List 4 Windows 2000のドメインコントローラがダウンしている場合にWindows NT 4.0クライアントからログオンしたときのトレース
1 PC98-D LILY NBT NS: MultiHomed Name Registration req. for PC98-D <00>
2 LILY PC98-D NBT NS: Registration (Node Status) resp. for PC98-D <00>, Success, Owner Addr. 192.168.1.13
3 PC98-D LILY NBT NS: Registration req. for ACTIVE <00>
4 LILY PC98-D NBT NS: Registration (Node Status) resp. for ACTIVE <00>, Success, Owner Addr. 192.168.1.13
5 PC98-D LILY NBT NS: Query req. for ACTIVE <1B>
6 LILY PC98-D NBT NS: Query (Node Status) resp. for ACTIVE <1B>, Success
7 PC98-D LILY Netlogon Query for Primary DC
8 PC98-D LILY NBT NS: Query req. for ACTIVE <1C>
9 LILY PC98-D NBT NS: Query (Node Status) resp. for ACTIVE <1C>, Success
10 PC98-D *BRDCST Netlogon SAM LOGON request from client
11 PC98-D LILY Netlogon SAM LOGON request from client
12 NT40SV-2 *BRDCST ARP_RARP ARP: Request, Target IP: 192.168.1.13
13 PC98-D NT40SV-2 ARP_RARP ARP: Reply, Target IP: 192.168.1.21 Target Hdwr Addr: xxxxxxxxxxxx
14 NT40SV-2 PC98-D Netlogon SAM Response to SAM LOGON request
15 PC98-D LILY NBT NS: Query req. for NT40SV-2
16 LILY PC98-D NBT NS: Query (Node Status) resp. for NT40SV-2, Success
17 PC98-D NT40SV-2 TCP ....S., len: 0, seq: 635392862-635392862, ack: 0, win: 8192, src: 1025 dst: 139 (NBT Session)
18 NT40SV-2 PC98-D TCP .A..S., len: 0, seq: 49425-49425, ack: 635392863, win: 8760, src: 139 (NBT Session) dst: 1025
19 PC98-D NT40SV-2 TCP .A...., len: 0, seq: 635392863-635392863, ack: 49426, win: 8760, src: 1025 dst: 139 (NBT Session)
20 PC98-D NT40SV-2 NBT SS: Session Request, Dest: NT40SV-2 , Source: PC98-D <00>, Len: 68
21 NT40SV-2 PC98-D NBT SS: Positive Session Response, Len: 0
22 PC98-D NT40SV-2 SMB C negotiate, Dialect = NT LM 0.12
23 NT40SV-2 PC98-D SMB R negotiate, Dialect # = 7
24 PC98-D NT40SV-2 SMB C session setup & X, Username = , and C tree connect & X, Share = \\NT40SV-2\IPC$
25 NT40SV-2 PC98-D SMB R session setup & X, and R tree connect & X, Type = IPC
26 PC98-D NT40SV-2 SMB C NT create & X, File = \lsarpc
27 NT40SV-2 PC98-D SMB R NT create & X, FID = 0x800
28 PC98-D NT40SV-2 MSRPC c/o RPC Bind: UUID 1xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx call 0x0 assoc grp 0x0 xmit 0x1630 recv 0x1630
29 NT40SV-2 PC98-D MSRPC c/o RPC Bind Ack: call 0x0 assoc grp 0x98FB xmit 0x1630 recv 0x1630
30 PC98-D NT40SV-2 R_LSARPC RPC Client call lsarpc:LsarOpenPolicy2(..)
31 NT40SV-2 PC98-D R_LSARPC RPC Server response lsarpc:LsarOpenPolicy2(..)
32 PC98-D NT40SV-2 R_LSARPC RPC Client call lsarpc:LsarEnumerateTrustedDomains(..)
33 NT40SV-2 PC98-D R_LSARPC RPC Server response lsarpc:LsarEnumerateTrustedDomains(..)
34 PC98-D NT40SV-2 R_LSARPC RPC Client call lsarpc:LsarEnumerateTrustedDomains(..)
35 NT40SV-2 PC98-D R_LSARPC RPC Server response lsarpc:LsarEnumerateTrustedDomains(..)
36 PC98-D NT40SV-2 R_LSARPC RPC Client call lsarpc:LsarClose(..)
37 NT40SV-2 PC98-D R_LSARPC RPC Server response lsarpc:LsarClose(..)
38 PC98-D NT40SV-2 SMB C close file, FID = 0x800
39 NT40SV-2 PC98-D SMB R close file
40 PC98-D NT40SV-2 SMB C NT create & X, File = \NETLOGON
41 NT40SV-2 PC98-D SMB R NT create & X, FID = 0x801
42 PC98-D NT40SV-2 MSRPC c/o RPC Bind: UUID xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx call 0x4 assoc grp 0x0 xmit 0x1630 recv 0x1630
43 NT40SV-2 PC98-D MSRPC c/o RPC Bind Ack: call 0x4 assoc grp 0x98FC xmit 0x1630 recv 0x1630
44 PC98-D NT40SV-2 R_LOGON RPC Client call logon:NetrServerReqChallenge(..)
45 NT40SV-2 PC98-D R_LOGON RPC Server response logon:NetrServerReqChallenge(..)
46 PC98-D NT40SV-2 R_LOGON RPC Client call logon:NetrServerAuthenticate2(..)
47 NT40SV-2 PC98-D R_LOGON RPC Server response logon:NetrServerAuthenticate2(..)