Attachment 293626 Details for Bug 429024 – new log wb-LINR51VD1.log

new log wb-LINR51VD1.log

wb-LINR51VD1.log (text/plain), 221.93 KB, created by Lin Li on 2008-01-31 19:19:18 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Lin Li

Created: 2008-01-31 19:19:18 UTC

Size: 221.93 KB

patch

obsolete

>[2008/01/31 14:04:48, 1] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625)
>  cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from remote machine LINR5164VS1 pipe \lsarpc fnum 0x7697!
>[2008/01/31 14:06:50, 4] nsswitch/winbindd_dual.c:fork_domain_child(1065)
>  child daemon request 47
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_dual.c:child_process_request(480)
>  process_request: request fn INIT_CONNECTION
>[2008/01/31 14:06:50, 8] nsswitch/winbindd_cm.c:connection_ok(1434)
>  connection_ok: Connection to  for domain LINR51VD1 has NULL cli!
>[2008/01/31 14:06:50, 10] lib/gencache.c:gencache_get(226)
>  Returning valid cache entry: key = SAF/DOMAIN/LINR51VD1, value = LINR5164VS1, timeout = Thu Jan 31 14:21:46 2008
>[2008/01/31 14:06:50, 5] libsmb/namequery.c:saf_fetch(136)
>  saf_fetch: Returning "LINR5164VS1" for "LINR51VD1" domain
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:cm_open_connection(1274)
>  cm_open_connection: saf_servername is 'LINR5164VS1' for domain LINR51VD1
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:cm_open_connection(1304)
>  cm_open_connection: dcname is 'LINR5164VS1' for domain LINR51VD1
>[2008/01/31 14:06:50, 10] lib/gencache.c:gencache_get(212)
>  Cache entry with key = AD_SITENAME/DOMAIN/ couldn't be found
>[2008/01/31 14:06:50, 5] libads/dns.c:sitename_fetch(676)
>  sitename_fetch: No stored sitename for 
>[2008/01/31 14:06:50, 10] libsmb/namequery.c:internal_resolve_name(1166)
>  internal_resolve_name: looking up LINR5164VS1#20 (sitename (null))
>[2008/01/31 14:06:50, 10] lib/gencache.c:gencache_get(226)
>  Returning valid cache entry: key = NBT/LINR5164VS1#20, value = 172.16.9.21:0, timeout = Thu Jan 31 14:15:47 2008
>[2008/01/31 14:06:50, 5] libsmb/namecache.c:namecache_fetch(214)
>  name LINR5164VS1#20 found.
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:cm_prepare_connection(612)
>  cm_prepare_connection: connecting to DC LINR5164VS1 for domain LINR51VD1
>[2008/01/31 14:06:50, 3] nsswitch/winbindd_cm.c:cm_get_ipc_userpass(507)
>  cm_get_ipc_userpass: No auth-user defined
>[2008/01/31 14:06:50, 10] passdb/secrets.c:secrets_named_mutex(930)
>  secrets_named_mutex: got mutex for LINR5164VS1
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,194)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,194) wrote 194
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 127
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=127
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=0
>  smb_mid=1
>  smt_wct=17
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=12803 (0x3203)
>  smb_vwv[ 2]=  256 (0x100)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=   65 (0x41)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  256 (0x100)
>  smb_vwv[ 7]=36352 (0x8E00)
>  smb_vwv[ 8]=   17 (0x11)
>  smb_vwv[ 9]=64768 (0xFD00)
>  smb_vwv[10]=33011 (0x80F3)
>  smb_vwv[11]=  128 (0x80)
>  smb_vwv[12]=53249 (0xD001)
>  smb_vwv[13]=15470 (0x3C6E)
>  smb_vwv[14]=51300 (0xC864)
>  smb_vwv[15]=11265 (0x2C01)
>  smb_vwv[16]=    1 (0x1)
>  smb_bcc=58
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 6C 69 6E 72 35 31 36 34  76 73 31 00 00 00 00 00  linr5164 vs1.....
>  [010] 60 28 06 06 2B 06 01 05  05 02 A0 1E 30 1C A0 0E  `(..+... ....0...
>  [020] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A3 0A  0...+... ..7.....
>  [030] 30 08 A0 06 1B 04 4E 4F  4E 45                    0.....NO NE
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=127
>  smb_com=0x72
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=0
>  smb_mid=1
>  smt_wct=17
>  smb_vwv[ 0]=    8 (0x8)
>  smb_vwv[ 1]=12803 (0x3203)
>  smb_vwv[ 2]=  256 (0x100)
>  smb_vwv[ 3]= 1024 (0x400)
>  smb_vwv[ 4]=   65 (0x41)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  256 (0x100)
>  smb_vwv[ 7]=36352 (0x8E00)
>  smb_vwv[ 8]=   17 (0x11)
>  smb_vwv[ 9]=64768 (0xFD00)
>  smb_vwv[10]=33011 (0x80F3)
>  smb_vwv[11]=  128 (0x80)
>  smb_vwv[12]=53249 (0xD001)
>  smb_vwv[13]=15470 (0x3C6E)
>  smb_vwv[14]=51300 (0xC864)
>  smb_vwv[15]=11265 (0x2C01)
>  smb_vwv[16]=    1 (0x1)
>  smb_bcc=58
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 6C 69 6E 72 35 31 36 34  76 73 31 00 00 00 00 00  linr5164 vs1.....
>  [010] 60 28 06 06 2B 06 01 05  05 02 A0 1E 30 1C A0 0E  `(..+... ....0...
>  [020] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A3 0A  0...+... ..7.....
>  [030] 30 08 A0 06 1B 04 4E 4F  4E 45                    0.....NO NE
>[2008/01/31 14:06:50, 5] nsswitch/winbindd_cm.c:cm_prepare_connection(723)
>  connecting to LINR5164VS1 from LINR5164VS1 with username [LINR51VD1]\[LINR5164VS1$]
>[2008/01/31 14:06:50, 3] libsmb/cliconnect.c:cli_session_setup_spnego(789)
>  Doing spnego session setup (blob length=58)
>[2008/01/31 14:06:50, 3] libsmb/cliconnect.c:cli_session_setup_spnego(814)
>  got OID=1 3 6 1 4 1 311 2 2 10
>[2008/01/31 14:06:50, 3] libsmb/cliconnect.c:cli_session_setup_spnego(822)
>  got principal=NONE
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,172)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,172) wrote 172
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 386
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=386
>  smb_com=0x73
>  smb_rcls=22
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=100
>  smb_mid=2
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  249 (0xF9)
>  smb_bcc=343
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] A1 81 F6 30 81 F3 A0 03  0A 01 01 A1 0C 06 0A 2B  ...0.... .......+
>  [010] 06 01 04 01 82 37 02 02  0A A2 81 DD 04 81 DA 4E  .....7.. .......N
>  [020] 54 4C 4D 53 53 50 00 02  00 00 00 12 00 12 00 30  TLMSSP.. .......0
>  [030] 00 00 00 15 82 89 60 2B  2C 1A 75 79 27 D2 F8 00  ......`+ ,.uy'...
>  [040] 00 00 00 00 00 00 00 98  00 98 00 42 00 00 00 4C  ........ ...B...L
>  [050] 00 49 00 4E 00 52 00 35  00 31 00 56 00 44 00 31  .I.N.R.5 .1.V.D.1
>  [060] 00 02 00 12 00 4C 00 49  00 4E 00 52 00 35 00 31  .....L.I .N.R.5.1
>  [070] 00 56 00 44 00 31 00 01  00 16 00 4C 00 49 00 4E  .V.D.1.. ...L.I.N
>  [080] 00 52 00 35 00 31 00 36  00 34 00 56 00 53 00 31  .R.5.1.6 .4.V.S.1
>  [090] 00 04 00 22 00 6F 00 74  00 74 00 61 00 77 00 61  ...".o.t .t.a.w.a
>  [0A0] 00 2E 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ...x.a.n .d.r.o.s
>  [0B0] 00 2E 00 63 00 61 00 03  00 3A 00 6C 00 69 00 6E  ...c.a.. .:.l.i.n
>  [0C0] 00 72 00 35 00 31 00 36  00 34 00 76 00 73 00 31  .r.5.1.6 .4.v.s.1
>  [0D0] 00 2E 00 6F 00 74 00 74  00 61 00 77 00 61 00 2E  ...o.t.t .a.w.a..
>  [0E0] 00 78 00 61 00 6E 00 64  00 72 00 6F 00 73 00 2E  .x.a.n.d .r.o.s..
>  [0F0] 00 63 00 61 00 00 00 00  00 55 00 6E 00 69 00 78  .c.a.... .U.n.i.x
>  [100] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [110] 00 2E 00 30 00 2E 00 32  00 35 00 62 00 2D 00 31  ...0...2 .5.b.-.1
>  [120] 00 2E 00 65 00 6C 00 35  00 5F 00 31 00 2E 00 34  ...e.l.5 ._.1...4
>  [130] 00 5F 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ._.x.a.n .d.r.o.s
>  [140] 00 00 00 4C 00 49 00 4E  00 52 00 35 00 31 00 56  ...L.I.N .R.5.1.V
>  [150] 00 44 00 31 00 00 00                              .D.1... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=386
>  smb_com=0x73
>  smb_rcls=22
>  smb_reh=0
>  smb_err=49152
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=100
>  smb_mid=2
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=  249 (0xF9)
>  smb_bcc=343
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] A1 81 F6 30 81 F3 A0 03  0A 01 01 A1 0C 06 0A 2B  ...0.... .......+
>  [010] 06 01 04 01 82 37 02 02  0A A2 81 DD 04 81 DA 4E  .....7.. .......N
>  [020] 54 4C 4D 53 53 50 00 02  00 00 00 12 00 12 00 30  TLMSSP.. .......0
>  [030] 00 00 00 15 82 89 60 2B  2C 1A 75 79 27 D2 F8 00  ......`+ ,.uy'...
>  [040] 00 00 00 00 00 00 00 98  00 98 00 42 00 00 00 4C  ........ ...B...L
>  [050] 00 49 00 4E 00 52 00 35  00 31 00 56 00 44 00 31  .I.N.R.5 .1.V.D.1
>  [060] 00 02 00 12 00 4C 00 49  00 4E 00 52 00 35 00 31  .....L.I .N.R.5.1
>  [070] 00 56 00 44 00 31 00 01  00 16 00 4C 00 49 00 4E  .V.D.1.. ...L.I.N
>  [080] 00 52 00 35 00 31 00 36  00 34 00 56 00 53 00 31  .R.5.1.6 .4.V.S.1
>  [090] 00 04 00 22 00 6F 00 74  00 74 00 61 00 77 00 61  ...".o.t .t.a.w.a
>  [0A0] 00 2E 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ...x.a.n .d.r.o.s
>  [0B0] 00 2E 00 63 00 61 00 03  00 3A 00 6C 00 69 00 6E  ...c.a.. .:.l.i.n
>  [0C0] 00 72 00 35 00 31 00 36  00 34 00 76 00 73 00 31  .r.5.1.6 .4.v.s.1
>  [0D0] 00 2E 00 6F 00 74 00 74  00 61 00 77 00 61 00 2E  ...o.t.t .a.w.a..
