I
Info
Hi,
2 W2000 domains on 2 sites (toto.in and child.toto.in)
Sites are connected with RNIS non permanent lines.
AD replication is OK acording to the planing in Sites & Services MMC.
But there are many connections between the domain controlers on the 2
sites...
Browser service is off (netbios off)
Network investigation indicates DNS registration every 7-8 minutes...
DNS is Active Directory based for each domain.
All DC are GCs
Help very appreciated !!
Bye
Xavier
---
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
1 19.078370 0050731A1481 000BCD2A2B40 DNS
0xBB
yn Upd UPD records to _ldap._tcp.gc._msdcs 10.208.201.1
10.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B53; Proto = UDP; Len: 128
UDP: Src Port: Unknown, (1557); Dst Port: DNS (53); Length = 108 (0x6C)
UDP: Source Port = 0x0615
UDP: Destination Port = DNS
UDP: Total length = 108 (0x6C) bytes
UDP: UDP Checksum = 0x77C5
UDP: Data: Number of data bytes remaining = 100 (0x0064)
DNS: 0xBByn Upd UPD records to _ldap._tcp.gc._msdcs.toto.in. of type Srv
Loc
DNS: Query Identifier = 187 (0xBB)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _ldap._tcp.gc._msdcs.toto.in. of type Srv Loc on class
INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 80 3B 53 00 00 7E 11 59 75 0A D0 C9 01 0A D1 .?;S..~.Yu.ÐÉ..Ñ
00020: C9 02 06 15 00 35 00 6C 77 C5 00 BB 28 00 00 01 É....5.lwÅ.»(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 05 5F 6C 64 61 70 04 5F 74 63 70 02 ....._ldap._tcp.
****************************************************************************
****************************************************************************
****
2 19.734628 0050731A1481 000BCD2A2B40 DNS
0xBDyn Upd UPD records to _gc._tcp.toto.in. o 10.208.201.1
10.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B56; Proto = UDP; Len: 116
UDP: Src Port: Unknown, (1559); Dst Port: DNS (53); Length = 96 (0x60)
UDP: Source Port = 0x0617
UDP: Destination Port = DNS
UDP: Total length = 96 (0x60) bytes
UDP: UDP Checksum = 0x92E6
UDP: Data: Number of data bytes remaining = 88 (0x0058)
DNS: 0xBDyn Upd UPD records to _gc._tcp.toto.in. of type Srv Loc
DNS: Query Identifier = 189 (0xBD)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _gc._tcp.toto.in. of type Srv Loc on class INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 74 3B 56 00 00 7E 11 59 7E 0A D0 C9 01 0A D1 .t;V..~.Y~.ÐÉ..Ñ
00020: C9 02 06 17 00 35 00 60 92 E6 00 BD 28 00 00 01 É....5.`'æ.½(...
page 1
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 03 5F 67 63 04 5F 74 63 70 05 69 65 ....._gc._tcp.ie
****************************************************************************
****************************************************************************
****
3 20.390886 0050731A1481 000BCD2A2B40 DNS
0xBFyn Upd UPD records to gc._msdcs.toto.in. 10.208.201.1
10.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B59; Proto = UDP; Len: 88
UDP: Src Port: Unknown, (1561); Dst Port: DNS (53); Length = 68 (0x44)
UDP: Source Port = 0x0619
UDP: Destination Port = DNS
UDP: Total length = 68 (0x44) bytes
UDP: UDP Checksum = 0x2180
UDP: Data: Number of data bytes remaining = 60 (0x003C)
DNS: 0xBFyn Upd UPD records to gc._msdcs.toto.in. of type Host Addr
DNS: Query Identifier = 191 (0xBF)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: gc._msdcs.toto.in. of type Host Addr on class INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 58 3B 59 00 00 7E 11 59 97 0A D0 C9 01 0A D1 .X;Y..~.Y-.ÐÉ..Ñ
00020: C9 02 06 19 00 35 00 44 21 80 00 BF 28 00 00 01 É....5.D!?.¿(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 02 67 63 06 5F 6D 73 64 63 73 05 69 .....gc._msdcs.i
****************************************************************************
****************************************************************************
****
4 21.047145 0050731A1481 000BCD2A2B40 DNS
0xC1yn Upd UPD records to _ldap._tcp.SI-SPM._s 10.208.201.1
10.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B5C; Proto = UDP; Len: 142
UDP: Src Port: Unknown, (1563); Dst Port: DNS (53); Length = 122 (0x7A)
UDP: Source Port = 0x061B
UDP: Destination Port = DNS
UDP: Total length = 122 (0x7A) bytes
UDP: UDP Checksum = 0x457F
UDP: Data: Number of data bytes remaining = 114 (0x0072)
DNS: 0xC1yn Upd UPD records to
_ldap._tcp.SI-SPM._sites.gc._msdcs.toto.in. of type Srv Loc
DNS: Query Identifier = 193 (0xC1)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _ldap._tcp.SI-SPM._sites.gc._msdcs.toto.in. of type Srv
Loc on class INET addr.
page 2
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 8E 3B 5C 00 00 7E 11 59 5E 0A D0 C9 01 0A D1 .Z;\..~.Y^.ÐÉ..Ñ
00020: C9 02 06 1B 00 35 00 7A 45 7F 00 C1 28 00 00 01 É....5.zE.Á(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 05 5F 6C 64 61 70 04 5F 74 63 70 06 ....._ldap._tcp.
