (0x0) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_vwv[10]= 82 (0x52) > smb_vwv[11]= 110 (0x6E) > smb_vwv[12]= 82 (0x52) > smb_vwv[13]= 2 (0x2) > smb_vwv[14]= 38 (0x26) > smb_vwv[15]=29653 (0x73D5) > smb_bcc=125 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 5C 00 50 00 49 00 50 00 45 00 5C 00 00 00 05 .\.P.I.P .E.\.... > [010] 00 0B 03 10 00 00 00 6E 00 1E 00 0B 00 00 00 B8 .......n ........ > [020] 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 ........ .......x > [030] 56 34 12 34 12 CD AB EF 00 01 23 45 67 CF FB 01 V4.4.... ..#Eg... > [040] 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B ....]... .......+ > [050] 10 48 60 02 00 00 00 44 06 00 00 01 00 00 00 00 .H`....D ........ > [060] 00 00 00 03 00 00 00 4C 49 4E 52 35 31 56 44 31 .......L INR51VD1 > [070] 00 4C 49 4E 52 35 31 36 34 56 53 31 00 .LINR516 4VS1. >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,196) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,196) wrote 196 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 144 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 88 (0x58) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 88 (0x58) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=89 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 0B 00 00 ........ .X...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 44 06 08 00 01 00 00 00 01 00 00 `....D.. ........ > [050] 00 00 00 00 00 05 00 00 00 ........ . >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=144 > smb_com=0x25 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=10 > smt_wct=10 > smb_vwv[ 0]= 0 (0x0) > smb_vwv[ 1]= 88 (0x58) > smb_vwv[ 2]= 0 (0x0) > smb_vwv[ 3]= 0 (0x0) > smb_vwv[ 4]= 56 (0x38) > smb_vwv[ 5]= 0 (0x0) > smb_vwv[ 6]= 88 (0x58) > smb_vwv[ 7]= 56 (0x38) > smb_vwv[ 8]= 0 (0x0) > smb_vwv[ 9]= 0 (0x0) > smb_bcc=89 >[2008/01/16 16:52:06, 10] lib/util.c:dump_data(2283) > [000] 00 05 00 0C 03 10 00 00 00 58 00 0C 00 0B 00 00 ........ .X...... > [010] 00 B8 10 B8 10 F0 53 00 00 0C 00 5C 50 49 50 45 ......S. ...\PIPE > [020] 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 \lsass.. ........ > [030] 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 ..]..... .....+.H > [040] 60 02 00 00 00 44 06 08 00 01 00 00 00 01 00 00 `....D.. ........ > [050] 00 00 00 00 00 05 00 00 00 ........ . >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr rpc_hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0058 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 0000000b >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843) > rpc_api_pipe: got PDU len of 88 at offset 0 >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894) > rpc_api_pipe: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d5 returned 88 bytes. >[2008/01/16 16:52:06, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081) > rpc_pipe_bind: Remote machine LINR5164VS1 pipe \NETLOGON fnum 0x73d5 bind request returned ok. >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000000 smb_io_rpc_hdr hdr >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0000 major : 05 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0001 minor : 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0002 pkt_type : 0c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0003 flags : 03 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0004 pack_type0: 10 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0005 pack_type1: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0006 pack_type2: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0007 pack_type3: 00 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0008 frag_len : 0058 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 000a auth_len : 000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 000c call_id : 0000000b >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_ba >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000010 smb_io_rpc_hdr_bba >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0010 max_tsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0012 max_rsize: 10b8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0014 assoc_gid: 000053f0 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000018 smb_io_rpc_addr_str >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0018 len: 000c >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 001a str: \PIPE\lsass. >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000026 smb_io_rpc_results >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8(616) > 0028 num_results: 01 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002c result : 0000 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 002e reason : 0000 >[2008/01/16 16:52:06, 6] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_rpc_iface >[2008/01/16 16:52:06, 7] rpc_parse/parse_prs.c:prs_debug(84) > 000030 smb_io_uuid uuid >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0030 data : 8a885d04 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0034 data : 1ceb >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint16(681) > 0036 data : 11c9 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 0038 data : 9f e8 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint8s(857) > 003a data : 08 00 2b 10 48 60 >[2008/01/16 16:52:06, 5] rpc_parse/parse_prs.c:prs_uint32(710) > 0040 version: 00000002 >[2008/01/16 16:52:06, 5] rpc_client/cli_pipe.c:check_bind_response(1701) > check_bind_response: accepted! >[2008/01/16 16:52:06, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_schannel_with_key(2543) > cli_rpc_pipe_open_schannel_with_key: opened pipe \NETLOGON to machine LINR5164VS1 for domain LINR51VD1 and bound using schannel. >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(153) > write_socket(17,45) >[2008/01/16 16:52:06, 6] libsmb/clientgen.c:write_socket(156) > write_socket(17,45) wrote 45 >[2008/01/16 16:52:06, 10] lib/util_sock.c:read_smb_length_return_keepalive(623) > got smb length of 35 >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(506) >[2008/01/16 16:52:06, 5] lib/util.c:show_msg(516) > size=35 > smb_com=0x4 > smb_rcls=0 > smb_reh=0 > smb_err=0 > smb_flg=136 > smb_flg2=51201 > smb_tid=1 > smb_pid=26386 > smb_uid=101 > smb_mid=11 > smt_wct=0 > smb_bcc=0 >[2008/01/16 16:52:06, 10] libsmb/clientgen.c:cli_rpc_pipe_close(395) > cli_rpc_pipe_close: closed pipe \NETLOGON to machine LINR5164VS1 >[2008/01/16 16:52:06, 3] nsswitch/winbindd_misc.c:winbindd_dual_check_machine_acct(87) > secret is good >[2008/01/16 16:52:06, 5] nsswitch/winbindd_misc.c:winbindd_dual_check_machine_acct(96) > Checking the trust account password returned NT_STATUS_OK >[2008/01/16 16:52:06, 10] nsswitch/winbindd_cache.c:cache_store_response(2259) > Storing response for pid 26386, len 3240
<b>You cannot view the attachment while viewing its details because your browser does not support IFRAMEs. <a href="attachment.cgi?id=291898">View the attachment on a separate page</a>.</b>
View Attachment As Raw
Actions:
View
Attachments on
bug 429024
:
291892
|
291893
|
291897
| 291898 |
292014
|
292015
|
292202
|
292203
|
293489
|
293625
|
293626
|
295318
|
299950
|
300141