>  [0E0] 00 78 00 61 00 6E 00 64  00 72 00 6F 00 73 00 2E  .x.a.n.d .r.o.s..
>  [0F0] 00 63 00 61 00 00 00 00  00 55 00 6E 00 69 00 78  .c.a.... .U.n.i.x
>  [100] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [110] 00 2E 00 30 00 2E 00 32  00 35 00 62 00 2D 00 31  ...0...2 .5.b.-.1
>  [120] 00 2E 00 65 00 6C 00 35  00 5F 00 31 00 2E 00 34  ...e.l.5 ._.1...4
>  [130] 00 5F 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ._.x.a.n .d.r.o.s
>  [140] 00 00 00 4C 00 49 00 4E  00 52 00 35 00 31 00 56  ...L.I.N .R.5.1.V
>  [150] 00 44 00 31 00 00 00                              .D.1... 
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1018)
>  Got challenge flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60898215
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_CHAL_TARGET_INFO
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1040)
>  NTLMSSP: Set final flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088215
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1112)
>  NTLMSSP challenge set by NTLM2
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1113)
>  challenge is: 
>[2008/01/31 14:06:50, 5] lib/util.c:dump_data(2283)
>  [000] 08 14 1A E5 20 D5 56 3B                           .... .V; 
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088215
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,290)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,290) wrote 290
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 146
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=146
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=3
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    9 (0x9)
>  smb_bcc=103
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
>  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [020] 00 2E 00 30 00 2E 00 32  00 35 00 62 00 2D 00 31  ...0...2 .5.b.-.1
>  [030] 00 2E 00 65 00 6C 00 35  00 5F 00 31 00 2E 00 34  ...e.l.5 ._.1...4
>  [040] 00 5F 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ._.x.a.n .d.r.o.s
>  [050] 00 00 00 4C 00 49 00 4E  00 52 00 35 00 31 00 56  ...L.I.N .R.5.1.V
>  [060] 00 44 00 31 00 00 00                              .D.1... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=146
>  smb_com=0x73
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=0
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=3
>  smt_wct=4
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    9 (0x9)
>  smb_bcc=103
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] A1 07 30 05 A0 03 0A 01  00 55 00 6E 00 69 00 78  ..0..... .U.n.i.x
>  [010] 00 00 00 53 00 61 00 6D  00 62 00 61 00 20 00 33  ...S.a.m .b.a. .3
>  [020] 00 2E 00 30 00 2E 00 32  00 35 00 62 00 2D 00 31  ...0...2 .5.b.-.1
>  [030] 00 2E 00 65 00 6C 00 35  00 5F 00 31 00 2E 00 34  ...e.l.5 ._.1...4
>  [040] 00 5F 00 78 00 61 00 6E  00 64 00 72 00 6F 00 73  ._.x.a.n .d.r.o.s
>  [050] 00 00 00 4C 00 49 00 4E  00 52 00 35 00 31 00 56  ...L.I.N .R.5.1.V
>  [060] 00 44 00 31 00 00 00                              .D.1... 
>[2008/01/31 14:06:50, 10] libsmb/clientgen.c:cli_init_creds(254)
>  cli_init_creds: user LINR5164VS1$ domain LINR51VD1
>[2008/01/31 14:06:50, 10] libsmb/namequery.c:saf_store(74)
>  saf_store: domain = [LINR51VD1], server = [LINR5164VS1], expire = [1201807310]
>[2008/01/31 14:06:50, 10] lib/gencache.c:gencache_set(140)
>  Adding cache entry with key = SAF/DOMAIN/LINR51VD1; value = LINR5164VS1 and timeout = Thu Jan 31 14:21:50 2008
>   (900 seconds ahead)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,90)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,90) wrote 90
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 56
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=56
>  smb_com=0x75
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=4
>  smt_wct=7
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=    1 (0x1)
>  smb_vwv[ 3]=  511 (0x1FF)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=  511 (0x1FF)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_bcc=7
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 49 50 43 00 00 00 00                              IPC.... 
>[2008/01/31 14:06:50, 10] passdb/secrets.c:secrets_named_mutex_release(942)
>  secrets_named_mutex: released mutex for LINR5164VS1
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:set_global_winbindd_state_online(2686)
>  set_global_winbindd_state_online: online requested.
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:set_global_winbindd_state_online(2689)
>  set_global_winbindd_state_online: rejecting.
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:set_domain_online(359)
>  set_domain_online: called for domain LINR51VD1
>[2008/01/31 14:06:50, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1527)
>  set_dc_type_and_flags: domain LINR51VD1
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,104)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,104) wrote 104
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 103
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=5
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50176 (0xC400)
>  smb_vwv[ 3]=  373 (0x175)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044)
>  Bind RPC Pipe[75c4]: \lsarpc auth_type 0, auth_level 0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647)
>  Bind Abstract Syntax: [000] 6A 28 19 39 0C B1 D0 11  9B A8 00 C0 4F D9 2E F5  j(.9.... ....O...
>  [010] 00 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650)
>  Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [010] 02 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 3919286a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : b10c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : 11d0
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : 9b a8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 00 c0 4f d9 2e f5 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c4
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=154
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=6
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30148 (0x75C4)
>  smb_bcc=87
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0B 03 10 00 00 00 48  00 00 00 01 00 00 00 B8  .......H ........
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 6A  ........ .......j
>  [030] 28 19 39 0C B1 D0 11 9B  A8 00 C0 4F D9 2E F5 00  (.9..... ...O....
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00                              .H`.... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,158)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,158) wrote 158
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 124
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=6
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=6
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 01 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0044
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000001
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 68 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c4 returned 68 bytes.
>[2008/01/31 14:06:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081)
>  rpc_pipe_bind: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c4 bind request returned ok.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0044
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_ba 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 000053f0
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000018 smb_io_rpc_addr_str 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0018 len: 000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          001a str: \PIPE\lsass.
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000026 smb_io_rpc_results 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>          0028 num_results: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002c result     : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002e reason     : 0000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000030 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000030 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0030 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0034 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0036 data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0038 data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003a data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0040 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701)
>  check_bind_response: accepted!
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2277)
>  cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine LINR5164VS1 and bound anonymously.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 ds_io_q_getprimdominfo 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0000 level: 0001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 001a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0000
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c4
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=108
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=7
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   26 (0x1A)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   26 (0x1A)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30148 (0x75C4)
>  smb_bcc=41
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 1A  00 00 00 02 00 00 00 02  ........ ........
>  [020] 00 00 00 00 00 00 00 01  00                       ........ .
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,112)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,112) wrote 112
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 160
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=7
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  104 (0x68)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  104 (0x68)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=105
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 68 00 00 00 02 00 00  ........ .h......
>  [010] 00 50 00 00 00 00 00 00  00 01 00 00 00 01 00 00  .P...... ........
>  [020] 00 05 00 00 00 00 00 00  01 01 00 00 00 00 00 00  ........ ........
>  [030] 00 00 00 00 00 D8 B6 01  AA B9 1E 43 43 B6 F5 39  ........ ...CC..9
>  [040] 0B 03 1A C7 C5 0A 00 00  00 00 00 00 00 0A 00 00  ........ ........
>  [050] 00 4C 00 49 00 4E 00 52  00 35 00 31 00 56 00 44  .L.I.N.R .5.1.V.D
>  [060] 00 31 00 00 00 00 00 00  00                       .1...... .
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=160
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=7
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  104 (0x68)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  104 (0x68)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=105
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 68 00 00 00 02 00 00  ........ .h......
>  [010] 00 50 00 00 00 00 00 00  00 01 00 00 00 01 00 00  .P...... ........
>  [020] 00 05 00 00 00 00 00 00  01 01 00 00 00 00 00 00  ........ ........
>  [030] 00 00 00 00 00 D8 B6 01  AA B9 1E 43 43 B6 F5 39  ........ ...CC..9
>  [040] 0B 03 1A C7 C5 0A 00 00  00 00 00 00 00 0A 00 00  ........ ........
>  [050] 00 4C 00 49 00 4E 00 52  00 35 00 31 00 56 00 44  .L.I.N.R .5.1.V.D
>  [060] 00 31 00 00 00 00 00 00  00                       .1...... .
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0068
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000050
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 104, data_len 80, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 104 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c4 returned 160 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 ds_io_r_getprimdominfo 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr: 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0004 level: 0001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0006 unknown0: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 machine_role: 0005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c flags: 01000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 netbios_ptr: 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0014 dnsname_ptr: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0018 forestname_ptr: 00000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001c smb_io_uuid domain_guid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          001c data   : aa01b6d8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0020 data   : 1eb9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0022 data   : 4343
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          0024 data   : b6 f5 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          0026 data   : 39 0b 03 1a c7 c5 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00002c smb_io_unistr2 netbios_domain
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          002c uni_max_len: 0000000a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 offset     : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0034 uni_str_len: 0000000a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942)
>          0038 buffer     : L.I.N.R.5.1.V.D.1...
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00004c smb_io_unistr2 - NULL dns_domain
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00004c smb_io_unistr2 - NULL forest_domain
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      004c status: NT_STATUS_OK
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,45)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,45) wrote 45
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 35
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=8
>  smt_wct=0
>  smb_bcc=0
>[2008/01/31 14:06:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(395)
>  cli_rpc_pipe_close: closed pipe \lsarpc to machine LINR5164VS1
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,104)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,104) wrote 104
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 103
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=9
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50432 (0xC500)
>  smb_vwv[ 3]=  373 (0x175)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044)
>  Bind RPC Pipe[75c5]: \lsarpc auth_type 0, auth_level 0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647)
>  Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB  EF 00 01 23 45 67 89 AB  xW4.4... ...#Eg..
>  [010] 00 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650)
>  Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [010] 02 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000003
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 12345778
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : 1234
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : abcd
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : ef 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 01 23 45 67 89 ab 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=154
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=10
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30149 (0x75C5)
>  smb_bcc=87
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0B 03 10 00 00 00 48  00 00 00 03 00 00 00 B8  .......H ........
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 78  ........ .......x
>  [030] 57 34 12 34 12 CD AB EF  00 01 23 45 67 89 AB 00  W4.4.... ..#Eg...
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00                              .H`.... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,158)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,158) wrote 158
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 124
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=10
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 03 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=124
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=10
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   68 (0x44)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=69
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 44 00 00 00 03 00 00  ........ .D......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00                                    `.... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0044
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000003
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 68 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5 returned 68 bytes.
