Conference utrtsc::pw_tools

    Can we address the functions of NETLOGON in a cluster in regards to
    responding to client domain logon validation requests?
    
    While .0 indicates only one node in a cluster is actively handling
    NETLOGON requests, a customer running v5.0D ECO3 (VAX/VMS 6.1 on 3
    nodes) sees behavior that contradicts this.  This cluster is a PDC and
    is the only "server" in the domain.  
    
    And I see some evidence of it on a cluster PDC in our LAB.  2-node
    VAXcluster running VMS G7.1, PATHWORKS v5.0E.  Node names are ALFPW1
    and ALFPW2 with alias name of ALFPW1_ALIAS.  Node ALFPW1 has the
    PWRK$DMN_UAS lock:
    
    Granted at      EX   00000000-FFFFFFFF
    
    Resource:      4E4D4424 4B525750    PWRK$DMN  Status:
     Length   12   00000000 5341555F    _UAS....
    
    
    On ALFPW1 I did $ NET LOGON <username password>, and it returned:
    
    The server \\ALFPW1 successfully logged you on as admin.
    
    But from AFLPW2, the same command returns:
    
    The server \\ALFPW2 successfully logged you on as admin.
    
    I would have expected either the cluster alias name be returned in both
    instances or the name of the "active" netlogon node (ALFPW1, in this
    case)?  Or is it all just smoke & mirrors - ALFPW1 is actually handling
    the NET LOGON, but we're returning the local nodename?
    
    The other behavior that doesn't fit .0 is the customer is having
    trouble with PATHWORKS on one node in his cluster becoming
    unresponsive.  Remember, it's a PDC and the only netlogon provider in
    the domain.  The problem begins with clients (native Win95 with license
    bits) failing domain logon ("The network password is incorrect or the
    server failed to respond").  Now the part that I'm having trouble with:
    
    The administrators can use PWMON to monitor which node in the cluster
    is the "least loaded".  If the cluster node which is not responding to
    net logon requests is the least loaded, clients can't logon.  
    
    Customer indicates when they induce a load on the node having trouble
    such that the problem node is no longer seen as the "least loaded",
    clients can logon (and the message returned indicates it's one of the
    other two nodes that logged them on). 
    
    The node having the problem was not the node with the exclusive lock on
    PWRK$DMN_UAS.  
    
    So based on the behavior we're seeing it appears that, in regards to
    responding to client net logon requests, the least busy node is the one
    who responds.  
    
    Can someone clear up the confusion?
    
    Paul

    I might be able to clear up a small piece of the confusion.
    
>>    
>>    On ALFPW1 I did $ NET LOGON <username password>, and it returned:
>>    
>>    The server \\ALFPW1 successfully logged you on as admin.
>>    
>>    But from AFLPW2, the same command returns:
>>    
>>    The server \\ALFPW2 successfully logged you on as admin.
>>

    I noticed the same behavior while doing some tests on V6 and also
    assumed that it meant that both daemons were processing logon requests.
    I stepped through the code and saw that this was not the case - indeed
    only one daemon in the cluster was actually processing the logon
    requests.
    
    I didn't chase it any further (too many other things that have to be
    understood first!), but I'm guessing it has to do with the other piece
    of PATHWORKS that uses the active/inactive concept - the MCP.  MCP also
    takes out a lock - PWRK$MCP_<alias>.  I wish I could tell you more - 
    maybe someone else can fill in some details.  FYI: I QAR'd this for
    V6 (61127.2) - it seemed to me also that the name displayed should
    be the cluster alias rather than an individual server.

    Sandy    

    	This is a note I entered in the pw50ift notesfile.
    Note that the netlogon response which is sent to client will have
    the PATHWORKS cluteralias name in it.
    
    The net logon code of $net logon .... gets the name backe with 
    NetWkstaGetInfo api.
    
    I tried this with a decnet client, the PATHWORKS clusteralias is
    in the response but the client probably gets the name out of the
    source address of the datalink header......
    
    The daemon _does_ not have load balacing as explained before. When a
    find name request is sent out to resolve the PATHWORKS cluster alias
    name the NETBIOS process on the least loaded node will react and sent
    the response back. In the mean time it can happen that the load
    balacing mechanism decides to move to another node but the client
    _still_ can make the connection to the origial node.
    
    
              <<< NOTED::NOTES$9:[NOTES$LIBRARY]PWV50IFT.NOTE;1 >>>
                 -< PATHWORKS V5.0x for OpenVMS (LAN Manager) >-
================================================================================
Note 4186.4        5.0E NETLOGON occasional failure. Multinet             4 of 9
UTRTSC::EISINK "No Kipling apes today"               77 lines   6-MAR-1997 05:32
                                -< Explanation >-
--------------------------------------------------------------------------------
    .3 Sorry I looked for the note and wanted to stick the keyword FDDI
    on it but noticed that I did not put it in here at all :-)
    
    So this is the sequence when you issue a $ net logon username password
    on a standalone machine to logon on the domain.
    
    	1) The net command will set up a session with the _local_ server
    	   (pwrk$lmsrv).
    	   This will happen via the remote api's and you are not able to
    	   trace this on the network with IRIS because we'll see
    	   that its on the same node and will use PCOMS for interprocess
    	   communication.
    
    	2) When the session setup is ok then the UXREDIR will send out a
    	   netlogon multicast.
    	   This is traceble with IRIS, capture all NETBIOS datagrams
    	   by filtering on:
    
    		 09-00-2b-00-00-07 DECnet netbios
    		 03-00-00-00-00-01 Netbeui
    		 ff-ff-ff-ff-ff-ff TCP/IP
    
    	  3) In the name response from the logon server (PDC or BDC)
    	  the server name which served the netlogon request is specified
    	  together with the type of the name (unique or group when its a 
    	  PATHWORKS cluster ) and the object number (which is object 64 which 
    	  is created by the pwrk$lmmmcp prccess which handles all incomming 
    	  connections.)
      
    	  4) Before the negotiate protocol is sent out a NETBIOS findname 
             request is sent out to resolve the netbios name of the 
    	     PATHWORKS cluster alias.
    
    	  5) The name response is sent back by the NETBIOS process containing
    	
    	         - the object number (64)
    		 - The physical decnet address prefixed with the fixed 
    		   part of 000400aa.
    
    	  6) A connection is made to the DECnet address (1024*area +
            nodenumber) object 64.
    
    	However on ethernet controllers DECnet overwrites the physical
        address with it DECnet physical address (SCSSYSTEMID is part of it).
    	Other applications can not overwrite it with another address.
    
    	For FDDI this is per channel, so the data link header should
    	contain the DECnet physical address rather then the physical
    	hardaware address. The application (NETBIOS) should overwrite it 
    	during initialization.
    
    	For FDDI controllers we did not do that thus the datalink source
    	address contained the physical address rather then the DECnet physical
    	address.
    
    	Why does it (mostly) work ?
    
    	Normaly the LANmanager machine name (NETBIOS name) is  the same as the
    	DECnet node name, when we do not see the DECnet physical address
    	prefix we connect to the nodename which mostly succeeds.
    
    	For cluster however it can happen that the connection is made to
    	wrong DECnet node which is _not_ running PATHWORKS because DECnet
    	will do the loadbalacing and not PATHWORKS.
    
    	The above problem is fixed as indicated in .3.
    
    	Also make sure that the PATHWORKS cluster alias in NOT the same as
    	the DECnet/Transport cluster alias!
    
    			Rob.
    

