🚀 go-pugleaf

Wenn ich mich auf meiner Ente anmelde, startet der Linux-GW die Dial-up
verbindung mit diald. Ich hab mal ein tcpdump auf eth0 (richtig, oder?)
lauefn lassen um rauszufinden, wieso diald gestartet wird.

Ich hab das ganze unten angef�gt. Wenn ich mich aber nicht irre, sind
die relevanten (TCP/IP) Teile nur die folgenden:

21:24:17.116381 arp who-has Odo.Terok-Nor tell Sisko.Terok-Nor
21:24:17.116381 arp reply Odo.Terok-Nor is-at 0:c0:26:89:2d:67

Keine Ahnung, was diese beiden Zeilen bedeuten...

21:24:17.116381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request
21:24:18.226381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request
21:24:19.226381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request

ns02.datanetworks.ch ist (unteranderem?) einer meiner Newsserver. Wieso
startet die Ente eine DNS-Abfrage?

21:24:20.226381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request
21:24:21.256381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request
21:24:22.236381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request

Diese Zeilen find ich am interessantesten... Warum in aller Welt wird
Kontakt mit hotmail aufgenommen (Wir wissen ja alle, von wem NT4 SP4
hergestellt wird....)???

Werden da wohl wieder irgendwelche Spionagedaten �bertragen?

21:24:24.356381 Sisko.Terok-Nor.netbios-dgm > 192.168.0.255.netbios-dgm:

Nochmal eine Zeile, die ich nicht zuordnen kann...

Danke

Sven


-----------------------------------------------------------------------------------------

21:24:12.526381 Sisko.Terok-Nor.netbios-ns > 192.168.0.255.netbios-ns:
>>> NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
TrnID=0x80C0
OpCode=5
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=1
QuestionRecords:
Name=SVEN            NameType=0x03 (Client?)
QuestionType=
ResourceRecords:
Name=ResType=0x20
ResClass=0x1
TTL=-1072955360
ResourceLength=1
ResourceData=
[000] 00                                                .


21:24:13.266381 Sisko.Terok-Nor.netbios-ns > 192.168.0.255.netbios-ns:
>>> NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
TrnID=0x80C0
OpCode=5
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=1
QuestionRecords:
Name=SVEN            NameType=0x03 (Client?)
QuestionType=
ResourceRecords:
Name=ResType=0x20
ResClass=0x1
TTL=-1072955360
ResourceLength=1
ResourceData=
[000] 00                                                .


21:24:14.016381 Sisko.Terok-Nor.netbios-ns > 192.168.0.255.netbios-ns:
>>> NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
TrnID=0x80C0
OpCode=5
NmFlags=0x11
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=1
QuestionRecords:
Name=SVEN            NameType=0x03 (Client?)
QuestionType=
ResourceRecords:
Name=ResType=0x20
ResClass=0x1
TTL=-1072955360
ResourceLength=1
ResourceData=
[000] 00                                                .


21:24:14.776381 Sisko.Terok-Nor.netbios-ns > 192.168.0.255.netbios-ns:
>>> NBT UDP PACKET(137): REGISTRATION; REQUEST; BROADCAST
TrnID=0x80C0
OpCode=5
NmFlags=0x1
Rcode=0
QueryCount=1
AnswerCount=0
AuthorityCount=0
AddressRecCount=1
QuestionRecords:
Name=SVEN            NameType=0x03 (Client?)
QuestionType=
ResourceRecords:
Name=ResType=0x20
ResClass=0x1
TTL=-1072955360
ResourceLength=1
ResourceData=
[000] 00                                                .