>[2008/01/31 14:06:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081)
>  rpc_pipe_bind: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5 bind request returned ok.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0044
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000003
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_ba 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 000053f0
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000018 smb_io_rpc_addr_str 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0018 len: 000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          001a str: \PIPE\lsass.
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000026 smb_io_rpc_results 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>          0028 num_results: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002c result     : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002e reason     : 0000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000030 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000030 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0030 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0034 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0036 data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0038 data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003a data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0040 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701)
>  check_bind_response: accepted!
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_noauth(2277)
>  cli_rpc_pipe_open_noauth: opened pipe \lsarpc to machine LINR5164VS1 and bound anonymously.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_sec_qos(185)
>  init_lsa_sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_open_pol2(368)
>  init_q_open_pol2: attr:0 da:33554432
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_obj_attr(236)
>  init_lsa_obj_attr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_open_pol2 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr       : 00000001
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000004 smb_io_unistr2 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0004 uni_max_len: 0000000e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0008 offset     : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          000c uni_str_len: 0000000e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942)
>          0010 buffer     : \.\.L.I.N.R.5.1.6.4.V.S.1...
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00002c lsa_io_obj_attr 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          002c len         : 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 ptr_root_dir: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0034 ptr_obj_name: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0038 attributes  : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          003c ptr_sec_desc: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0040 ptr_sec_qos : 00000001
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000044 lsa_io_obj_qos sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0044 len           : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0048 sec_imp_level : 0002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              004a sec_ctxt_mode : 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              004b effective_only: 00
>[2008/01/31 14:06:50, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(224)
>  lsa_io_sec_qos: length c does not match size 8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c des_access: 02000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0068
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000004
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000050
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 002c
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=186
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=11
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  104 (0x68)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  104 (0x68)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30149 (0x75C5)
>  smb_bcc=119
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 68  00 00 00 04 00 00 00 50  .......h .......P
>  [020] 00 00 00 00 00 2C 00 01  00 00 00 0E 00 00 00 00  .....,.. ........
>  [030] 00 00 00 0E 00 00 00 5C  00 5C 00 4C 00 49 00 4E  .......\ .\.L.I.N
>  [040] 00 52 00 35 00 31 00 36  00 34 00 56 00 53 00 31  .R.5.1.6 .4.V.S.1
>  [050] 00 00 00 18 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [060] 00 00 00 00 00 00 00 01  00 00 00 0C 00 00 00 02  ........ ........
>  [070] 00 01 00 00 00 00 02                              ....... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,190)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,190) wrote 190
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 104
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=11
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 04 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [020] 00 00 00 00 00 A2 47 4A  1C 8E 11 00 00 00 00 00  ......GJ ........
>  [030] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=11
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 04 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 01 00 00  ........ ........
>  [020] 00 00 00 00 00 A2 47 4A  1C 8E 11 00 00 00 00 00  ......GJ ........
>  [030] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0030
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000004
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 48 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5 returned 48 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_open_pol2 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0014 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_query2(3141)
>  init_q_query2
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_query_info2 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd pol
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 info_class: 000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 002e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000016
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 002e
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=12
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   46 (0x2E)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   46 (0x2E)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30149 (0x75C5)
>  smb_bcc=61
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 2E  00 00 00 05 00 00 00 16  ........ ........
>  [020] 00 00 00 00 00 2E 00 00  00 00 00 01 00 00 00 00  ........ ........
>  [030] 00 00 00 A2 47 4A 1C 8E  11 00 00 0C 00           ....GJ.. .....
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,132)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,132) wrote 132
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 88
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=88
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=12
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   32 (0x20)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   32 (0x20)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=33
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 03 23 10 00 00  00 20 00 00 00 05 00 00  ....#... . ......
>  [010] 00 00 00 00 00 00 00 00  00 02 00 01 1C 00 00 00  ........ ........
>  [020] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=88
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=12
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   32 (0x20)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   32 (0x20)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=33
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 03 23 10 00 00  00 20 00 00 00 05 00 00  ....#... . ......
>  [010] 00 00 00 00 00 00 00 00  00 02 00 01 1C 00 00 00  ........ ........
>  [020] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 23
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0020
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000018 smb_io_rpc_hdr_fault fault
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_dcerpc_status(799)
>      0018 status  : DCERPC_FAULT_OP_RNG_ERROR
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      001c reserved: 00000000
>[2008/01/31 14:06:50, 1] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(625)
>  cli_pipe_validate_current_pdu: RPC fault code DCERPC_FAULT_OP_RNG_ERROR received from remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5!
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 32 at offset 0
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_sec_qos(185)
>  init_lsa_sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_open_pol(304)
>  init_open_pol: attr:0 da:33554432
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_obj_attr(236)
>  init_lsa_obj_attr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_open_pol 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr       : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0004 system_name: 005c
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000008 lsa_io_obj_attr 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0008 len         : 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          000c ptr_root_dir: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0010 ptr_obj_name: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 attributes  : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0018 ptr_sec_desc: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          001c ptr_sec_qos : 00000001
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 lsa_io_obj_qos sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 len           : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 sec_imp_level : 0002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0026 sec_ctxt_mode : 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0027 effective_only: 00
>[2008/01/31 14:06:50, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(224)
>  lsa_io_sec_qos: length c does not match size 8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0028 des_access: 02000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0044
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000006
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000002c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0006
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=150
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=13
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   68 (0x44)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   68 (0x44)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30149 (0x75C5)
>  smb_bcc=83
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 44  00 00 00 06 00 00 00 2C  .......D .......,
>  [020] 00 00 00 00 00 06 00 01  00 00 00 5C 00 00 00 18  ........ ...\....
>  [030] 00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  ........ ........
>  [040] 00 00 00 01 00 00 00 0C  00 00 00 02 00 01 00 00  ........ ........
>  [050] 00 00 02                                          ... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,154)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,154) wrote 154
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 104
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=13
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 06 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 02 00 00  ........ ........
>  [020] 00 00 00 00 00 A2 47 4A  1C 8E 11 00 00 00 00 00  ......GJ ........
>  [030] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=104
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=13
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   48 (0x30)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   48 (0x30)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=49
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 30 00 00 00 06 00 00  ........ .0......
>  [010] 00 18 00 00 00 00 00 00  00 00 00 00 00 02 00 00  ........ ........
>  [020] 00 00 00 00 00 A2 47 4A  1C 8E 11 00 00 00 00 00  ......GJ ........
>  [030] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0030
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000006
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 48, data_len 24, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 48 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5 returned 48 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_open_pol 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0014 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_query(488)
>  init_q_query
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_query 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 info_class: 0005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 002e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000007
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000016
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0007
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=14
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   46 (0x2E)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   46 (0x2E)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30149 (0x75C5)
>  smb_bcc=61
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 2E  00 00 00 07 00 00 00 16  ........ ........
>  [020] 00 00 00 00 00 07 00 00  00 00 00 02 00 00 00 00  ........ ........
>  [030] 00 00 00 A2 47 4A 1C 8E  11 00 00 05 00           ....GJ.. .....
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,132)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,132) wrote 132
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 164
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=14
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 07 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 00 00 00 22 05 00 00  .T...... ...."...
>  [020] 00 12 00 14 00 01 00 00  00 01 00 00 00 0A 00 00  ........ ........
>  [030] 00 00 00 00 00 09 00 00  00 4C 00 49 00 4E 00 52  ........ .L.I.N.R
>  [040] 00 35 00 31 00 56 00 44  00 31 00 00 00 04 00 00  .5.1.V.D .1......
>  [050] 00 01 04 00 00 00 00 00  05 15 00 00 00 95 E5 AE  ........ ........
>  [060] 5D 13 6A F7 F1 94 39 8B  B2 00 00 00 00           ].j...9. .....
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=164
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=14
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  108 (0x6C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  108 (0x6C)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=109
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 6C 00 00 00 07 00 00  ........ .l......
>  [010] 00 54 00 00 00 00 00 00  00 00 00 00 22 05 00 00  .T...... ...."...
>  [020] 00 12 00 14 00 01 00 00  00 01 00 00 00 0A 00 00  ........ ........
>  [030] 00 00 00 00 00 09 00 00  00 4C 00 49 00 4E 00 52  ........ .L.I.N.R
>  [040] 00 35 00 31 00 56 00 44  00 31 00 00 00 04 00 00  .5.1.V.D .1......
>  [050] 00 01 04 00 00 00 00 00  05 15 00 00 00 95 E5 AE  ........ ........
>  [060] 5D 13 6A F7 F1 94 39 8B  B2 00 00 00 00           ].j...9. .....
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 006c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000007
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000054
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 108, data_len 84, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 108 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c5 returned 168 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_query 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 dom_ptr: 22000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000004 lsa_io_query_info_ctr 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0004 info_class: 0005
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000008 lsa_io_dom_query_3 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 uni_dom_max_len: 0012
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a uni_dom_str_len: 0014
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              000c buffer_dom_name: 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0010 buffer_dom_sid : 00000001
>[2008/01/31 14:06:50, 8] rpc_parse/parse_prs.c:prs_debug(84)
>              000014 smb_io_unistr2 unistr2
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  0014 uni_max_len: 0000000a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  0018 offset     : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  001c uni_str_len: 00000009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942)
>                  0020 buffer     : L.I.N.R.5.1.V.D.1.
>[2008/01/31 14:06:50, 8] rpc_parse/parse_prs.c:prs_debug(84)
>              000034 smb_io_dom_sid2 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  0034 num_auths: 00000004
>[2008/01/31 14:06:50, 9] rpc_parse/parse_prs.c:prs_debug(84)
>                  000038 smb_io_dom_sid sid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      0038 sid_rev_num: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      0039 num_auths  : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003a id_auth[0] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003b id_auth[1] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003c id_auth[2] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003d id_auth[3] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003e id_auth[4] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                      003f id_auth[5] : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32s(997)
>                      0040 sub_auths : 00000015 5daee595 f1f76a13 b28b3994 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0050 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1633)
>  set_dc_type_and_flags: domain LINR51VD1 is NOT in native mode.
>[2008/01/31 14:06:50, 5] nsswitch/winbindd_cm.c:set_dc_type_and_flags(1636)
>  set_dc_type_and_flags: domain LINR51VD1 is NOT running active directory.