****************************************************************************
****************************************************************************
****
5 21.703403 0050731A1481 000BCD2A2B40 DNS
0xC3yn Upd UPD records to _gc._tcp.SI-SPM._sit 10.208.201.1
10.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B5F; Proto = UDP; Len: 130
UDP: Src Port: Unknown, (1565); Dst Port: DNS (53); Length = 110 (0x6E)
UDP: Source Port = 0x061D
UDP: Destination Port = DNS
UDP: Total length = 110 (0x6E) bytes
UDP: UDP Checksum = 0x60A0
UDP: Data: Number of data bytes remaining = 102 (0x0066)
DNS: 0xC3yn Upd UPD records to _gc._tcp.SI-SPM._sites.toto.in. of type
Srv Loc
DNS: Query Identifier = 195 (0xC3)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _gc._tcp.SI-SPM._sites.toto.in. of type Srv Loc on class
INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 82 3B 5F 00 00 7E 11 59 67 0A D0 C9 01 0A D1 .,;_..~.Yg.ÐÉ..Ñ
00020: C9 02 06 1D 00 35 00 6E 60 A0 00 C3 28 00 00 01 É....5.n` .Ã(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 03 5F 67 63 04 5F 74 63 70 06 53 49 ....._gc._tcp.SI
2 W2000 domains on 2 sites (toto.in and child.toto.in)
Sites are connected with RNIS non permanent lines.
AD replication is OK acording to the planing in Sites & Services MMC.
But there are many connections between the domain controlers on the 2
sites...
Browser service is off (netbios off)
Network investigation indicates DNS registration every 7-8 minutes...
DNS is Active Directory based for each domain.
All DC are GCs
Help very appreciated !!
Bye
Xavier
---
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
1 19.078370 0050731A1481 000BCD2A2B40 DNS
0xBB
yn Upd UPD records to _ldap._tcp.gc._msdcs 10.208.201.110.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B53; Proto = UDP; Len: 128
UDP: Src Port: Unknown, (1557); Dst Port: DNS (53); Length = 108 (0x6C)
UDP: Source Port = 0x0615
UDP: Destination Port = DNS
UDP: Total length = 108 (0x6C) bytes
UDP: UDP Checksum = 0x77C5
UDP: Data: Number of data bytes remaining = 100 (0x0064)
DNS: 0xBB
yn Upd UPD records to _ldap._tcp.gc._msdcs.toto.in. of type SrvLoc
DNS: Query Identifier = 187 (0xBB)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _ldap._tcp.gc._msdcs.toto.in. of type Srv Loc on class
INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 80 3B 53 00 00 7E 11 59 75 0A D0 C9 01 0A D1 .?;S..~.Yu.ÐÉ..Ñ
00020: C9 02 06 15 00 35 00 6C 77 C5 00 BB 28 00 00 01 É....5.lwÅ.»(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 05 5F 6C 64 61 70 04 5F 74 63 70 02 ....._ldap._tcp.
****************************************************************************
****************************************************************************
****
2 19.734628 0050731A1481 000BCD2A2B40 DNS
0xBD
yn Upd UPD records to _gc._tcp.toto.in. o 10.208.201.110.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B56; Proto = UDP; Len: 116
UDP: Src Port: Unknown, (1559); Dst Port: DNS (53); Length = 96 (0x60)
UDP: Source Port = 0x0617
UDP: Destination Port = DNS
UDP: Total length = 96 (0x60) bytes
UDP: UDP Checksum = 0x92E6
UDP: Data: Number of data bytes remaining = 88 (0x0058)
DNS: 0xBD
yn Upd UPD records to _gc._tcp.toto.in. of type Srv LocDNS: Query Identifier = 189 (0xBD)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _gc._tcp.toto.in. of type Srv Loc on class INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 74 3B 56 00 00 7E 11 59 7E 0A D0 C9 01 0A D1 .t;V..~.Y~.ÐÉ..Ñ
00020: C9 02 06 17 00 35 00 60 92 E6 00 BD 28 00 00 01 É....5.`'æ.½(...