    Rob,
    
    >The net logon code of $net logon .... gets the name backe with 
    >NetWkstaGetInfo api.
    
    >I tried this with a decnet client, the PATHWORKS clusteralias is
    >in the response but the client probably gets the name out of the
    >source address of the datalink header......
    
    >The daemon _does_ not have load balacing as explained before. When a
    >find name request is sent out to resolve the PATHWORKS cluster alias
    >name the NETBIOS process on the least loaded node will react and sent
    >the response back. 
    
    This is where we're getting confused.  While the daemon process does
    not have load balancing, the NET LOGON process sure relies on it.  Say
    your active NETLOGON node is NODEA and yet NODEB is the least loaded
    node and, at the moment, NODEB is not responding, you're stuck.  So you 
    induce a load on the least loaded node to force the alias name to another
    member and now it responds to the findname.  
    
    So which processes are responsible for sending back the findname
    request for each of the 3 transports (although I'm very, very 
    interested in IP specifically)?  Is there anything different about this
    findname request than one generated by, say, NBTSTAT -A or NET DIAG
    /STATUS or SHOW ASTAT?
    
    Paul
    
    

    Don't get the things confused paul.
    
    Net logon is only to get you as a user into the domain.
    It is by no way used as the connection mechanism or authen-
    tication mechanism. 
    
    What happens next is on a tree connect is that the client sends
    out a name query for the cluster alias. Now the least loaded
    server in the cluster responds.
    
    So I don't get your point, or are you maybe looking at an IRIS
    trace and getting things confused, because it might be that
    the trace shows a tree connect for the logon script ???
    
    Adrie

    
    From what Rob has explained, I'm getting the impression that a client
    logging onto the domain (not trying to connect to a share) does a
    FindName operation during the logon.  Yes/No?  
    
    Paul

    No,
    
    The mailslot \\netlogon is send out by the client. The logon server
    sends a nelogon mailslot back with the NETBIOS name in it as the
    logon server. When  the logon server is part of the PATHWORKS cluster
    alias then the cluster alias is in the data.
    
    I said 'send the netlogon mailslot' deliberty because you don't see it
    as a reponse (R) in IRIS but as a 'C'.
    
    Make an IRIS trace of a netlogon sequence and you'll see what I mean.
    
    
    	Rob.

    Frame 22 is the \MAILSLOT\NET\NETLOGON to DEC_NETBIOS from DRTHRR
    domain UTO_LUC.
    
    The logon server for the domain UTO_LUC reponds by sending mailslot
    as captured in fram 23.
    
    In the datapart the nelogon server is \\EXTSMB. The name is the same as
    the DECnet nodename (53.673) but when the netlogn server is part of the
    cluster then the PATHWORK cluster alias will be there.
    
    
    
    
IRIS capture data                                                     Page   1
netlogon                                                     03/14/97 07:36:48


** Summary for frame 22 **

    22  +40.1m  DEC_NETBIOS<-      drthrr  SMB C Transact NoResp WriteMS NET\NETLOGON

** Detail for frame 22 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 2A83
SMB: User ID                        = 029B
SMB: Multiplex ID                   = 0561
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 45
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0002
SMB:         ..............1. = No response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 92
SMB: Actual data bytes sent         = 45
SMB: Offset to data bytes           = 92
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 4
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 68 (68 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\NET\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 45 of 45 bytes

** Hex for frame 22 **

0000: 09 00 2B 00 00 07 AA 00 04 00 8F FC 80 40 02 02    ..+..........@..  
0010: 01 00 01 00 44 52 54 48 52 52 20 20 20 20 20 20    ....DRTHRR        
0020: 20 20 20 00 55 54 4F 2D 4C 55 43 20 20 20 20 20       .UTO-LUC       
0030: 20 20 20 00 00 00 89 00 00 FF 53 4D 42 25 00 00       .......SMB%..  
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................  
0050: 00 00 00 83 2A 9B 02 61 05 11 00 00 2D 00 00 00    ....*..a....-...  
0060: 00 00 00 00 02 00 FF FF FF FF 00 00 00 00 5C 00    ..............\.  
0070: 2D 00 5C 00 03 00 01 00 04 00 02 00 44 00 5C 4D    -.\.........D.\M  
0080: 41 49 4C 53 4C 4F 54 5C 4E 45 54 5C 4E 45 54 4C    AILSLOT\NET\NETL  

IRIS capture data                                                     Page   2
netlogon                                                     03/14/97 07:36:48

0090: 4F 47 4F 4E 00 00 00 44 52 54 48 52 52 00 45 49    OGON...DRTHRR.EI  
00A0: 53 49 4E 4B 00 5C 4D 41 49 4C 53 4C 4F 54 5C 54    SINK.\MAILSLOT\T  
00B0: 45 4D 50 5C 4E 45 54 4C 4F 47 4F 4E 00 46 01 00    EMP\NETLOGON.F..  
00C0: FF FF                                              ..                

IRIS capture data                                                     Page   3
netlogon                                                     03/14/97 07:36:48


** Summary for frame 23 **

    23  +15.4m  DEC_NETBIOS<-      53.673  SMB C Transact WriteMS TEMP\NETLOGON

** Detail for frame 23 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 13
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 13
SMB: Offset to data bytes           = 94
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 38 (38 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\TEMP\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 13 of 13 bytes

** Hex for frame 23 **

0000: 09 00 2B 00 00 07 AA 00 04 00 A1 D6 80 40 02 03    ..+..........@..  
0010: 01 00 01 00 00 00 00 00 00 00 00 00 00 00 AA 00    ................  
0020: 04 00 A1 D6 44 52 54 48 52 52 20 20 20 20 20 20    ....DRTHRR        
0030: 20 20 20 00 00 00 6B 00 00 FF 53 4D 42 25 00 00       ...k...SMB%..  
0040: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00    ................  
0050: 00 00 00 00 00 00 00 00 00 11 00 00 0D 00 00 00    ................  
0060: 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 00 00    ................  
0070: 0D 00 5E 00 03 00 01 00 00 00 02 00 26 00 5C 4D    ..^.........&.\M  
0080: 41 49 4C 53 4C 4F 54 5C 54 45 4D 50 5C 4E 45 54    AILSLOT\TEMP\NET  

IRIS capture data                                                     Page   4
netlogon                                                     03/14/97 07:36:48

0090: 4C 4F 47 4F 4E 00 00 06 00 5C 5C 45 58 54 53 4D    LOGON....\\EXTSM  
00A0: 42 00 FF FF                                        B...              
    

    Well I haven't used IRIS yet, but I've certainly duplicate the behavior
    the customer explains.  And server debug trace seems to confirm it.
    
    Cluster alias name of ALFPWIFT, of nodes ALFPW1 and ALFPW2.  I started
    PATHWORKS on ALFPW2 first.  It has the PWRK$DMN_UAS lock Granted (not 
    Waiting). 
    
    MC PCSA_CLAIM_NAME shows node ALFPW1 owns the alias name (status is 84
    on ALFPW1 and 8C on ALFPW2). 
    
    From a PATHWORKS v6 client I did NET LOGON ADMIN pswd /DOMAIN:ALFPWIFT.
    The message returned indicated ALFPW1 logged me on.  I look at the
    trace files for both cluster members - no activity from my client is
    logged in ALFPW2's (the "active" NETLOGON node) trace files; but there
    are these two messages in LMMCP trace on ALFPW1:
    
    13:15:31.60 20C0044C:001ABF80 LISTENER: connection request on fd
    3329120
    13:15:31.62 20C0044C:001ABF80 LISTENER\newclient: FARQAR
    
    and lots of messages in LMSRV trace on ALFPW1 for my client.
    