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,45)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,45) wrote 45
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 35
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=35
>  smb_com=0x4
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=15
>  smt_wct=0
>  smb_bcc=0
>[2008/01/31 14:06:50, 10] libsmb/clientgen.c:cli_rpc_pipe_close(395)
>  cli_rpc_pipe_close: closed pipe \lsarpc to machine LINR5164VS1
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:cache_store_response(2259)
>  Storing response for pid 4493, len 3240
>[2008/01/31 14:06:50, 4] nsswitch/winbindd_dual.c:fork_domain_child(1065)
>  child daemon request 19
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_dual.c:child_process_request(480)
>  process_request: request fn LIST_TRUSTDOM
>[2008/01/31 14:06:50, 3] nsswitch/winbindd_misc.c:winbindd_dual_list_trusted_domains(121)
>  [ 4491]: list trusted domains
>[2008/01/31 14:06:50, 5] nsswitch/winbindd_cache.c:get_cache(174)
>  get_cache: Setting MS-RPC methods for domain LINR51VD1
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:fetch_cache_seqnum(384)
>  fetch_cache_seqnum: invalid data size key [SEQNUM/LINR51VD1]
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_rpc.c:sequence_number(823)
>  rpc: fetch sequence_number for LINR51VD1
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,100)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,100) wrote 100
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 103
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=16
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50688 (0xC600)
>  smb_vwv[ 3]=  373 (0x175)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044)
>  Bind RPC Pipe[75c6]: \samr auth_type 3, auth_level 6
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647)
>  Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB  EF 00 01 23 45 67 89 AC  xW4.4... ...#Eg..
>  [010] 01 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650)
>  Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [010] 02 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:create_spnego_ntlmssp_auth_rpc_bind_req(982)
>  create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:create_spnego_ntlmssp_auth_rpc_bind_req(1005)
>  create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:
>[2008/01/31 14:06:50, 5] lib/util.c:dump_data(2283)
>  [000] 60 54 06 06 2B 06 01 05  05 02 A0 4A 30 48 A0 0E  `T..+... ...J0H..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 36  0...+... ..7....6
>  [020] 04 34 4E 54 4C 4D 53 53  50 00 01 00 00 00 35 82  .4NTLMSS P.....5.
>  [030] 08 60 09 00 09 00 20 00  00 00 0B 00 0B 00 29 00  .`.... . ......).
>  [040] 00 00 4C 49 4E 52 35 31  56 44 31 4C 49 4E 52 35  ..LINR51 VD1LINR5
>  [050] 31 36 34 56 53 31                                 164VS1 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 00a6
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0056
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 12345778
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : 1234
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : abcd
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : ef 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 01 23 45 67 89 ac 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000001
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=248
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=17
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  166 (0xA6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  166 (0xA6)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30150 (0x75C6)
>  smb_bcc=181
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0B 03 10 00 00 00 A6  00 56 00 08 00 00 00 B8  ........ .V......
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 78  ........ .......x
>  [030] 57 34 12 34 12 CD AB EF  00 01 23 45 67 89 AC 01  W4.4.... ..#Eg...
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00 09  06 00 00 01 00 00 00 60  .H`..... .......`
>  [060] 54 06 06 2B 06 01 05 05  02 A0 4A 30 48 A0 0E 30  T..+.... ..J0H..0
>  [070] 0C 06 0A 2B 06 01 04 01  82 37 02 02 0A A2 36 04  ...+.... .7....6.
>  [080] 34 4E 54 4C 4D 53 53 50  00 01 00 00 00 35 82 08  4NTLMSSP .....5..
>  [090] 60 09 00 09 00 20 00 00  00 0B 00 0B 00 29 00 00  `.... .. .....)..
>  [0A0] 00 4C 49 4E 52 35 31 56  44 31 4C 49 4E 52 35 31  .LINR51V D1LINR51
>  [0B0] 36 34 56 53 31                                    64VS1 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,252)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,252) wrote 252
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 381
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=381
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=17
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  325 (0x145)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  325 (0x145)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=326
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 45 01 F9 00 08 00 00  ........ .E......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00 09 06 08  00 01 00 00 00 A1 81 F6  `....... ........
>  [050] 30 81 F3 A0 03 0A 01 01  A1 0C 06 0A 2B 06 01 04  0....... ....+...
>  [060] 01 82 37 02 02 0A A2 81  DD 04 81 DA 4E 54 4C 4D  ..7..... ....NTLM
>  [070] 53 53 50 00 02 00 00 00  12 00 12 00 30 00 00 00  SSP..... ....0...
>  [080] 35 82 89 60 B7 B2 98 5F  A2 6A 34 A4 00 00 00 00  5..`..._ .j4.....
>  [090] 00 00 00 00 98 00 98 00  42 00 00 00 4C 00 49 00  ........ B...L.I.
>  [0A0] 4E 00 52 00 35 00 31 00  56 00 44 00 31 00 02 00  N.R.5.1. V.D.1...
>  [0B0] 12 00 4C 00 49 00 4E 00  52 00 35 00 31 00 56 00  ..L.I.N. R.5.1.V.
>  [0C0] 44 00 31 00 01 00 16 00  4C 00 49 00 4E 00 52 00  D.1..... L.I.N.R.
>  [0D0] 35 00 31 00 36 00 34 00  56 00 53 00 31 00 04 00  5.1.6.4. V.S.1...
>  [0E0] 22 00 6F 00 74 00 74 00  61 00 77 00 61 00 2E 00  ".o.t.t. a.w.a...
>  [0F0] 78 00 61 00 6E 00 64 00  72 00 6F 00 73 00 2E 00  x.a.n.d. r.o.s...
>  [100] 63 00 61 00 03 00 3A 00  6C 00 69 00 6E 00 72 00  c.a...:. l.i.n.r.
>  [110] 35 00 31 00 36 00 34 00  76 00 73 00 31 00 2E 00  5.1.6.4. v.s.1...
>  [120] 6F 00 74 00 74 00 61 00  77 00 61 00 2E 00 78 00  o.t.t.a. w.a...x.
>  [130] 61 00 6E 00 64 00 72 00  6F 00 73 00 2E 00 63 00  a.n.d.r. o.s...c.
>  [140] 61 00 00 00 00 00                                 a..... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=381
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=17
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  325 (0x145)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  325 (0x145)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=326
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 45 01 F9 00 08 00 00  ........ .E......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00 09 06 08  00 01 00 00 00 A1 81 F6  `....... ........
>  [050] 30 81 F3 A0 03 0A 01 01  A1 0C 06 0A 2B 06 01 04  0....... ....+...
>  [060] 01 82 37 02 02 0A A2 81  DD 04 81 DA 4E 54 4C 4D  ..7..... ....NTLM
>  [070] 53 53 50 00 02 00 00 00  12 00 12 00 30 00 00 00  SSP..... ....0...
>  [080] 35 82 89 60 B7 B2 98 5F  A2 6A 34 A4 00 00 00 00  5..`..._ .j4.....
>  [090] 00 00 00 00 98 00 98 00  42 00 00 00 4C 00 49 00  ........ B...L.I.
>  [0A0] 4E 00 52 00 35 00 31 00  56 00 44 00 31 00 02 00  N.R.5.1. V.D.1...
>  [0B0] 12 00 4C 00 49 00 4E 00  52 00 35 00 31 00 56 00  ..L.I.N. R.5.1.V.
>  [0C0] 44 00 31 00 01 00 16 00  4C 00 49 00 4E 00 52 00  D.1..... L.I.N.R.
>  [0D0] 35 00 31 00 36 00 34 00  56 00 53 00 31 00 04 00  5.1.6.4. V.S.1...
>  [0E0] 22 00 6F 00 74 00 74 00  61 00 77 00 61 00 2E 00  ".o.t.t. a.w.a...
>  [0F0] 78 00 61 00 6E 00 64 00  72 00 6F 00 73 00 2E 00  x.a.n.d. r.o.s...
>  [100] 63 00 61 00 03 00 3A 00  6C 00 69 00 6E 00 72 00  c.a...:. l.i.n.r.
>  [110] 35 00 31 00 36 00 34 00  76 00 73 00 31 00 2E 00  5.1.6.4. v.s.1...
>  [120] 6F 00 74 00 74 00 61 00  77 00 61 00 2E 00 78 00  o.t.t.a. w.a...x.
>  [130] 61 00 6E 00 64 00 72 00  6F 00 73 00 2E 00 63 00  a.n.d.r. o.s...c.
>  [140] 61 00 00 00 00 00                                 a..... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0145
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00f9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 325 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 returned 325 bytes.
>[2008/01/31 14:06:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081)
>  rpc_pipe_bind: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 bind request returned ok.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0145
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00f9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_ba 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 000053f0
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000018 smb_io_rpc_addr_str 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0018 len: 000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          001a str: \PIPE\lsass.
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000026 smb_io_rpc_results 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>          0028 num_results: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002c result     : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002e reason     : 0000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000030 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000030 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0030 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0034 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0036 data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0038 data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003a data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0040 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701)
>  check_bind_response: accepted!
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000044 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0044 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0045 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0046 auth_pad_len : 08
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0047 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0048 auth_context_id: 00000001
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1018)
>  Got challenge flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60898235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_CHAL_TARGET_INFO
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1040)
>  NTLMSSP: Set final flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1112)
>  NTLMSSP challenge set by NTLM2
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1113)
>  challenge is: 
>[2008/01/31 14:06:50, 5] lib/util.c:dump_data(2283)
>  [000] A0 03 27 DF D4 C6 58 FA                           ..'...X. 
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 011c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00cc
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 12345778
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : 1234
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : abcd
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : ef 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 01 23 45 67 89 ac 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000001
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=366
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=18
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  284 (0x11C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  284 (0x11C)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30150 (0x75C6)
>  smb_bcc=299
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0E 03 10 00 00 00 1C  01 CC 00 08 00 00 00 B8  ........ ........
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 78  ........ .......x
>  [030] 57 34 12 34 12 CD AB EF  00 01 23 45 67 89 AC 01  W4.4.... ..#Eg...
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00 09  06 00 00 01 00 00 00 A1  .H`..... ........
>  [060] 81 C9 30 81 C6 A2 81 C3  04 81 C0 4E 54 4C 4D 53  ..0..... ...NTLMS
>  [070] 53 50 00 03 00 00 00 18  00 18 00 40 00 00 00 18  SP...... ...@....
>  [080] 00 18 00 58 00 00 00 12  00 12 00 70 00 00 00 18  ...X.... ...p....
>  [090] 00 18 00 82 00 00 00 16  00 16 00 9A 00 00 00 10  ........ ........
>  [0A0] 00 10 00 B0 00 00 00 35  82 08 60 F3 26 AE 2C 3D  .......5 ..`.&.,=
>  [0B0] 35 AC A4 00 00 00 00 00  00 00 00 00 00 00 00 00  5....... ........
>  [0C0] 00 00 00 11 62 97 9B AB  1E 03 F8 1F 29 3E 8D BA  ....b... ....)>..
>  [0D0] DC F6 B8 08 F9 18 0A 0D  B1 9B 82 4C 00 49 00 4E  ........ ...L.I.N
>  [0E0] 00 52 00 35 00 31 00 56  00 44 00 31 00 4C 00 49  .R.5.1.V .D.1.L.I
>  [0F0] 00 4E 00 52 00 35 00 31  00 36 00 34 00 56 00 53  .N.R.5.1 .6.4.V.S
>  [100] 00 31 00 24 00 4C 00 49  00 4E 00 52 00 35 00 31  .1.$.L.I .N.R.5.1
>  [110] 00 36 00 34 00 56 00 53  00 31 00 EF 8A 21 5F 06  .6.4.V.S .1...!_.
