Re: Quick NetBEUI question

Richard B. Johnson (
Wed, 29 Jul 1998 08:43:01 -0400 (EDT)

On Wed, 29 Jul 1998, Alan Cox wrote:

> > > Unfortunately you are talking complete crap at this point. And anyone
> > > who suspects otherwise should stick their windows boxes in netbeui only
> > > mode and use tcpdump
> > You have such a nice way of explaining things, Alan.
> So why have you sent me a dump of a broken tcp packet, not netbeui
> > ETHER: Destination = ff:ff:ff:ff:ff:ff, (broadcast)
> > IP: Protocol = 6 (TCP)
> Thats just a corrupt packet. Its not TCP/IP. That or snoop can't handle
> the packets you are seeing.
> NetBEUI frames are 802.2LLC, I've sat and watched them, to an extent I've
> joined in with name resolutions with netbeui equipment.
> Alan
This is what all Microsoft machines transmit when they are configured
for NetBEUI. There have been many trade-magazine articles about this
stuff. Even your former company made switches to filter this stuff.
Because of the network problems these packets create, Microsoft doesn't
even support it any more.

If you look into the "data" area of the packet, you see a NETBIOS header
followed by (finally) data.

Dick Johnson
Penguin : Linux version 2.1.111 on an i586 machine (66.15 BogoMips).
Warning : It's hard to remain at the trailing edge of technology.

To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
Please read the FAQ at