    Then on ALFPW1 I simply ran PWMON (the system is otherwise idle) so the
    alias name failed over to ALFPW2 (confirmed with PCSA_CLAIM_NAME
    /STATUS).  Now when I logon from my client, I'm validated by ALFPW2 and
    I see corresponding debug messages in ALFPW2's trace files.
    
    Can you still unequivically, without doubt, swear that only one node is
    answering CLIENT netlogon requests?  
    
    Also, it also appears that the PWRK$LMDMN process is NOT involved as no
    new messages are logged in it's trace file on either node.  The LMSRV
    process gets the following SMB's from the client (in order specified):
    
    14:07:05 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> negotiate protocol
    
    14:07:06 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> session setup
    
    14:07:06 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> net use and X
    
    14:07:07 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> transaction
    
    14:07:07 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.EXTSMB.SRC]TRANS.C;1
    1081 FARQAR --SMB--API-> WkstaUserLogoff
    
    14:07:07 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> net use /delete
    
    14:07:07 006FB230(smbwork)  LM$BLD_ROOT:[LM.SERVER.CTRL.SRC]SMBWORK.C;1 
    712 FARQAR --SMB--> user log off
    
    
    Paul

    Tell you what...
    
    We can simulate it here...
    
    So it looks like a bug....
    
    One of us will simulate it, trace it, debug it and
    let you know.
    
    Adrie

    
    Is there a way to force the active NETLOGON node to switch w/o shutting
    down PATHWORKS?
    
    For example, NODEA is running the active netlogon process (has the lock
    granted), but I want NODEB to be the active netlogon server.
    
    I tried $ NET STOP NETLOGON and $ NET START NETLOGON from "NODEB", but
    "NODEA" retains the lock.
    
    Paul

    No.
    
    IN the lock value block of the lock we'll update the status of the
    netlogon service.
    So when its initialy started and then gets paused/stopped via the net
    commands we'll pause/stop the service and update the lvb of the lock.
    
    When the process whoch helds the lock dies or gets shutdowned then one
    other dmn process in the cluster gets the lock, reads the lock value
    block ans takes over that status.
    
    So the answer is straight forward, no no way at all without shutting
    PATHWORKS down on the active node.
    
    	Rob.
    

    
    Say I'm desparate to get active NETLOGON moved to another node, yet
    I can't disrupt the 300 users currently connected to the active
    NETLOGON node ;o).
    
    How much trouble would I get in if I:
    
    	$ net stop netlogon
    	$ mc pwrk$stop /id=<LMDMN-pid>
    	$ mc pwrk$start pwrk$lmdmn
    	$ net start netlogon
    
    Paul

    Paul,
    
    No,
    
>>    	$ net stop netlogon
>>    	$ mc pwrk$stop /id=<LMDMN-pid>
    
    	You can't stop a single lanmanger process. The're is a termination
    mailbox box for each process defined. SO when you kill one lanmanager
    process such as the daemon then the others will be shutdowned.
>>    	$ mc pwrk$start pwrk$lmdmn
    
    You can't do this either, the reason that we stop all the processes is
    that they depend heavily on each other.
    Mailslot queues, shared area (PCOMS) one process can't life with out
    another.
    
    
    		Rob.
    

    
    I surrender.  Thanks.
    
    Paul

    Paul,
    
    this is how it works and why you see an inactive node as the server
    which has logged you in.
    
    Doamin name is UTO-EISJE, PDC is EISJE the PATHWORKS cluster alias
    name. 
    The cluster consists of two nodes, SPIDR and ANSWRS.
    
    PATHWORKS at node SPIDR is started first, thus the active daemon.
    PATHWORKS at node ANSWRS is started after that, thus the inactive node
    for the netlogon process.
    
    ANSWRS has the clusteralias, thus all new connections go to that node
    when the cluster alias is used to connect.
    
    Part of the netlogon process the client establish a session and connects 
    to IPC$. Because the node ANSWRS has the cluster alias the netbios
    process resolves the cluster alias for this node.
    
    The client establis a session to node answrs. So this is the reason why
    the client displays the nodename ANSWRS as the logon server although
    the netlogon mailslot is processed by node SPIDR.
    
    So all makes sense.
    
    The next reply will contain the iris capture.
    
    		Rob.
    
    Frame 11, 
    DEC_NETBIOS<-      drthrr  SMB C Transact NoResp WriteMSNET\NETLOGON
    
    Frame 13, SPIDR honors the netlogon mailslot, in the data the cluster
    alis EISJE is specifies and no single machine name.
    
    DEC_NETBIOS<-       spidr  SMB C Transact WriteMS TEMP\NETLOGON
    
    Frame 14, DRTHRR tries to resolve the PATHWORKS NETBIOS clusteralias.
    
     DEC_NETBIOS<-      drthrr  DECNB AdapName Query SA='..............d.'
    DA='EISJE           '
    
    Frame 15, Answrs answers :-) because answrs owns the CLUSTERALIAS.
    
    drthrr<-      answrs  DECNB AdapName Resp  SA='................'
    DA='EISJE           '
    
    Frame 39, DRTHRR issues a negprot to answrs
    
    Frame 42, negprot reponse from answrs
    
    Frame 43,  SessSetup&Tcon&X from DRTHRR
    
    frame 45, SessSetup&Tcon&X response from answrs
    
    Frame 46,  NetWkstaUserLogon from DRTHRR
    
    frame 48, NetWkstaUserLogon response 
    
    frame 49  TDis 
    
    frame 50  TDIS response
    
    frame 51  Ulogoff&X request
    
    frame 52, Ulogoff&X response.
    
    End of netlogon process.

IRIS capture data                                                     Page   1
netlogon process                                             04/01/97 15:27:00


** Summary for frame 0 **

     0         AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 0 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:46 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page   2
netlogon process                                             04/01/97 15:27:00


** Summary for frame 1 **

     1 +130.7m  DEC_NETBIOS<-      53.236  SMB C Announce HLP523 "PATHWORKS V5.0B for OpenVMS (LAN Manager)"

** Detail for frame 1 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0213
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "HLP523"
SMB: Description                    = "PATHWORKS V5.0B for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page   3
netlogon process                                             04/01/97 15:27:00


** Summary for frame 2 **

     2 +584.9m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 2 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:22 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page   4
netlogon process                                             04/01/97 15:27:00


** Summary for frame 3 **

     3     +1s  DEC_NETBIOS<-      53.405  SMB C Announce UTR01 "Universal Galactic OpenVMS UNIX met Pathworks V5"

** Detail for frame 3 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 65
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 65
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 82 (83 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0213
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTR01"
SMB: Description                    = "Universal Galactic OpenVMS UNIX met Pathworks V5"

IRIS capture data                                                     Page   5
netlogon process                                             04/01/97 15:27:00


** Summary for frame 4 **

     4  +11.3m  DEC_NETBIOS<-      53.405  SMB C Announce UTRUST "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

** Detail for frame 4 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 64
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 64
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 81 (82 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0213
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTRUST"
SMB: Description                    = "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

IRIS capture data                                                     Page   6
netlogon process                                             04/01/97 15:27:00


** Summary for frame 5 **

     5 +140.7m  DEC_NETBIOS<-      53.463  SMB C Announce UTURBO "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

** Detail for frame 5 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0233
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTURBO"
SMB: Description                    = "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

IRIS capture data                                                     Page   7
netlogon process                                             04/01/97 15:27:00