page 1
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 03 5F 67 63 04 5F 74 63 70 05 69 65 ....._gc._tcp.ie
****************************************************************************
****************************************************************************
****
3 20.390886 0050731A1481 000BCD2A2B40 DNS
0xBF
yn Upd UPD records to gc._msdcs.toto.in. 10.208.201.110.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B59; Proto = UDP; Len: 88
UDP: Src Port: Unknown, (1561); Dst Port: DNS (53); Length = 68 (0x44)
UDP: Source Port = 0x0619
UDP: Destination Port = DNS
UDP: Total length = 68 (0x44) bytes
UDP: UDP Checksum = 0x2180
UDP: Data: Number of data bytes remaining = 60 (0x003C)
DNS: 0xBF
yn Upd UPD records to gc._msdcs.toto.in. of type Host AddrDNS: Query Identifier = 191 (0xBF)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: gc._msdcs.toto.in. of type Host Addr on class INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 58 3B 59 00 00 7E 11 59 97 0A D0 C9 01 0A D1 .X;Y..~.Y-.ÐÉ..Ñ
00020: C9 02 06 19 00 35 00 44 21 80 00 BF 28 00 00 01 É....5.D!?.¿(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 02 67 63 06 5F 6D 73 64 63 73 05 69 .....gc._msdcs.i
****************************************************************************
****************************************************************************
****
4 21.047145 0050731A1481 000BCD2A2B40 DNS
0xC1
yn Upd UPD records to _ldap._tcp.SI-SPM._s 10.208.201.110.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B5C; Proto = UDP; Len: 142
UDP: Src Port: Unknown, (1563); Dst Port: DNS (53); Length = 122 (0x7A)
UDP: Source Port = 0x061B
UDP: Destination Port = DNS
UDP: Total length = 122 (0x7A) bytes
UDP: UDP Checksum = 0x457F
UDP: Data: Number of data bytes remaining = 114 (0x0072)
DNS: 0xC1
yn Upd UPD records to_ldap._tcp.SI-SPM._sites.gc._msdcs.toto.in. of type Srv Loc
DNS: Query Identifier = 193 (0xC1)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _ldap._tcp.SI-SPM._sites.gc._msdcs.toto.in. of type Srv
Loc on class INET addr.
page 2
Trace du Moniteur réseau Wed 09/17/03 09:42:55 cap2.txt
Trame Heure Adr MAC src Adr MAC dst Protocole
Description Autre adr src Autre adr dst Taper une autre
adresse
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 8E 3B 5C 00 00 7E 11 59 5E 0A D0 C9 01 0A D1 .Z;\..~.Y^.ÐÉ..Ñ
00020: C9 02 06 1B 00 35 00 7A 45 7F 00 C1 28 00 00 01 É....5.zE.Á(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 05 5F 6C 64 61 70 04 5F 74 63 70 06 ....._ldap._tcp.
****************************************************************************
****************************************************************************
****
5 21.703403 0050731A1481 000BCD2A2B40 DNS
0xC3
yn Upd UPD records to _gc._tcp.SI-SPM._sit 10.208.201.110.209.201.2
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP: DOD Internet Protocol
+ IP: ID = 0x3B5F; Proto = UDP; Len: 130
UDP: Src Port: Unknown, (1565); Dst Port: DNS (53); Length = 110 (0x6E)
UDP: Source Port = 0x061D
UDP: Destination Port = DNS
UDP: Total length = 110 (0x6E) bytes
UDP: UDP Checksum = 0x60A0
UDP: Data: Number of data bytes remaining = 102 (0x0066)
DNS: 0xC3
yn Upd UPD records to _gc._tcp.SI-SPM._sites.toto.in. of typeSrv Loc
DNS: Query Identifier = 195 (0xC3)
+ DNS: DNS Flags = Query, OpCode - Dyn Upd, RCode - No error
DNS: Zone Count = 1 (0x1)
DNS: Prerequisite Section Entry Count = 0 (0x0)
DNS: Update Section Entry Count = 1 (0x1)
DNS: Additional Records Count = 0 (0x0)
+ DNS: Update Zone: toto.in. of type SOA on class INET addr.
+ DNS: Update: _gc._tcp.SI-SPM._sites.toto.in. of type Srv Loc on class
INET addr.
00000: 00 0B CD 2A 2B 40 00 50 73 1A 14 81 08 00 45 00 ..Í*[email protected].
00010: 00 82 3B 5F 00 00 7E 11 59 67 0A D0 C9 01 0A D1 .,;_..~.Yg.ÐÉ..Ñ
00020: C9 02 06 1D 00 35 00 6E 60 A0 00 C3 28 00 00 01 É....5.n` .Ã(...
00030: 00 00 00 01 00 00 05 69 65 64 6F 6D 02 69 6E 00 .......toto.in.
00040: 00 06 00 01 03 5F 67 63 04 5F 74 63 70 06 53 49 ....._gc._tcp.SI