>  [120] 73 CB F5 20 4F BF FE 52  67 B1 8A                 s.. O..R g..
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,370)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,370) wrote 370
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 129
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=129
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=18
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   73 (0x49)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   73 (0x49)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=74
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0F 03 10 00 00  00 49 00 09 00 08 00 00  ........ .I......
>  [010] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 01 00 00  ......S. ........
>  [020] 00 00 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [030] 00 2B 10 48 60 02 00 00  00 09 06 08 00 01 00 00  .+.H`... ........
>  [040] 00 A1 07 30 05 A0 03 0A  01 00                    ...0.... ..
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=129
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=18
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   73 (0x49)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   73 (0x49)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=74
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0F 03 10 00 00  00 49 00 09 00 08 00 00  ........ .I......
>  [010] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 01 00 00  ......S. ........
>  [020] 00 00 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [030] 00 2B 10 48 60 02 00 00  00 09 06 08 00 01 00 00  .+.H`... ........
>  [040] 00 A1 07 30 05 A0 03 0A  01 00                    ...0.... ..
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0049
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 73 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 returned 73 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0049
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000038 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0038 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0039 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003a auth_pad_len : 08
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      003c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_finish_spnego_ntlmssp_bind(2018)
>  rpc_finish_spnego_ntlmssp_bind: alter context request to remote machine LINR5164VS1 pipe \samr fnum 0x75c6.
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_ntlmssp_internal(2369)
>  cli_rpc_pipe_open_ntlmssp_internal: opened pipe \samr to machine LINR5164VS1 andbound NTLMSSP as user LINR51VD1\LINR5164VS1$.
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:cm_connect_sam(1723)
>  cm_connect_sam: connected to SAMR pipe for domain LINR51VD1 using NTLMSSP authenticated pipe: user LINR51VD1\LINR5164VS1$
>[2008/01/31 14:06:50, 10] rpc_client/cli_samr.c:rpccli_samr_connect(36)
>  cli_samr_connect to LINR5164VS1
>[2008/01/31 14:06:50, 5] rpc_parse/parse_samr.c:init_samr_q_connect(7005)
>  init_samr_q_connect
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_q_connect 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr_srv_name: 00000001
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000004 smb_io_unistr2 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0004 uni_max_len: 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0008 offset     : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          000c uni_str_len: 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942)
>          0010 buffer     : L.I.N.R.5.1.6.4.V.S.1...
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0028 access_mask: 02000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0060
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000002c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0039
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=178
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=19
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   96 (0x60)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   96 (0x60)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30150 (0x75C6)
>  smb_bcc=111
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 60  00 10 00 09 00 00 00 2C  .......` .......,
>  [020] 00 00 00 00 00 39 00 D7  64 D2 4D BC 87 10 1E 1B  .....9.. d.M.....
>  [030] 9B 7D 7E A2 7C 87 C3 2E  6D 60 47 4E 0B AD 94 43  .}~.|... m`GN...C
>  [040] B5 FC 85 D2 89 E4 4B FA  76 CB 0B C0 C7 E8 53 16  ......K. v.....S.
>  [050] B0 BF 98 8D 33 56 FE 09  06 04 00 01 00 00 00 01  ....3V.. ........
>  [060] 00 00 00 4D 52 05 C3 56  A4 BD 82 00 00 00 00     ...MR..V .......
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,182)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,182) wrote 182
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 128
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=19
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 09 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 CC 51 12 05 7C 50 57  ........ ..Q..|PW
>  [020] 1C 5D 88 DC A4 9B AC 50  B9 B1 91 E4 F8 30 57 BF  .].....P .....0W.
>  [030] 18 09 06 00 00 01 00 00  00 01 00 00 00 CF F3 B2  ........ ........
>  [040] 25 75 6B F9 BE 00 00 00  00                       %uk..... .
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=19
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 09 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 CC 51 12 05 7C 50 57  ........ ..Q..|PW
>  [020] 1C 5D 88 DC A4 9B AC 50  B9 B1 91 E4 F8 30 57 BF  .].....P .....0W.
>  [030] 18 09 06 00 00 01 00 00  00 01 00 00 00 CF F3 B2  ........ ........
>  [040] 25 75 6B F9 BE 00 00 00  00                       %uk..... .
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 00000009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000030 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0030 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0031 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0032 auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0033 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0034 auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 72, data_len 24, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 72 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 returned 48 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_r_connect 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd connect_pol
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000003
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0014 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 10] rpc_client/cli_samr.c:rpccli_samr_open_domain(149)
>  cli_samr_open_domain with sid S-1-5-21-1571743125-4059523603-2995468692
>[2008/01/31 14:06:50, 5] rpc_parse/parse_samr.c:init_samr_q_open_domain(248)
>  samr_init_samr_q_open_domain
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_q_open_domain 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd pol
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000003
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0014 flags: 02000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000018 smb_io_dom_sid2 sid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0018 num_auths: 00000004
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          00001c smb_io_dom_sid sid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              001c sid_rev_num: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              001d num_auths  : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              001e id_auth[0] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              001f id_auth[1] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0020 id_auth[2] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0021 id_auth[3] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0022 id_auth[4] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0023 id_auth[5] : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32s(997)
>              0024 sub_auths : 00000015 5daee595 f1f76a13 b28b3994 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0068
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000034
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0007
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000050 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0050 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0051 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0052 auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0053 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0054 auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=186
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=20
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  104 (0x68)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  104 (0x68)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30150 (0x75C6)
>  smb_bcc=119
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 68  00 10 00 0A 00 00 00 34  .......h .......4
>  [020] 00 00 00 00 00 07 00 12  03 47 91 58 17 25 95 E2  ........ .G.X.%..
>  [030] 24 EE 79 A6 8B B8 6E 55  E5 B2 4C D4 21 35 15 08  $.y...nU ..L.!5..
>  [040] B2 88 46 AF 0D 55 97 72  30 AC AA F7 FF 25 AE 26  ..F..U.r 0....%.&
>  [050] C2 7C 0A FB 8C 82 5C F8  9E 69 9D 2D F1 F5 C1 09  .|....\. .i.-....
>  [060] 06 04 00 01 00 00 00 01  00 00 00 4C 28 EC 72 A5  ........ ...L(.r.
>  [070] 63 39 64 01 00 00 00                              c9d.... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,190)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,190) wrote 190
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 128
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=20
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 0A 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 52 6C 2C EC 95 28 14  ........ .Rl,..(.
>  [020] 9A 27 A2 69 73 74 DA 57  B8 5B 21 0E B9 F4 44 EC  .'.ist.W .[!...D.
>  [030] 33 09 06 00 00 01 00 00  00 01 00 00 00 61 FD EB  3....... .....a..
>  [040] 52 D0 E6 4D EE 01 00 00  00                       R..M.... .
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=20
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 0A 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 52 6C 2C EC 95 28 14  ........ .Rl,..(.
>  [020] 9A 27 A2 69 73 74 DA 57  B8 5B 21 0E B9 F4 44 EC  .'.ist.W .[!...D.
>  [030] 33 09 06 00 00 01 00 00  00 01 00 00 00 61 FD EB  3....... .....a..
>  [040] 52 D0 E6 4D EE 01 00 00  00                       R..M.... .
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000030 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0030 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0031 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0032 auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0033 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0034 auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 72, data_len 24, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 72 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 returned 48 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_r_open_domain 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd domain_pol
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000004
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0014 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 10] rpc_client/cli_samr.c:rpccli_samr_query_dom_info(1102)
>  cli_samr_query_dom_info
>[2008/01/31 14:06:50, 5] rpc_parse/parse_samr.c:init_samr_q_query_domain_info(467)
>  samr_init_samr_q_query_domain_info
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_q_query_domain_info 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd domain_pol
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000004
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 switch_value: 0008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000016
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0008
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000030 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0030 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0031 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0032 auth_pad_len : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0033 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0034 auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=154
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=21
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   72 (0x48)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30150 (0x75C6)
>  smb_bcc=87
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 48  00 10 00 0B 00 00 00 16  .......H ........
>  [020] 00 00 00 00 00 08 00 52  77 C9 D4 2D E5 21 46 E2  .......R w..-.!F.
>  [030] F7 8A 76 AB BB 40 B2 29  97 00 4F 83 AC 50 C0 09  ..v..@.) ..O..P..
>  [040] 06 02 00 01 00 00 00 01  00 00 00 CB D2 44 05 0C  ........ .....D..
>  [050] BD 35 47 02 00 00 00                              .5G.... 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,158)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,158) wrote 158
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 136
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=136
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=21
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   80 (0x50)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=81
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 50 00 10 00 0B 00 00  ........ .P......
>  [010] 00 1C 00 00 00 00 00 00  00 4D 14 BB A1 CA B7 0F  ........ .M......
>  [020] AF 47 DF 9D B1 9F A6 EB  A9 DC 9A E9 AD 53 10 BD  .G...... .....S..
>  [030] 88 29 46 D6 5E 50 84 FD  36 09 06 04 00 01 00 00  .)F.^P.. 6.......
>  [040] 00 01 00 00 00 1D E4 E4  0E 99 A4 5F 4A 02 00 00  ........ ..._J...
>  [050] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=136
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=21
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   80 (0x50)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=81
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 50 00 10 00 0B 00 00  ........ .P......
>  [010] 00 1C 00 00 00 00 00 00  00 4D 14 BB A1 CA B7 0F  ........ .M......
>  [020] AF 47 DF 9D B1 9F A6 EB  A9 DC 9A E9 AD 53 10 BD  .G...... .....S..
>  [030] 88 29 46 D6 5E 50 84 FD  36 09 06 04 00 01 00 00  .)F.^P.. 6.......
>  [040] 00 01 00 00 00 1D E4 E4  0E 99 A4 5F 4A 02 00 00  ........ ..._J...