21:24:17.116381 arp who-has Odo.Terok-Nor tell Sisko.Terok-Nor
21:24:17.116381 arp reply Odo.Terok-Nor is-at 0:c0:26:89:2d:67
21:24:17.116381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request
21:24:18.226381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request
21:24:19.226381 127.0.0.3 > ns02.datanetworks.ch: icmp: echo request
21:24:20.226381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request
21:24:21.256381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request
21:24:22.236381 127.0.0.3 > wya-www.hotmail.com: icmp: echo request
21:24:24.356381 Sisko.Terok-Nor.netbios-dgm > 192.168.0.255.netbios-dgm:

>>> NBT UDP PACKET(138) Res=0x1102 ID=0x80C2 IP=192.168.0.10 Port=138
Length=192 Res2=0x0
SourceName=SISKO           NameType=0x00 (Workstation)
DestName=
SMB PACKET: SMBunknown (REQUEST)
SMB Command   =  0x43
Error class   =  0x46
Error code    =  20550
Flags1        =  0x45
Flags2        =  0x4E
Tree ID       =  17990
Proc ID       =  18000
UID           =  16720
MID           =  16707
Word Count    =  66
SMBError = ERROR: Unknown error (70,20550)
smbvwv[]=
smb_vwv[0]=65280 (0xFF00)
smb_vwv[1]=19795 (0x4D53)
smb_vwv[2]=9538 (0x2542)
smb_vwv[3]=0 (0x0)
smb_vwv[4]=0 (0x0)
smb_vwv[5]=0 (0x0)
smb_vwv[6]=0 (0x0)
smb_vwv[7]=0 (0x0)
smb_vwv[8]=0 (0x0)
smb_vwv[9]=0 (0x0)
smb_vwv[10]=0 (0x0)
smb_vwv[11]=0 (0x0)
smb_vwv[12]=0 (0x0)
smb_vwv[13]=0 (0x0)
smb_vwv[14]=0 (0x0)
smb_vwv[15]=0 (0x0)
smb_vwv[16]=4352 (0x1100)
smb_vwv[17]=0 (0x0)
smb_vwv[18]=38 (0x26)
smb_vwv[19]=0 (0x0)
smb_vwv[20]=0 (0x0)
smb_vwv[21]=0 (0x0)
smb_vwv[22]=0 (0x0)
smb_vwv[23]=1000 (0x3E8)
smb_vwv[24]=0 (0x0)
smb_vwv[25]=0 (0x0)
smb_vwv[26]=0 (0x0)
smb_vwv[27]=0 (0x0)
smb_vwv[28]=38 (0x26)
smb_vwv[29]=86 (0x56)
smb_vwv[30]=3 (0x3)
smb_vwv[31]=1 (0x1)
smb_vwv[32]=1 (0x1)
smb_vwv[33]=2 (0x2)
smb_vwv[34]=55 (0x37)
smb_vwv[35]=19804 (0x4D5C)
smb_vwv[36]=18753 (0x4941)
smb_vwv[37]=21324 (0x534C)
smb_vwv[38]=20300 (0x4F4C)
smb_vwv[39]=23636 (0x5C54)
smb_vwv[40]=21058 (0x5242)
smb_vwv[41]=22351 (0x574F)
smb_vwv[42]=17747 (0x4553)
smb_vwv[43]=3072 (0xC00)
smb_vwv[44]=40960 (0xA000)
smb_vwv[45]=3515 (0xDBB)
smb_vwv[46]=21504 (0x5400)
smb_vwv[47]=21061 (0x5245)
smb_vwv[48]=19279 (0x4B4F)
smb_vwv[49]=20013 (0x4E2D)
smb_vwv[50]=21071 (0x524F)
smb_vwv[51]=3840 (0xF00)
smb_vwv[52]=57845 (0xE1F5)
smb_vwv[53]=16503 (0x4077)
smb_vwv[54]=929 (0x3A1)
smb_vwv[55]=10 (0xA)
smb_vwv[56]=16 (0x10)
smb_vwv[57]=2176 (0x880)
smb_vwv[58]=49919 (0xC2FF)
smb_vwv[59]=21249 (0x5301)
smb_vwv[60]=21321 (0x5349)
smb_vwv[61]=20299 (0x4F4B)
smb_vwv[62]=0 (0x0)
smb_vwv[63]=0 (0x0)
smb_vwv[64]=0 (0x0)
smb_vwv[65]=0 (0x0)
smb_bcc=0