** Summary for frame 6 **

     6 +137.6m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 6 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:48 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page   8
netlogon process                                             04/01/97 15:27:00


** Summary for frame 7 **

     7 +415.7m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 7 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:26 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page   9
netlogon process                                             04/01/97 15:27:00


** Summary for frame 8 **

     8     +2s AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 8 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:28 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  10
netlogon process                                             04/01/97 15:27:00


** Summary for frame 9 **

     9 +344.7m  DEC_NETBIOS<-      53.431  SMB C Announce HLIS51 "PATHWORKS V5.0D for OpenVMS (C.C.S. Office)"

** Detail for frame 9 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 61
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 61
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 78 (79 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0233
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "HLIS51"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (C.C.S. Office)"

IRIS capture data                                                     Page  11
netlogon process                                             04/01/97 15:27:00


** Summary for frame 10 **

    10 +139.4m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 10 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:52 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  12
netlogon process                                             04/01/97 15:27:00


** Summary for frame 11 **

    11 +434.7m  DEC_NETBIOS<-      drthrr  SMB C Transact NoResp WriteMS NET\NETLOGON

** Detail for frame 11 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 26B6
SMB: User ID                        = 029B
SMB: Multiplex ID                   = 0561
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 45
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0002
SMB:         ..............1. = No response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 92
SMB: Actual data bytes sent         = 45
SMB: Offset to data bytes           = 92
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 4
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 68 (68 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\NET\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 45 of 45 bytes

IRIS capture data                                                     Page  13
netlogon process                                             04/01/97 15:27:00


** Summary for frame 12 **

    12     +1s AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 12 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:30 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  14
netlogon process                                             04/01/97 15:27:00


** Summary for frame 13 **

    13 +591.6m  DEC_NETBIOS<-       spidr  SMB C Transact WriteMS TEMP\NETLOGON

** Detail for frame 13 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 12
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 12
SMB: Offset to data bytes           = 94
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 37 (37 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\TEMP\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 12 of 12 bytes

IRIS capture data                                                     Page  15
netlogon process                                             04/01/97 15:27:00


** Summary for frame 14 **

    14   +4.9m  DEC_NETBIOS<-      drthrr  DECNB AdapName Query SA='..............d.' DA='EISJE           '

** Detail for frame 14 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 1
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 2, Name Query
DECNB: Message ID code                = 36
DECNB: Source adapter name            = "..............d."
DECNB: Destination adapter name       = "EISJE           "
DECNB: Source adapter status          = 0
DECNB: Destination adapter status     = 129
DECNB: Message data length            = 106
DECNB: DECnet object                  = 0
DECNB: Message data
DECNB: 
DECNB: ** Unexpected end of frame **

IRIS capture data                                                     Page  16
netlogon process                                             04/01/97 15:27:00


** Summary for frame 15 **

    15   +1.3m       drthrr<-      answrs  DECNB AdapName Resp  SA='................' DA='EISJE           '

** Detail for frame 15 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 3
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 3, Name Response
DECNB: Message ID code                = 36
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "EISJE           "
DECNB: Source adapter status          = 255
DECNB: Destination adapter status     = 128
DECNB: Message data length            = 0
DECNB: DECnet object                  = 64

IRIS capture data                                                     Page  17
netlogon process                                             04/01/97 15:27:00


** Summary for frame 16 **

    16   +3.9m  All_NETBIOS<-       spidr  SMB C Transact WriteMS TEMP\NETLOGON

** Detail for frame 16 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 12
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 12
SMB: Offset to data bytes           = 94
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 37 (37 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\TEMP\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 12 of 12 bytes

IRIS capture data                                                     Page  18
netlogon process                                             04/01/97 15:27:00


** Summary for frame 17 **

    17  +61.5m    Broadcast<-       spidr  SMB C Transact WriteMS TEMP\NETLOGON

** Detail for frame 17 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 12
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 12
SMB: Offset to data bytes           = 94
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 37 (37 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\TEMP\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 12 of 12 bytes

IRIS capture data                                                     Page  19
netlogon process                                             04/01/97 15:27:00


** Summary for frame 18 **

    18 +720.6m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 18 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:54 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  20
netlogon process                                             04/01/97 15:27:00


** Summary for frame 19 **

    19 +917.0m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 19 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:32 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  21
netlogon process                                             04/01/97 15:27:00


** Summary for frame 20 **

    20     +1s AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 20 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:58 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  22
netlogon process                                             04/01/97 15:27:00


** Summary for frame 21 **

    21 +415.8m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 21 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:34 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  23
netlogon process                                             04/01/97 15:27:00


** Summary for frame 22 **

    22 +666.5m  DEC_NETBIOS<-      53.180  SMB C Announce HLFS "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

** Detail for frame 22 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 62
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 62
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 79 (80 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0323
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "HLFS"
SMB: Description                    = "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

IRIS capture data                                                     Page  24
netlogon process                                             04/01/97 15:27:00


** Summary for frame 23 **

    23     +1s AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 23 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:00 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  25
netlogon process                                             04/01/97 15:27:00


** Summary for frame 24 **

    24 +115.9m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 24 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:36 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  26
netlogon process                                             04/01/97 15:27:00


** Summary for frame 25 **

    25     +1s AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 25 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:02 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  27
netlogon process                                             04/01/97 15:27:00


** Summary for frame 26 **

    26  +16.9m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 26 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:38 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  28
netlogon process                                             04/01/97 15:27:00


** Summary for frame 27 **

    27     +1s  DEC_NETBIOS<-      53.399  SMB C Announce LDNDL1 "PATHWORKS V5.0C for OpenVMS (LAN Manager)"

** Detail for frame 27 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 022B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "LDNDL1"
SMB: Description                    = "PATHWORKS V5.0C for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  29
netlogon process                                             04/01/97 15:27:00


** Summary for frame 28 **

    28 +398.5m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 28 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:40 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  30
netlogon process                                             04/01/97 15:27:00


** Summary for frame 29 **

    29 +283.9m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 29 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:04 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  31
netlogon process                                             04/01/97 15:27:00


** Summary for frame 30 **

    30 +336.1m   LAST_Grp_0<-       spidr  LAST Adver  SPIDR Client 3.1 DC=0000

** Detail for frame 30 **

LAST: 
LAST: - - - - - LAST Circuit Header - - - - -
LAST: 
LAST: Message length                 = 51
LAST: Message type                   = 5, Adver
LAST: Message flags                  = 00
LAST:         .......0 = Not checksummed
LAST: Destination circuit            = 0000
LAST: Node identification            = 08-00-2B-09-95-99
LAST: Segment/second rate            = 0, Old
LAST: Last segment rate              = 0
LAST: 
LAST: - - - - - Adver Message - - - - -
LAST: 
LAST: Protocol version               = 3.1
LAST: Lowest version supported       = 3
LAST: Highest version supported      = 3
LAST: Solicit flags                  = 01
LAST:         .......1 = Master
LAST:         ......0. = 
LAST:         .....0.. = 
LAST: Node name length               = 5
LAST: Node name                      = "SPIDR"
LAST: Request sequence               = 00000000
LAST: Service class                  = 0, Response required
LAST: Service rating                 = 0
LAST: Source incarnation             = 4D00
LAST: Service name length            = 0
LAST: Service name                   = ""
LAST: Service data length            = 0

IRIS capture data                                                     Page  32
netlogon process                                             04/01/97 15:27:00