>  [050] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0050
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000001c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000038 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0038 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0039 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      003c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 80, data_len 28, ss_len 4
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 80 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \samr fnum 0x75c6 returned 56 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 samr_io_r_query_domain_info 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr_0 : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0004 switch_value: 0008
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000008 sam_io_unk_info8 unk_inf8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0008 seq_num: 47a21c4a
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              000c seq_num: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000010 smb_io_time domain_create_time
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0010 low : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0014 high: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0018 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_rpc.c:sequence_number(882)
>  domain_sequence_number: for domain LINR51VD1 is 1201806410
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:store_cache_seqnum(435)
>  store_cache_seqnum: success [LINR51VD1][1201806410 @ 1201806410]
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:refresh_sequence_number(499)
>  refresh_sequence_number: LINR51VD1 seq number is now 1201806410
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:trusted_domains(1989)
>  trusted_domains: [Cached] - doing backend query for info for domain LINR51VD1
>[2008/01/31 14:06:50, 3] nsswitch/winbindd_rpc.c:trusted_domains(909)
>  rpc: trusted_domains
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,104)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,104) wrote 104
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 103
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=103
>  smb_com=0xa2
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=22
>  smt_wct=34
>  smb_vwv[ 0]=  255 (0xFF)
>  smb_vwv[ 1]=    0 (0x0)
>  smb_vwv[ 2]=50944 (0xC700)
>  smb_vwv[ 3]=  373 (0x175)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=    0 (0x0)
>  smb_vwv[11]=    0 (0x0)
>  smb_vwv[12]=    0 (0x0)
>  smb_vwv[13]=    0 (0x0)
>  smb_vwv[14]=    0 (0x0)
>  smb_vwv[15]=    0 (0x0)
>  smb_vwv[16]=    0 (0x0)
>  smb_vwv[17]=    0 (0x0)
>  smb_vwv[18]=    0 (0x0)
>  smb_vwv[19]=    0 (0x0)
>  smb_vwv[20]=    0 (0x0)
>  smb_vwv[21]=32768 (0x8000)
>  smb_vwv[22]=    0 (0x0)
>  smb_vwv[23]=    0 (0x0)
>  smb_vwv[24]=    0 (0x0)
>  smb_vwv[25]=    0 (0x0)
>  smb_vwv[26]=    0 (0x0)
>  smb_vwv[27]=    0 (0x0)
>  smb_vwv[28]=    0 (0x0)
>  smb_vwv[29]=    0 (0x0)
>  smb_vwv[30]=    0 (0x0)
>  smb_vwv[31]=  512 (0x200)
>  smb_vwv[32]=65280 (0xFF00)
>  smb_vwv[33]=    5 (0x5)
>  smb_bcc=0
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_pipe_bind(2044)
>  Bind RPC Pipe[75c7]: \lsarpc auth_type 3, auth_level 6
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1647)
>  Bind Abstract Syntax: [000] 78 57 34 12 34 12 CD AB  EF 00 01 23 45 67 89 AB  xW4.4... ...#Eg..
>  [010] 00 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:valid_pipe_name(1650)
>  Bind Transfer Syntax: [000] 04 5D 88 8A EB 1C C9 11  9F E8 08 00 2B 10 48 60  .]...... ....+.H`
>  [010] 02 00 00 00                                       .... 
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:create_spnego_ntlmssp_auth_rpc_bind_req(982)
>  create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:create_spnego_ntlmssp_auth_rpc_bind_req(1005)
>  create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:
>[2008/01/31 14:06:50, 5] lib/util.c:dump_data(2283)
>  [000] 60 54 06 06 2B 06 01 05  05 02 A0 4A 30 48 A0 0E  `T..+... ...J0H..
>  [010] 30 0C 06 0A 2B 06 01 04  01 82 37 02 02 0A A2 36  0...+... ..7....6
>  [020] 04 34 4E 54 4C 4D 53 53  50 00 01 00 00 00 35 82  .4NTLMSS P.....5.
>  [030] 08 60 09 00 09 00 20 00  00 00 0B 00 0B 00 29 00  .`.... . ......).
>  [040] 00 00 4C 49 4E 52 35 31  56 44 31 4C 49 4E 52 35  ..LINR51 VD1LINR5
>  [050] 31 36 34 56 53 31                                 164VS1 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0b
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 00a6
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0056
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 12345778
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : 1234
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : abcd
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : ef 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 01 23 45 67 89 ab 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=248
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=23
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  166 (0xA6)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  166 (0xA6)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30151 (0x75C7)
>  smb_bcc=181
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0B 03 10 00 00 00 A6  00 56 00 0C 00 00 00 B8  ........ .V......
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 78  ........ .......x
>  [030] 57 34 12 34 12 CD AB EF  00 01 23 45 67 89 AB 00  W4.4.... ..#Eg...
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00 09  06 00 00 01 00 00 00 60  .H`..... .......`
>  [060] 54 06 06 2B 06 01 05 05  02 A0 4A 30 48 A0 0E 30  T..+.... ..J0H..0
>  [070] 0C 06 0A 2B 06 01 04 01  82 37 02 02 0A A2 36 04  ...+.... .7....6.
>  [080] 34 4E 54 4C 4D 53 53 50  00 01 00 00 00 35 82 08  4NTLMSSP .....5..
>  [090] 60 09 00 09 00 20 00 00  00 0B 00 0B 00 29 00 00  `.... .. .....)..
>  [0A0] 00 4C 49 4E 52 35 31 56  44 31 4C 49 4E 52 35 31  .LINR51V D1LINR51
>  [0B0] 36 34 56 53 31                                    64VS1 
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,252)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,252) wrote 252
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 381
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=381
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=23
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  325 (0x145)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  325 (0x145)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=326
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 45 01 F9 00 0C 00 00  ........ .E......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00 09 06 08  00 01 00 00 00 A1 81 F6  `....... ........
>  [050] 30 81 F3 A0 03 0A 01 01  A1 0C 06 0A 2B 06 01 04  0....... ....+...
>  [060] 01 82 37 02 02 0A A2 81  DD 04 81 DA 4E 54 4C 4D  ..7..... ....NTLM
>  [070] 53 53 50 00 02 00 00 00  12 00 12 00 30 00 00 00  SSP..... ....0...
>  [080] 35 82 89 60 79 01 77 0A  4D 00 B5 BB 00 00 00 00  5..`y.w. M.......
>  [090] 00 00 00 00 98 00 98 00  42 00 00 00 4C 00 49 00  ........ B...L.I.
>  [0A0] 4E 00 52 00 35 00 31 00  56 00 44 00 31 00 02 00  N.R.5.1. V.D.1...
>  [0B0] 12 00 4C 00 49 00 4E 00  52 00 35 00 31 00 56 00  ..L.I.N. R.5.1.V.
>  [0C0] 44 00 31 00 01 00 16 00  4C 00 49 00 4E 00 52 00  D.1..... L.I.N.R.
>  [0D0] 35 00 31 00 36 00 34 00  56 00 53 00 31 00 04 00  5.1.6.4. V.S.1...
>  [0E0] 22 00 6F 00 74 00 74 00  61 00 77 00 61 00 2E 00  ".o.t.t. a.w.a...
>  [0F0] 78 00 61 00 6E 00 64 00  72 00 6F 00 73 00 2E 00  x.a.n.d. r.o.s...
>  [100] 63 00 61 00 03 00 3A 00  6C 00 69 00 6E 00 72 00  c.a...:. l.i.n.r.
>  [110] 35 00 31 00 36 00 34 00  76 00 73 00 31 00 2E 00  5.1.6.4. v.s.1...
>  [120] 6F 00 74 00 74 00 61 00  77 00 61 00 2E 00 78 00  o.t.t.a. w.a...x.
>  [130] 61 00 6E 00 64 00 72 00  6F 00 73 00 2E 00 63 00  a.n.d.r. o.s...c.
>  [140] 61 00 00 00 00 00                                 a..... 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=381
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=23
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  325 (0x145)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  325 (0x145)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=326
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0C 03 10 00 00  00 45 01 F9 00 0C 00 00  ........ .E......
>  [010] 00 B8 10 B8 10 F0 53 00  00 0C 00 5C 50 49 50 45  ......S. ...\PIPE
>  [020] 5C 6C 73 61 73 73 00 00  00 01 00 00 00 00 00 00  \lsass.. ........
>  [030] 00 04 5D 88 8A EB 1C C9  11 9F E8 08 00 2B 10 48  ..]..... .....+.H
>  [040] 60 02 00 00 00 09 06 08  00 01 00 00 00 A1 81 F6  `....... ........
>  [050] 30 81 F3 A0 03 0A 01 01  A1 0C 06 0A 2B 06 01 04  0....... ....+...
>  [060] 01 82 37 02 02 0A A2 81  DD 04 81 DA 4E 54 4C 4D  ..7..... ....NTLM
>  [070] 53 53 50 00 02 00 00 00  12 00 12 00 30 00 00 00  SSP..... ....0...
>  [080] 35 82 89 60 79 01 77 0A  4D 00 B5 BB 00 00 00 00  5..`y.w. M.......
>  [090] 00 00 00 00 98 00 98 00  42 00 00 00 4C 00 49 00  ........ B...L.I.
>  [0A0] 4E 00 52 00 35 00 31 00  56 00 44 00 31 00 02 00  N.R.5.1. V.D.1...
>  [0B0] 12 00 4C 00 49 00 4E 00  52 00 35 00 31 00 56 00  ..L.I.N. R.5.1.V.
>  [0C0] 44 00 31 00 01 00 16 00  4C 00 49 00 4E 00 52 00  D.1..... L.I.N.R.
>  [0D0] 35 00 31 00 36 00 34 00  56 00 53 00 31 00 04 00  5.1.6.4. V.S.1...
>  [0E0] 22 00 6F 00 74 00 74 00  61 00 77 00 61 00 2E 00  ".o.t.t. a.w.a...
>  [0F0] 78 00 61 00 6E 00 64 00  72 00 6F 00 73 00 2E 00  x.a.n.d. r.o.s...
>  [100] 63 00 61 00 03 00 3A 00  6C 00 69 00 6E 00 72 00  c.a...:. l.i.n.r.
>  [110] 35 00 31 00 36 00 34 00  76 00 73 00 31 00 2E 00  5.1.6.4. v.s.1...
>  [120] 6F 00 74 00 74 00 61 00  77 00 61 00 2E 00 78 00  o.t.t.a. w.a...x.
>  [130] 61 00 6E 00 64 00 72 00  6F 00 73 00 2E 00 63 00  a.n.d.r. o.s...c.
>  [140] 61 00 00 00 00 00                                 a..... 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0145
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00f9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 325 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 returned 325 bytes.
>[2008/01/31 14:06:50, 3] rpc_client/cli_pipe.c:rpc_pipe_bind(2081)
>  rpc_pipe_bind: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 bind request returned ok.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0145
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00f9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_ba 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 000053f0
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000018 smb_io_rpc_addr_str 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0018 len: 000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>          001a str: \PIPE\lsass.
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000026 smb_io_rpc_results 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>          0028 num_results: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002c result     : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          002e reason     : 0000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000030 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000030 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0030 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0034 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0036 data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0038 data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003a data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0040 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:check_bind_response(1701)
>  check_bind_response: accepted!
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000044 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0044 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0045 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0046 auth_pad_len : 08
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0047 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0048 auth_context_id: 00000001
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1018)
>  Got challenge flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60898235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_CHAL_TARGET_INFO
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:ntlmssp_client_challenge(1040)
>  NTLMSSP: Set final flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1112)
>  NTLMSSP challenge set by NTLM2
>[2008/01/31 14:06:50, 5] libsmb/ntlmssp.c:ntlmssp_client_challenge(1113)
>  challenge is: 
>[2008/01/31 14:06:50, 5] lib/util.c:dump_data(2283)
>  [000] 96 30 65 95 DC 59 E0 F3                           .0e..Y.. 
