On Tue, Mar 11, 2014 at 7:11 AM, Steve Campbell campbell@cnpapers.comwrote:
I'm sure it firewalling, I just don't see it yet. I was just checking to see if any of the defaults from versions had changed mostly, something less obvious hidden in comments in the config file. I'm not seeing anything in log files on the samba server or the firewall.
Have you ran tcpdump on the samba server yet?
tcpdump -i <interface> -nn port 135 or portrange 137-139 or port 445
Add the host or network filter to constrain to just the Samba traffic from a certain host or network. tcpdump -i <interface> -nn host x.x.x.x and (port 135 or portrange 137-139 or port 445) tcpdump -i <interface> -nn net x.x.x.x/y and (port 135 or portrange 137-139 or port 445)
You might rather log the packet capture to file and then open it in Wireshark... tcpdump -i <interface> -nn net x.x.x.x/y and (port 135 or portrange 137-139 or port 445) -w /tmp/samba_traffic.pcap
[0] http://wiki.samba.org/index.php/Samba_port_usage [1] http://www.danielmiessler.com/study/tcpdump/