** Summary for frame 31 **

    31   +1.7m   LAST_Grp_0<-       spidr  LAST Adver  SPIDR Client 3.1 DC=0000

** Detail for frame 31 **

LAST: 
LAST: - - - - - LAST Circuit Header - - - - -
LAST: 
LAST: Message length                 = 51
LAST: Message type                   = 5, Adver
LAST: Message flags                  = 00
LAST:         .......0 = Not checksummed
LAST: Destination circuit            = 0000
LAST: Node identification            = 08-00-2B-09-95-99
LAST: Segment/second rate            = 0, Old
LAST: Last segment rate              = 0
LAST: 
LAST: - - - - - Adver Message - - - - -
LAST: 
LAST: Protocol version               = 3.1
LAST: Lowest version supported       = 3
LAST: Highest version supported      = 3
LAST: Solicit flags                  = 01
LAST:         .......1 = Master
LAST:         ......0. = 
LAST:         .....0.. = 
LAST: Node name length               = 5
LAST: Node name                      = "SPIDR"
LAST: Request sequence               = 00000000
LAST: Service class                  = 0, Response required
LAST: Service rating                 = 0
LAST: Source incarnation             = 4D00
LAST: Service name length            = 0
LAST: Service name                   = ""
LAST: Service data length            = 0

IRIS capture data                                                     Page  33
netlogon process                                             04/01/97 15:27:00


** Summary for frame 32 **

    32     +1s AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 32 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:42 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  34
netlogon process                                             04/01/97 15:27:00


** Summary for frame 33 **

    33     +1s AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 33 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:08 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  35
netlogon process                                             04/01/97 15:27:00


** Summary for frame 34 **

    34 +716.2m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 34 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:44 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  36
netlogon process                                             04/01/97 15:27:00


** Summary for frame 35 **

    35 +827.8m       drthrr<-      answrs  NSP ConnAck  D=13DE

** Detail for frame 35 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 24
NSP:         ....01.. = Acknowledgement Message
NSP:         .010.... = Connect Acknowledgement
NSP: 
NSP: Destination Link Address       = 13DE

IRIS capture data                                                     Page  37
netlogon process                                             04/01/97 15:27:00


** Summary for frame 36 **

    36  +51.8m       drthrr<-      answrs  NSP ConnCfrm D=13DE S=00B6 SEGSIZE=1441

** Detail for frame 36 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 28
NSP:         ....10.. = Control Message
NSP:         .010.... = Connect Confirm
NSP: 
NSP: Destination Link Address       = 13DE
NSP: Source Link Address            = 00B6
NSP: Requested Services             = 05
NSP:         ....01.. = Segment Request Count
NSP: NSP Version Information        = 07
NSP:         .....111 = NSP Version 4.2
NSP: Max Rcv Segment Size           = 1441
NSP: 
NSP: (17 bytes of data remaining in packet)
NSP: 

IRIS capture data                                                     Page  38
netlogon process                                             04/01/97 15:27:00


** Summary for frame 37 **

    37    +.5m       answrs<-      drthrr  NSP LinkSvc  D=00B6 S=13DE ACKOTH=0 ACKDAT=0 SEG=1 REQD=6

** Detail for frame 37 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 10
NSP:         ....00.. = Data Message
NSP:         .001.... = Link Service Message
NSP: 
NSP: Destination Link Address       = 00B6
NSP: Source Link Address            = 13DE
NSP: Other-Data Acknowledgement     = 0 (8000)
NSP:         ..00............ = ACK
NSP: Acknowledgement Number         = 0 (A000)
NSP:         ..10............ = Cross-Channel ACK
NSP: Link Service Segment Number    = 0001
NSP: Link Service Flags             = 00
NSP:         ......00 = No Changes
NSP:         ....00.. = Data Segment/Message Request
NSP: Flow Control Adjustment        = 06

IRIS capture data                                                     Page  39
netlogon process                                             04/01/97 15:27:00


** Summary for frame 38 **

    38   +2.0m       drthrr<-      answrs  NSP LinkSvc  D=13DE S=00B6 ACKOTH=1 SEG=1 REQD=127

** Detail for frame 38 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 10
NSP:         ....00.. = Data Message
NSP:         .001.... = Link Service Message
NSP: 
NSP: Destination Link Address       = 13DE
NSP: Source Link Address            = 00B6
NSP: Other-Data Acknowledgement     = 1 (8001)
NSP:         ..00............ = ACK
NSP: Link Service Segment Number    = 0001
NSP: Link Service Flags             = 00
NSP:         ......00 = No Changes
NSP:         ....00.. = Data Segment/Message Request
NSP: Flow Control Adjustment        = 7F

IRIS capture data                                                     Page  40
netlogon process                                             04/01/97 15:27:00


** Summary for frame 39 **

    39    +.8m       answrs<-      drthrr  SMB C NegProt

** Detail for frame 39 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 72, NegProt Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 01A8
SMB: Word count                     = 0
SMB: Byte count                     = 115 (115 in this segment)
SMB: Dialect 0                      = "PC NETWORK PROGRAM 1.0"
SMB: Dialect 1                      = "XENIX CORE"
SMB: Dialect 2                      = "MICROSOFT NETWORKS 1.03"
SMB: Dialect 3                      = "MICROSOFT NETWORKS 3.0"
SMB: Dialect 4                      = "DOS LM1.2X002"
SMB: Dialect 5                      = "DOS LANMAN2.1"

IRIS capture data                                                     Page  41
netlogon process                                             04/01/97 15:27:00


** Summary for frame 40 **

    40    +.2m       answrs<-      drthrr  NSP OthAck   D=00B6 S=13DE NUM=1

** Detail for frame 40 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 14
NSP:         ....01.. = Acknowledgement Message
NSP:         .001.... = Other-Data Acknowledgement
NSP: 
NSP: Destination Link Address       = 00B6
NSP: Source Link Address            = 13DE
NSP: Other-Data Acknowledgement     = 1 (8001)
NSP:         ..00............ = ACK

IRIS capture data                                                     Page  42
netlogon process                                             04/01/97 15:27:00


** Summary for frame 41 **

    41 +151.5m  DEC_NETBIOS<-      63.297  SMB C Transact WriteMS BROWSE

** Detail for frame 41 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 33
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 33
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 50 (50 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\BROWSE"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 33 of 33 bytes

IRIS capture data                                                     Page  43
netlogon process                                             04/01/97 15:27:00


** Summary for frame 42 **

    42 +903.0m       drthrr<-      answrs  SMB R NegProt Dialect=5

** Detail for frame 42 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 72, NegProt Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 89
SMB:         .......1 = Supports L&R, W&U
SMB:         ....1... = Caseless
SMB:         1....... = Response message
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 01A8
SMB: Word count                     = 13
SMB: Dialect selected               = 5
SMB: Security mode                  = 0003
SMB:         ...............1 = User level
SMB:         ..............1. = Encrypt passwords
SMB: Max transmit buffer            = 4356
SMB: Max pending mpx requests       = 3
SMB: Max VCs per session            = 1
SMB: Block read/write support       = 0003
SMB:         ...............1 = ReadRaw support
SMB:         ..............1. = WriteRaw support
SMB: Session key                    = 00000000
SMB: Server current time            = 5-Nov-57
SMB: Server current date            = 4:36:02
SMB: Server timezone                = 0
SMB: Reserved                       = 00000008
SMB: Byte count                     = 18 (18 in this segment)
SMB: Untagged data block

IRIS capture data                                                     Page  44
netlogon process                                             04/01/97 15:27:00


** Summary for frame 43 **

    43   +2.0m       answrs<-      drthrr  SMB C SessSetup&Tcon&X User=EISINK \\EISJE\IPC$