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp_sign.c:ntlmssp_sign_init(338)
>  NTLMSSP Sign/Seal - Initialising with flags:
>[2008/01/31 14:06:50, 3] libsmb/ntlmssp.c:debug_ntlmssp_flags(63)
>  Got NTLMSSP neg_flags=0x60088235
>    NTLMSSP_NEGOTIATE_UNICODE
>    NTLMSSP_REQUEST_TARGET
>    NTLMSSP_NEGOTIATE_SIGN
>    NTLMSSP_NEGOTIATE_SEAL
>    NTLMSSP_NEGOTIATE_NTLM
>    NTLMSSP_NEGOTIATE_ALWAYS_SIGN
>    NTLMSSP_NEGOTIATE_NTLM2
>    NTLMSSP_NEGOTIATE_128
>    NTLMSSP_NEGOTIATE_KEY_EXCH
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 011c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 00cc
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_rb 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000010 smb_io_rpc_hdr_bba 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0010 max_tsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>          0012 max_rsize: 10b8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 assoc_gid: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0018 num_contexts: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      001c context_id  : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      001e num_transfer_syntaxes: 01
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00001f smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 data   : 12345778
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 data   : 1234
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0026 data   : abcd
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              0028 data   : ef 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              002a data   : 01 23 45 67 89 ab 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0030 version: 00000000
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000034 smb_io_rpc_iface 
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000034 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0034 data   : 8a885d04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0038 data   : 1ceb
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              003a data   : 11c9
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003c data   : 9f e8 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              003e data   : 08 00 2b 10 48 60 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0044 version: 00000002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=366
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=24
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  284 (0x11C)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=  284 (0x11C)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30151 (0x75C7)
>  smb_bcc=299
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 0E 03 10 00 00 00 1C  01 CC 00 0C 00 00 00 B8  ........ ........
>  [020] 10 B8 10 00 00 00 00 01  00 00 00 00 00 01 00 78  ........ .......x
>  [030] 57 34 12 34 12 CD AB EF  00 01 23 45 67 89 AB 00  W4.4.... ..#Eg...
>  [040] 00 00 00 04 5D 88 8A EB  1C C9 11 9F E8 08 00 2B  ....]... .......+
>  [050] 10 48 60 02 00 00 00 09  06 00 00 01 00 00 00 A1  .H`..... ........
>  [060] 81 C9 30 81 C6 A2 81 C3  04 81 C0 4E 54 4C 4D 53  ..0..... ...NTLMS
>  [070] 53 50 00 03 00 00 00 18  00 18 00 40 00 00 00 18  SP...... ...@....
>  [080] 00 18 00 58 00 00 00 12  00 12 00 70 00 00 00 18  ...X.... ...p....
>  [090] 00 18 00 82 00 00 00 16  00 16 00 9A 00 00 00 10  ........ ........
>  [0A0] 00 10 00 B0 00 00 00 35  82 08 60 C1 3B 1F 11 7A  .......5 ..`.;..z
>  [0B0] E7 33 64 00 00 00 00 00  00 00 00 00 00 00 00 00  .3d..... ........
>  [0C0] 00 00 00 E2 80 1C 28 98  FA B5 37 65 95 82 AF 08  ......(. ..7e....
>  [0D0] F0 D4 75 B4 FC F8 BE D4  C3 91 70 4C 00 49 00 4E  ..u..... ..pL.I.N
>  [0E0] 00 52 00 35 00 31 00 56  00 44 00 31 00 4C 00 49  .R.5.1.V .D.1.L.I
>  [0F0] 00 4E 00 52 00 35 00 31  00 36 00 34 00 56 00 53  .N.R.5.1 .6.4.V.S
>  [100] 00 31 00 24 00 4C 00 49  00 4E 00 52 00 35 00 31  .1.$.L.I .N.R.5.1
>  [110] 00 36 00 34 00 56 00 53  00 31 00 EB 9C 02 97 08  .6.4.V.S .1......
>  [120] 7D 1D B1 82 DB 2D 58 B3  EF C0 7A                 }....-X. ..z
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,370)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,370) wrote 370
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 129
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=129
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=24
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   73 (0x49)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   73 (0x49)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=74
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0F 03 10 00 00  00 49 00 09 00 0C 00 00  ........ .I......
>  [010] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 01 00 00  ......S. ........
>  [020] 00 00 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [030] 00 2B 10 48 60 02 00 00  00 09 06 08 00 01 00 00  .+.H`... ........
>  [040] 00 A1 07 30 05 A0 03 0A  01 00                    ...0.... ..
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=129
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=24
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   73 (0x49)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   73 (0x49)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=74
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 0F 03 10 00 00  00 49 00 09 00 0C 00 00  ........ .I......
>  [010] 00 B8 10 B8 10 F0 53 00  00 01 00 00 00 01 00 00  ......S. ........
>  [020] 00 00 00 00 00 04 5D 88  8A EB 1C C9 11 9F E8 08  ......]. ........
>  [030] 00 2B 10 48 60 02 00 00  00 09 06 08 00 01 00 00  .+.H`... ........
>  [040] 00 A1 07 30 05 A0 03 0A  01 00                    ...0.... ..
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0049
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 73 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 returned 73 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 0f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0049
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000038 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0038 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0039 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003a auth_pad_len : 08
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      003c auth_context_id: 00000001
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_finish_spnego_ntlmssp_bind(2018)
>  rpc_finish_spnego_ntlmssp_bind: alter context request to remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7.
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_rpc_pipe_open_ntlmssp_internal(2369)
>  cli_rpc_pipe_open_ntlmssp_internal: opened pipe \lsarpc to machine LINR5164VS1 andbound NTLMSSP as user LINR51VD1\LINR5164VS1$.
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cm.c:cm_connect_lsa(1855)
>  cm_connect_lsa: connected to LSA pipe for domain LINR51VD1 using NTLMSSP authenticated pipe: user LINR51VD1\LINR5164VS1$
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_sec_qos(185)
>  init_lsa_sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_open_pol(304)
>  init_open_pol: attr:0 da:33554432
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_lsa_obj_attr(236)
>  init_lsa_obj_attr
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_open_pol 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 ptr       : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0004 system_name: 005c
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000008 lsa_io_obj_attr 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0008 len         : 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          000c ptr_root_dir: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0010 ptr_obj_name: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0014 attributes  : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0018 ptr_sec_desc: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          001c ptr_sec_qos : 00000001
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000020 lsa_io_obj_qos sec_qos
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0020 len           : 0000000c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0024 sec_imp_level : 0002
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0026 sec_ctxt_mode : 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>              0027 effective_only: 00
>[2008/01/31 14:06:50, 3] rpc_parse/parse_lsa.c:lsa_io_sec_qos(224)
>  lsa_io_sec_qos: length c does not match size 8
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0028 des_access: 02000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0060
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000d
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000002c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 0006
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000048 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0048 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0049 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      004b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      004c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=178
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=25
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   96 (0x60)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   96 (0x60)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30151 (0x75C7)
>  smb_bcc=111
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 60  00 10 00 0D 00 00 00 2C  .......` .......,
>  [020] 00 00 00 00 00 06 00 C5  77 AD C7 EF E2 15 D1 D2  ........ w.......
>  [030] 50 4E F6 B7 65 35 34 5A  0C 99 53 8B 1B 24 08 09  PN..e54Z ..S..$..
>  [040] 38 6E 5F 03 B9 E9 4A A5  19 28 83 1A 7F 8A C8 8E  8n_...J. .(......
>  [050] B0 9E B1 78 B6 6E 9E 09  06 04 00 01 00 00 00 01  ...x.n.. ........
>  [060] 00 00 00 68 5D 89 F4 67  A8 4A A2 00 00 00 00     ...h]..g .J.....
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,182)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,182) wrote 182
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 128
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=25
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 0D 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 2A 48 70 3D CF C0 82  ........ .*Hp=...
>  [020] 98 4F 64 CB CE 9B 1E AC  D6 9F 80 EB BE 54 2C 83  .Od..... .....T,.
>  [030] B0 09 06 00 00 01 00 00  00 01 00 00 00 CA 99 89  ........ ........
>  [040] 1F ED 2C F3 07 00 00 00  00                       ..,..... .
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=128
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=25
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   72 (0x48)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   72 (0x48)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=73
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 48 00 10 00 0D 00 00  ........ .H......
>  [010] 00 18 00 00 00 00 00 00  00 2A 48 70 3D CF C0 82  ........ .*Hp=...
>  [020] 98 4F 64 CB CE 9B 1E AC  D6 9F 80 EB BE 54 2C 83  .Od..... .....T,.
>  [030] B0 09 06 00 00 01 00 00  00 01 00 00 00 CA 99 89  ........ ........
>  [040] 1F ED 2C F3 07 00 00 00  00                       ..,..... .
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0048
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000d
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000018
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000030 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0030 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0031 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0032 auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0033 auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0034 auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 72, data_len 24, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 72 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 returned 48 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_open_pol 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0014 status: NT_STATUS_OK
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_enum_trust_dom(520)
>  init_q_enum_trust_dom
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_enum_trust_dom 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0014 enum_context : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0018 preferred_len: 00010000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0050
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000001c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 000d
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000038 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0038 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0039 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      003c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=162
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=26
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   80 (0x50)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30151 (0x75C7)
>  smb_bcc=95
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 50  00 10 00 0E 00 00 00 1C  .......P ........
>  [020] 00 00 00 00 00 0D 00 F4  19 65 BA 35 04 F9 F4 F1  ........ .e.5....
>  [030] 66 16 65 9C FE 3D 98 E3  37 B0 82 22 6E FA 32 F5  f.e..=.. 7.."n.2.
>  [040] 03 66 D8 58 9E 57 04 09  06 04 00 01 00 00 00 01  .f.X.W.. ........
>  [050] 00 00 00 F0 40 0D 3C 94  34 C1 8C 01 00 00 00     ....@.<. 4......
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,166)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,166) wrote 166
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 200
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=200
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=26
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  144 (0x90)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  144 (0x90)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=145
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 90 00 10 00 0E 00 00  ........ ........
>  [010] 00 5C 00 00 00 00 00 00  00 FF E5 33 67 85 EB A7  .\...... ...3g...
>  [020] 72 65 18 4C 28 67 98 8C  FE EC 08 67 6B B0 3E 91  re.L(g.. ...gk.>.
>  [030] 5A F8 3E DA 4E 2E 16 6E  DD 45 ED C0 E8 9E EE 9D  Z.>.N..n .E......
>  [040] 5B AE 38 AA 17 04 33 BB  17 61 B2 F5 F8 49 AA 1D  [.8...3. .a...I..
