Home page logo
/

bugtraq logo Bugtraq mailing list archives

DUMP of NT system crash
From: vytasvy () OSF LT (Vytautas Vysniauskas)
Date: Mon, 7 Apr 1997 14:31:57 +0300


                   TCP/IP session dump
                   --------------------
                of Windows NT 4.0 system crash
                --------------------------------

This message is a continuation of my previous letter on the topic
about Windows NT system crash while responding to disk share requests
for UNIX (Linux) clients.

Today (April 7, 1997) I have reproduced system crash on another NT system.
It was Packard Bell computer :
P5/100, 24Mb RAM, ATAPI 1.2 dual channel PCI IDE controller,
 3c509 (ISA) ethernet card.
I was able to produce system dump, which  already was sent to
Microsoft Windows NT Test group.

This computer has the same packs/hotfixes installed:
Windows NT version 4.0, build 1381, Service Pack 2
Q135707Q141239NTOSKRNLFIX
Q163213 TCPIP DRIVER UPDATE
Q163333SERIALFIX
RPC SERVER CPU USAGE FIX


In addition, very handfull information is TCP/IP session dump between
a client and server. I have compared two sessions:

1) correct session between properly configured Linux client (client A)
   and  NT host (host H)

2) "wrong" session between incompatible Linux client (client B)
   and the same NT host (host H). In this case host H crashes immediatelly.

There is also NT server (host S) which is WINS server for NT workstation H.

client A:
Linux 2.0.29. smbmount utility is compiled for this
kernel version, so it is "correct" client which can mount remotely
host H disk and to see contents of the mount point.

client B:
Linux 2.0.25. This client has compatibility problem,
because smbmount utility requires kernel version 2.0.29. This session
produces NT system crash.

host H:
NT 4.0 workstation

host S:
NT 4.0 server

session between Linux client and NT workstations is:

./smbmount //H/service /mnt -U client_name
(password: some_password)
ls /mnt                 (at this point "wrong" session breaks NT system)
./smbumount /mnt


TCP/IP session listing is available at:
ftp://puni.osf.lt/windows/tcpipdump.gz (~5k)
(md5summ is a75a618b7e390e3945ad8a26f9753725)

Hope, it will help to detect what's wrong with NT system.


========================================================
Vytautas Vysniauskas       e-mail: vytasvy () osf lt
                              tel: +370-2-611408
UNIX systems administrator
Open Society Fund of Lithuania,
========================================================



  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]