** Detail for frame 43 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 73, SessSetup&X Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 26B6
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 01B0
SMB: Word count                     = 10
SMB: Next command code              = 75, Tcon&X
SMB: Reserved byte (MBZ)            = 00
SMB: Offset to second message       = 91
SMB: Consumers max buffer size      = 2148
SMB: Max pending mpx requests       = 0
SMB: Virtual circuit number         = 0
SMB: Session key                    = 00000000
SMB: Size of account password       = 10
SMB: Size of encryption key         = 0
SMB: Offset to encryption key       = 0
SMB: Byte count                     = 36 (67 in this segment)
SMB: Account password               = "INSIDESMB"
SMB: Account name                   = "EISINK"
SMB: Untagged data block
SMB: 
SMB: - - - - - Tcon&X - - - - -
SMB: 
SMB: Word count                     = 4
SMB: Next command code              = 0xFF, None
SMB: Additional flags               = 0000
SMB: Password length                = 1
SMB: Byte count                     = 20 (20 in this segment)
SMB: Password                       = ""
SMB: Alias name                     = "\\EISJE\IPC$"
SMB: Device name                    = "?????"

IRIS capture data                                                     Page  45
netlogon process                                             04/01/97 15:27:00


** Summary for frame 44 **

    44 +244.0m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 44 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:10 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  46
netlogon process                                             04/01/97 15:27:00


** Summary for frame 45 **

    45 +221.3m       drthrr<-      answrs  SMB R SessSetup&Tcon&X Guest=0

** Detail for frame 45 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 73, SessSetup&X Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 88
SMB:         ....1... = Caseless
SMB:         1....... = Response message
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 26B6
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01B0
SMB: Word count                     = 3
SMB: Next command code              = 75, Tcon&X
SMB: Reserved byte (MBZ)            = 00
SMB: Offset to second message       = 90
SMB: Logged on as GUEST?            = 0
SMB: Byte count                     = 49 (62 in this segment)
SMB: Data length                    = 19798 (60 in this segment)
SMB: File data
SMB: 
SMB: - - - - - Tcon&X - - - - -
SMB: 
SMB: Word count                     = 3
SMB: Next command code              = 0xFF, None
SMB: Word parameter 2               = 0
SMB: Byte count                     = 4 (4 in this segment)
SMB: Service type                   = "IPC"

IRIS capture data                                                     Page  47
netlogon process                                             04/01/97 15:27:00


** Summary for frame 46 **

    46   +4.1m       answrs<-      drthrr  SMB C NetWkstaUserLogon

** Detail for frame 46 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 26B6
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01B8
SMB: Word count                     = 14
SMB: Total parameter bytes          = 94
SMB: Total data bytes               = 0
SMB: Max return param bytes         = 6
SMB: Max return data bytes          = 1024
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 5000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 94
SMB: Offset to parameter bytes      = 76
SMB: Actual data bytes sent         = 0
SMB: Offset to data bytes           = 0
SMB: Setup word count               = 0
SMB: 
SMB: - - - - - Named Pipe Transaction - - - - -
SMB: 
SMB: Byte count                     = 107 (107 in this segment)
SMB: Transaction name or pad        = "\PIPE\LANMAN"
SMB: Transaction parameters         = 94 of 94 bytes
SMB: Remote API request             = 132, NetWkstaUserLogon
SMB: 
SMB: - - - - - NetWkstaUserLogon RPC Transaction - - - - -
SMB: 
SMB: Parameter descriptor           = "OOWb54WrLh."
SMB: Data descriptor                = "WB21BWDWWDDDDDDDzzzD."
SMB: NULL Ptr     FLen 0, DLen 1    = 
SMB: NULL Ptr     FLen 0, DLen 1    = 
SMB: Word Data    FLen 2, DLen 1    = 1
SMB: Byte Ptr     FLen 1, DLen 54   = 
SMB: Word Data    FLen 2, DLen 1    = 54
SMB: Rcv Buf Ptr  FLen 0, DLen 1    = 
SMB: Rcv Buf Len  FLen 2, DLen 1    = 1024
SMB: 
SMB: ** Unexpected end of frame **

IRIS capture data                                                     Page  48
netlogon process                                             04/01/97 15:27:00


** Summary for frame 47 **

    47 +390.6m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 47 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:46 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  49
netlogon process                                             04/01/97 15:27:00


** Summary for frame 48 **

    48 +351.9m       drthrr<-      answrs  SMB R NetWkstaUserLogon

** Detail for frame 48 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 88
SMB:         ....1... = Caseless
SMB:         1....... = Response message
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 26B6
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01B8
SMB: Word count                     = 10
SMB: Total parameter bytes          = 6
SMB: Total data bytes               = 98
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 6
SMB: Max return setup bytes         = 55
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 3997794
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: 
SMB: - - - - - Named Pipe Transaction - - - - -
SMB: 
SMB: Remote API request             = 132, NetWkstaUserLogon
SMB: Byte count                     = 104 (104 in this segment)

IRIS capture data                                                     Page  50
netlogon process                                             04/01/97 15:27:00


** Summary for frame 49 **

    49   +3.7m       answrs<-      drthrr  SMB R TDis TID=0001

** Detail for frame 49 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 71, TDis Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 0000
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01C0
SMB: Word count                     = 0
SMB: Byte count                     = 0 (0 in this segment)

IRIS capture data                                                     Page  51
netlogon process                                             04/01/97 15:27:00


** Summary for frame 50 **

    50 +154.9m       drthrr<-      answrs  SMB R TDis TID=0001

** Detail for frame 50 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 71, TDis Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 88
SMB:         ....1... = Caseless
SMB:         1....... = Response message
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 0000
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01C0
SMB: Word count                     = 0
SMB: Byte count                     = 0 (0 in this segment)

IRIS capture data                                                     Page  52
netlogon process                                             04/01/97 15:27:00


** Summary for frame 51 **

    51   +1.3m       answrs<-      drthrr  SMB C Ulogoff&X

** Detail for frame 51 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 74, Ulogoff&X Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 26B6
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01C8
SMB: Word count                     = 2
SMB: Next command code              = 0xFF, None
SMB: Byte count                     = 0 (0 in this segment)

IRIS capture data                                                     Page  53
netlogon process                                             04/01/97 15:27:00


** Summary for frame 52 **

    52  +91.1m  DEC_NETBIOS<-      53.384  SMB C Announce HLEUS2 "PWV5.0D LM Server UTO.PSG domain"

** Detail for frame 52 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 50
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 50
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 67 (68 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 000B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "HLEUS2"
SMB: Description                    = "PWV5.0D LM Server UTO.PSG domain"

IRIS capture data                                                     Page  54
netlogon process                                             04/01/97 15:27:00


** Summary for frame 53 **

    53 +138.9m       drthrr<-      answrs  SMB R Ulogoff&X

** Detail for frame 53 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 74, Ulogoff&X Response
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 88
SMB:         ....1... = Caseless
SMB:         1....... = Response message
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0001
SMB: Process ID                     = 26B6
SMB: User ID                        = 8003
SMB: Multiplex ID                   = 01C8
SMB: Word count                     = 2
SMB: Next command code              = 0xFF, None
SMB: Byte count                     = 0 (0 in this segment)

IRIS capture data                                                     Page  55
netlogon process                                             04/01/97 15:27:00