>  [050] DA A9 4A CD 0F 31 AB 7E  3D 65 0D 45 9A 74 49 22  ..J..1.~ =e.E.tI"
>  [060] 9C 80 8C BB 08 07 65 E5  8F 52 74 6C 2A CC 62 EA  ......e. .Rtl*.b.
>  [070] 9C 49 11 58 B9 3D D2 1F  9A 09 06 04 00 01 00 00  .I.X.=.. ........
>  [080] 00 01 00 00 00 98 5F F1  3E E1 10 70 71 01 00 00  ......_. >..pq...
>  [090] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=200
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=26
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=  144 (0x90)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=  144 (0x90)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=145
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 90 00 10 00 0E 00 00  ........ ........
>  [010] 00 5C 00 00 00 00 00 00  00 FF E5 33 67 85 EB A7  .\...... ...3g...
>  [020] 72 65 18 4C 28 67 98 8C  FE EC 08 67 6B B0 3E 91  re.L(g.. ...gk.>.
>  [030] 5A F8 3E DA 4E 2E 16 6E  DD 45 ED C0 E8 9E EE 9D  Z.>.N..n .E......
>  [040] 5B AE 38 AA 17 04 33 BB  17 61 B2 F5 F8 49 AA 1D  [.8...3. .a...I..
>  [050] DA A9 4A CD 0F 31 AB 7E  3D 65 0D 45 9A 74 49 22  ..J..1.~ =e.E.tI"
>  [060] 9C 80 8C BB 08 07 65 E5  8F 52 74 6C 2A CC 62 EA  ......e. .Rtl*.b.
>  [070] 9C 49 11 58 B9 3D D2 1F  9A 09 06 04 00 01 00 00  .I.X.=.. ........
>  [080] 00 01 00 00 00 98 5F F1  3E E1 10 70 71 01 00 00  ......_. >..pq...
>  [090] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0090
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000e
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000005c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000078 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0078 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0079 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      007a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      007b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      007c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 144, data_len 92, ss_len 4
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 144 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 returned 184 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_enum_trust_dom 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 enum_context: 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0004 count: 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0008 ptr: f000baaa
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      00000c lsa_io_domain_list trusted_domains
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          000c count: 00000001
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000010 prs_unistr4_hdr name_header
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0010 length: 0012
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0012 size: 0012
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0014 ptr: f000baaa
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0018 dom_sid2_p: f000baaa
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          00001c prs_unistr4_str name
>[2008/01/31 14:06:50, 8] rpc_parse/parse_prs.c:prs_debug(84)
>              00001c smb_io_unistr2 name
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  001c uni_max_len: 00000009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  0020 offset     : 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>                  0024 uni_str_len: 00000009
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:dbg_rw_punival(942)
>                  0028 buffer     : W.I.N.Q.A.N.E.T.2.
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          00003a smb_io_dom_sid2 sid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              003c num_auths: 00000004
>[2008/01/31 14:06:50, 8] rpc_parse/parse_prs.c:prs_debug(84)
>              000040 smb_io_dom_sid sid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0040 sid_rev_num: 01
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0041 num_auths  : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0042 id_auth[0] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0043 id_auth[1] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0044 id_auth[2] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0045 id_auth[3] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0046 id_auth[4] : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>                  0047 id_auth[5] : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32s(997)
>                  0048 sub_auths : 00000015 0d12e74f 32f84639 bac308c2 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      0058 status: STATUS_MORE_ENTRIES
>[2008/01/31 14:06:50, 5] rpc_parse/parse_lsa.c:init_q_enum_trust_dom(520)
>  init_q_enum_trust_dom
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_q_enum_trust_dom 
>[2008/01/31 14:06:50, 6] rpc_parse/parse_prs.c:prs_debug(84)
>      000000 smb_io_pol_hnd 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>          0000 handle_type: 00000000
>[2008/01/31 14:06:50, 7] rpc_parse/parse_prs.c:prs_debug(84)
>          000004 smb_io_uuid uuid
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>              0004 data   : 00000005
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              0008 data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>              000a data   : 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000c data   : a2 47 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8s(857)
>              000e data   : 4a 1c 8e 11 00 00 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0014 enum_context : 00000001
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0018 preferred_len: 00010000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr hdr    
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0050
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_req hdr_req
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 0000001c
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0016 opnum     : 000d
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000038 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0038 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0039 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003a auth_pad_len : 04
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      003b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      003c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_seal_packet(249)
>  ntlmssp_seal_data: seal
>[2008/01/31 14:06:50, 5] rpc_client/cli_pipe.c:rpc_api_pipe(770)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=162
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=8
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=27
>  smt_wct=16
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   80 (0x50)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]= 4280 (0x10B8)
>  smb_vwv[ 4]=    0 (0x0)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=    0 (0x0)
>  smb_vwv[ 7]=    0 (0x0)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_vwv[10]=   82 (0x52)
>  smb_vwv[11]=   80 (0x50)
>  smb_vwv[12]=   82 (0x52)
>  smb_vwv[13]=    2 (0x2)
>  smb_vwv[14]=   38 (0x26)
>  smb_vwv[15]=30151 (0x75C7)
>  smb_bcc=95
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 5C 00 50 00 49 00 50  00 45 00 5C 00 00 00 05  .\.P.I.P .E.\....
>  [010] 00 00 03 10 00 00 00 50  00 10 00 0F 00 00 00 1C  .......P ........
>  [020] 00 00 00 00 00 0D 00 50  58 56 C3 FB 41 B2 07 52  .......P XV..A..R
>  [030] AC 4B 07 3E 74 9E 7B FA  04 14 ED 5E 46 0E 1D 43  .K.>t.{. ...^F..C
>  [040] 10 CA A1 27 CE 5F AC 09  06 04 00 01 00 00 00 01  ...'._.. ........
>  [050] 00 00 00 57 11 9C 28 CF  76 CB 4C 02 00 00 00     ...W..(. v.L....
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(153)
>  write_socket(17,166)
>[2008/01/31 14:06:50, 6] libsmb/clientgen.c:write_socket(156)
>  write_socket(17,166) wrote 166
>[2008/01/31 14:06:50, 10] lib/util_sock.c:read_smb_length_return_keepalive(623)
>  got smb length of 120
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=120
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=27
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   64 (0x40)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   64 (0x40)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=65
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 40 00 10 00 0F 00 00  ........ .@......
>  [010] 00 10 00 00 00 00 00 00  00 AC 90 F3 D3 AA 68 1E  ........ ......h.
>  [020] 02 A4 86 48 64 77 FF 75  74 09 06 00 00 01 00 00  ...Hdw.u t.......
>  [030] 00 01 00 00 00 20 5B 15  64 7F 68 36 B7 02 00 00  ..... [. d.h6....
>  [040] 00                                                . 
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(506)
>[2008/01/31 14:06:50, 5] lib/util.c:show_msg(516)
>  size=120
>  smb_com=0x25
>  smb_rcls=0
>  smb_reh=0
>  smb_err=0
>  smb_flg=136
>  smb_flg2=51201
>  smb_tid=1
>  smb_pid=4493
>  smb_uid=101
>  smb_mid=27
>  smt_wct=10
>  smb_vwv[ 0]=    0 (0x0)
>  smb_vwv[ 1]=   64 (0x40)
>  smb_vwv[ 2]=    0 (0x0)
>  smb_vwv[ 3]=    0 (0x0)
>  smb_vwv[ 4]=   56 (0x38)
>  smb_vwv[ 5]=    0 (0x0)
>  smb_vwv[ 6]=   64 (0x40)
>  smb_vwv[ 7]=   56 (0x38)
>  smb_vwv[ 8]=    0 (0x0)
>  smb_vwv[ 9]=    0 (0x0)
>  smb_bcc=65
>[2008/01/31 14:06:50, 10] lib/util.c:dump_data(2283)
>  [000] 00 05 00 02 03 10 00 00  00 40 00 10 00 0F 00 00  ........ .@......
>  [010] 00 10 00 00 00 00 00 00  00 AC 90 F3 D3 AA 68 1E  ........ ......h.
>  [020] 02 A4 86 48 64 77 FF 75  74 09 06 00 00 01 00 00  ...Hdw.u t.......
>  [030] 00 01 00 00 00 20 5B 15  64 7F 68 36 B7 02 00 00  ..... [. d.h6....
>  [040] 00                                                . 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 smb_io_rpc_hdr rpc_hdr   
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0000 major     : 05
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0001 minor     : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0002 pkt_type  : 02
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0003 flags     : 03
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0004 pack_type0: 10
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0005 pack_type1: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0006 pack_type2: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0007 pack_type3: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0008 frag_len  : 0040
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      000a auth_len  : 0010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      000c call_id   : 0000000f
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000010 smb_io_rpc_hdr_resp rpc_hdr_resp
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0010 alloc_hint: 00000010
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint16(681)
>      0014 context_id: 0000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0016 cancel_ct : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0017 reserved  : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000028 smb_io_rpc_hdr_auth hdr_auth
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0028 auth_type    : 09
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      0029 auth_level   : 06
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      002a auth_pad_len : 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint8(616)
>      002b auth_reserved: 00
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      002c auth_context_id: 00000001
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_unseal_packet(310)
>  ntlmssp_unseal_packet: seal
>[2008/01/31 14:06:50, 10] libsmb/ntlmssp_sign.c:ntlmssp_check_packet(223)
>  ntlmssp_check_packet: NTLMSSP signature OK !
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:cli_pipe_validate_current_pdu(577)
>  cli_pipe_validate_current_pdu: got pdu len 64, data_len 16, ss_len 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(843)
>  rpc_api_pipe: got PDU len of 64 at offset 0
>[2008/01/31 14:06:50, 10] rpc_client/cli_pipe.c:rpc_api_pipe(894)
>  rpc_api_pipe: Remote machine LINR5164VS1 pipe \lsarpc fnum 0x75c7 returned 32 bytes.
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_debug(84)
>  000000 lsa_io_r_enum_trust_dom 
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0000 enum_context: ffffffff
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0004 count: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_uint32(710)
>      0008 ptr: 00000000
>[2008/01/31 14:06:50, 5] rpc_parse/parse_prs.c:prs_ntstatus(769)
>      000c status: NT_STATUS_NO_MORE_ENTRIES
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:refresh_sequence_number(465)
>  refresh_sequence_number: LINR51VD1 time ok
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:refresh_sequence_number(499)
>  refresh_sequence_number: LINR51VD1 seq number is now 1201806410
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:cache_store_response(2259)
>  Storing response for pid 4493, len 3291
>[2008/01/31 14:06:50, 10] nsswitch/winbindd_cache.c:cache_store_response(2273)
>  Storing extra data: len=51

Actions: View

Attachments on bug 429024: 291892 | 291893 | 291897 | 291898 | 292014 | 292015 | 292202 | 292203 | 293489 | 293625 | 293626 | 295318 | 299950 | 300141