** Summary for frame 54 **

    54   +1.2m       answrs<-      drthrr  NSP DiscInit D=00B6 S=13DE Reason=0

** Detail for frame 54 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 38
NSP:         ....10.. = Control Message
NSP:         .011.... = Disconnect Initiate
NSP: 
NSP: Destination Link Address       = 00B6
NSP: Source Link Address            = 13DE
NSP: Disconnect Reason              = 0 (Unknown)
NSP: 
NSP: (1 bytes of data remaining in packet)
NSP: 

IRIS capture data                                                     Page  56
netlogon process                                             04/01/97 15:27:00


** Summary for frame 55 **

    55   +2.4m       drthrr<-      answrs  NSP DiscCfrm D=13DE S=00B6 Reason=42

** Detail for frame 55 **

NSP: 
NSP: - - - - - Network Services protocol - - - - -
NSP: 
NSP: Message Type                   = 48
NSP:         ....10.. = Control Message
NSP:         .100.... = Disconnect Confirm
NSP: 
NSP: Destination Link Address       = 13DE
NSP: Source Link Address            = 00B6
NSP: Disconnect Reason              = 42 (Disconnect Complete (normal))

IRIS capture data                                                     Page  57
netlogon process                                             04/01/97 15:27:00


** Summary for frame 56 **

    56   +1.6m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='EISINK         .'

** Detail for frame 56 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 37
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "EISINK         ."
DECNB: Source adapter status          = 116
DECNB: Destination adapter status     = 0
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  58
netlogon process                                             04/01/97 15:27:00


** Summary for frame 57 **

    57 +241.2m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='EISINK         .'

** Detail for frame 57 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 37
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "EISINK         ."
DECNB: Source adapter status          = 116
DECNB: Destination adapter status     = 0
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  59
netlogon process                                             04/01/97 15:27:00


** Summary for frame 58 **

    58  +95.7m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 58 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:12 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  60
netlogon process                                             04/01/97 15:27:00


** Summary for frame 59 **

    59 +893.0m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='EISINK         .'

** Detail for frame 59 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 37
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "EISINK         ."
DECNB: Source adapter status          = 116
DECNB: Destination adapter status     = 0
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  61
netlogon process                                             04/01/97 15:27:00


** Summary for frame 60 **

    60 +123.0m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 60 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:48 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  62
netlogon process                                             04/01/97 15:27:00


** Summary for frame 61 **

    61 +398.1m  DEC_NETBIOS<-       53.76  SMB C Transact WriteMS BROWSE

** Detail for frame 61 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 39
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 39
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 1
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 56 (56 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\BROWSE"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 39 of 39 bytes

IRIS capture data                                                     Page  63
netlogon process                                             04/01/97 15:27:00


** Summary for frame 62 **

    62 +100.7m  DEC_NETBIOS<-      answrs  SMB C Announce ANSWRS "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 62 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "ANSWRS"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  64
netlogon process                                             04/01/97 15:27:00


** Summary for frame 63 **

    63   +4.3m  All_NETBIOS<-      answrs  SMB C Announce ANSWRS "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 63 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "ANSWRS"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  65
netlogon process                                             04/01/97 15:27:00


** Summary for frame 64 **

    64 +281.0m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 64 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:14 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  66
netlogon process                                             04/01/97 15:27:00


** Summary for frame 65 **

    65  +83.1m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='UTO-EISJE      .'

** Detail for frame 65 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 38
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "UTO-EISJE      ."
DECNB: Source adapter status          = 0
DECNB: Destination adapter status     = 1
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  67
netlogon process                                             04/01/97 15:27:00


** Summary for frame 66 **

    66 +987.4m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='UTO-EISJE      .'

** Detail for frame 66 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 38
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "UTO-EISJE      ."
DECNB: Source adapter status          = 0
DECNB: Destination adapter status     = 1
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  68
netlogon process                                             04/01/97 15:27:00


** Summary for frame 67 **

    67 +545.2m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 67 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:52 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  69
netlogon process                                             04/01/97 15:27:00


** Summary for frame 68 **

    68  +70.1m  DEC_NETBIOS<-      63.873  DECNB AdapName Query SA='................' DA='PCNEE           '

** Detail for frame 68 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 1
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 2, Name Query
DECNB: Message ID code                = 47
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "PCNEE           "
DECNB: Source adapter status          = 0
DECNB: Destination adapter status     = 187
DECNB: Message data length            = 0
DECNB: DECnet object                  = 32

IRIS capture data                                                     Page  70
netlogon process                                             04/01/97 15:27:00


** Summary for frame 69 **

    69 +373.5m  DEC_NETBIOS<-      drthrr  DECNB AdapName Claim SA='................' DA='UTO-EISJE      .'

** Detail for frame 69 **

DECNB: 
DECNB: - - - - - DEC NetBIOS Protocol Header - - - - -
DECNB: 
DECNB: Protocol version               = 2
DECNB: Protocol revision              = 2
DECNB: Service class                  = 2, Adapter Name Service
DECNB: Message function               = 1, Name Claim
DECNB: Message ID code                = 38
DECNB: Source adapter name            = "................"
DECNB: Destination adapter name       = "UTO-EISJE      ."
DECNB: Source adapter status          = 0
DECNB: Destination adapter status     = 1
DECNB: Message data length            = 0
DECNB: DECnet object                  = 0

IRIS capture data                                                     Page  71
netlogon process                                             04/01/97 15:27:00


** Summary for frame 70 **

    70 +740.1m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 70 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:16 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  72
netlogon process                                             04/01/97 15:27:00


** Summary for frame 71 **

    71 +126.5m  DEC_NETBIOS<-       spidr  SMB C Announce SPIDR "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 71 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 58
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 58
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 75 (76 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "SPIDR"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  73
netlogon process                                             04/01/97 15:27:00


** Summary for frame 72 **

    72   +7.9m  All_NETBIOS<-       spidr  SMB C Announce SPIDR "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 72 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 58
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 58
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 75 (76 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "SPIDR"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  74
netlogon process                                             04/01/97 15:27:00


** Summary for frame 73 **

    73  +61.2m    Broadcast<-       spidr  SMB C Announce SPIDR "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 73 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 58
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 58
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 75 (76 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "SPIDR"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  75
netlogon process                                             04/01/97 15:27:00


** Summary for frame 74 **

    74 +196.7m  DEC_NETBIOS<-       spidr  SMB C Announce EISJE "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

** Detail for frame 74 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "EISJE"
SMB: Description                    = "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

IRIS capture data                                                     Page  76
netlogon process                                             04/01/97 15:27:00


** Summary for frame 75 **

    75   +7.6m  All_NETBIOS<-       spidr  SMB C Announce EISJE "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

** Detail for frame 75 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "EISJE"
SMB: Description                    = "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

IRIS capture data                                                     Page  77
netlogon process                                             04/01/97 15:27:00


** Summary for frame 76 **

    76  +60.0m    Broadcast<-       spidr  SMB C Announce EISJE "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

** Detail for frame 76 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 020B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "EISJE"
SMB: Description                    = "PATHWORKS V5 for OpenVMS (LAN Manager) (Alias)"

IRIS capture data                                                     Page  78
netlogon process                                             04/01/97 15:27:00


** Summary for frame 77 **

    77     +1s AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 77 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:54 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  79
netlogon process                                             04/01/97 15:27:00


** Summary for frame 78 **

    78 +583.2m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 78 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:18 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  80
netlogon process                                             04/01/97 15:27:00


** Summary for frame 79 **

    79 +158.1m  DEC_NETBIOS<-      63.297  SMB C Transact WriteMS BROWSE

** Detail for frame 79 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 33
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 33
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 50 (50 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\BROWSE"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 33 of 33 bytes

IRIS capture data                                                     Page  81
netlogon process                                             04/01/97 15:27:00


** Summary for frame 80 **

    80     +1s  DEC_NETBIOS<-      53.440  SMB C Announce HLSM01 "PATHWORKS V5.0C for OpenVMS (LAN Manager)"

** Detail for frame 80 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 022B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "HLSM01"
SMB: Description                    = "PATHWORKS V5.0C for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  82
netlogon process                                             04/01/97 15:27:00


** Summary for frame 81 **

    81 +117.0m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 81 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:20 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  83
netlogon process                                             04/01/97 15:27:00


** Summary for frame 82 **

    82 +116.3m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 82 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:56 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  84
netlogon process                                             04/01/97 15:27:00


** Summary for frame 83 **

    83     +1s  DEC_NETBIOS<-      qstion  SMB C Announce QSTION "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

** Detail for frame 83 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 59
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 59
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 76 (77 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 000B
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "QSTION"
SMB: Description                    = "PATHWORKS V5.0D for OpenVMS (LAN Manager)"

IRIS capture data                                                     Page  85
netlogon process                                             04/01/97 15:27:00


** Summary for frame 84 **

    84 +238.5m  DEC_NETBIOS<-      53.472  SMB C Announce UTRUIN "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

** Detail for frame 84 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0233
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTRUIN"
SMB: Description                    = "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

IRIS capture data                                                     Page  86
netlogon process                                             04/01/97 15:27:00


** Summary for frame 85 **

    85   +7.7m  DEC_NETBIOS<-      53.472  SMB C Announce UTRTSC "Pathworks v5 Cluster of SSO"

** Detail for frame 85 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 45
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 45
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 62 (63 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0233
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTRTSC"
SMB: Description                    = "Pathworks v5 Cluster of SSO"

IRIS capture data                                                     Page  87
netlogon process                                             04/01/97 15:27:00


** Summary for frame 86 **

    86 +110.6m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 86 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:25:58 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  88
netlogon process                                             04/01/97 15:27:00


** Summary for frame 87 **

    87 +354.2m  DEC_NETBIOS<-      53.431  SMB C Transact WriteMS TEMP\NETLOGON

** Detail for frame 87 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 13
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 4294967295
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 13
SMB: Offset to data bytes           = 94
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 38 (38 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\TEMP\NETLOGON"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Data parameters                = 13 of 13 bytes

IRIS capture data                                                     Page  89
netlogon process                                             04/01/97 15:27:00


** Summary for frame 88 **

    88 +528.6m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 88 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:24 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  90
netlogon process                                             04/01/97 15:27:00


** Summary for frame 89 **

    89     +1s  DEC_NETBIOS<-      53.458  SMB C Announce UTRUCK "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

** Detail for frame 89 **

SMB: 
SMB: - - - - - SMB Protocol Message - - - - -
SMB: 
SMB: SMB signature                  = FF-53-4D-42
SMB: Command code                   = 25, Transact Request
SMB: Error class                    = 0, Success
SMB: Reserved                       = 00
SMB: Error code                     = 0, Success
SMB: Flags                          = 00
SMB:         ....0... = Case sensitive
SMB: Flags 2                        = 0000
SMB: Reserved bytes
SMB: Tree ID                        = 0000
SMB: Process ID                     = 0000
SMB: User ID                        = 0000
SMB: Multiplex ID                   = 0000
SMB: Word count                     = 17
SMB: Total parameter bytes          = 0
SMB: Total data bytes               = 63
SMB: Max return param bytes         = 0
SMB: Max return data bytes          = 0
SMB: Max return setup bytes         = 0
SMB: Transaction flags              = 0000
SMB:         ..............0. = Response required
SMB: Millisecond timeout            = 1000
SMB: Reserved                       = 0000
SMB: Actual parameter bytes sent    = 0
SMB: Offset to parameter bytes      = 0
SMB: Actual data bytes sent         = 63
SMB: Offset to data bytes           = 86
SMB: Setup word count               = 3
SMB: 
SMB: - - - - - Mailslot Transaction - - - - -
SMB: 
SMB: Mailslot opcode                = 1 (WriteMS)
SMB: Message priority               = 0
SMB: Message class                  = 2 (Unreliable)
SMB: Byte count                     = 80 (81 in this segment)
SMB: Transaction name or pad        = "\MAILSLOT\LANMAN"
SMB: Transaction parameters         = 0 of 0 bytes
SMB: Announce opcode                = 1, Announce
SMB: Services available             = 0233
SMB:         ...............1 = Workstation
SMB:         ..............1. = Server
SMB: Software version               = 2.2
SMB: Announcment seconds            = 60
SMB: Computer name                  = "UTRUCK"
SMB: Description                    = "Pathworks V5 on UTRTSC (Netbeui Decnet TCPIP)"

IRIS capture data                                                     Page  91
netlogon process                                             04/01/97 15:27:00


** Summary for frame 90 **

    90   +6.3m AB0004017101<-       spidr  SCA CC=Hello

** Detail for frame 90 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-64-D6 (spidr)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".SPIDR ."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 15
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:00 1928
SCA: Local device name              = ".XQA............"
SCA: Hardware address               = 08-00-2B-09-95-99
SCA: Datalink device type           = XQ_DELQA
SCA: Node hardware type             = VAX

IRIS capture data                                                     Page  92
netlogon process                                             04/01/97 15:27:00


** Summary for frame 91 **

    91 +780.4m AB0004017101<-      answrs  SCA CC=Hello

** Detail for frame 91 **

SCA: 
SCA: - - - - - NI SCA Protocol - - - - -
SCA: 
SCA: Message Length                 = 112
SCA: Destination System ID          = AB-00-04-01-71-01 (AB0004017101)
SCA: Group Number                   = 113
SCA: Source System ID               = AA-00-04-00-8C-D5 (answrs)
SCA: 
SCA: - - - - - Channel Control Message - - - - -
SCA: 
SCA: Channel Control Message Flags  = A0
SCA:         .....000 = Hello
SCA:         ...0.... = Authorize not valid
SCA:         ..1..... = Accept Message over this NI
SCA:         .0...... = No cancel of OK_XMT
SCA:         1....... = Channel Control Message
SCA: 
SCA: OK_XMT cancel reason code      = 0
SCA: Remote port type               = 8
SCA:         1....... = Multiple channels supported
SCA: 
SCA: NI-SCA Protocol Version        = 1.4.00
SCA: Remote system node name        = ".ANSWRS."
SCA: Remote Port Funct Mask         = 83FF0180
SCA: Station info                   = 00000400
SCA: Port to last reset this port   = "......"
SCA: Remote Pipe Quota              = 16
SCA: Remote provided services mask  = 3
SCA:         .......1 = XOR style xmt'er checksum service supported
SCA:         ......1. = XOR style rcv'er checksum service supported
SCA: 
SCA: Remote requested services mask = 0
SCA:         .......0 = No XOR style xmt'er checksum service requested
SCA:         ......0. = No XOR style rcv'er checksum service requested
SCA: 
SCA: Authorization Code             = 00-00-00-00-00-00-00-00
SCA: Service Requested              = "................"
SCA: Local channel sequence number  = 0
SCA: Maximum buffer size            = 1412
SCA: Transmit timestamp             = Sun Apr 01 14:26:26 1928
SCA: Local device name              = ".EZA............"
SCA: Hardware address               = 08-00-2B-27-55-F6
SCA: Datalink device type           = EZ_SGEC
SCA: Node hardware type             = VAX