Packet Trace of Win95 Browsing

This is a detailed look at a Win95 machine browsing the Network Neighborhood. All non-IPX transactions are described in detail whenever possible. Some packets are rearranged in order to group transactions together. However, no packet content has been modified.

IPX Stuff

20:31:39.540532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.452:ipx-sap-nearest-req 650 ''
20:31:40.300532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.452:ipx-sap-nearest-req 650 ''
20:31:41.050532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.452:ipx-sap-req 650 ''
20:31:41.810532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.452:ipx-sap-req 650 ''
20:31:42.560532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 40
20:31:43.320532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 40
20:31:44.070532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72
20:31:44.830532 10.00:aa:00:ac:21:3f.400c > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72
20:31:45.590532 10.00:aa:00:ac:21:3f.555 > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72
20:31:47.590532 10.00:aa:00:ac:21:3f.555 > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72
20:31:48.590532 10.00:aa:00:ac:21:3f.555 > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72
20:31:49.590532 10.00:aa:00:ac:21:3f.555 > 0.ff:ff:ff:ff:ff:ff.555: ipx-#555 72

Microsoft Networking

First, the host sends a subnet broadcast to the Local Master Browser, asking for the list of backup-browsers for the CAMPUS workgroup. At the same time, it asks the WINS server for the CAMPUS Domain Controller.

20:31:50.610532 128.2.6.192.138 > 128.2.6.255.138: NBT UDP PACKET(138)
20:31:50.610532 arp who-has 128.2.6.124 tell 128.2.6.192
20:31:50.620532 arp reply 128.2.6.124 is-at 0:e0:8f:9:90:0
20:31:50.620532 128.2.6.192.137 > 128.2.35.60.137: NBT UDP PACKET(137)

When the WINS server responds, our host asks the Domain Controller for it's list of backup browsers for the CAMPUS workgroup.

20:31:50.630532 128.2.35.60.137 > 128.2.6.192.137: NBT UDP PACKET(137)
20:31:50.630532 128.2.6.192.138 > 128.2.35.60.138: NBT UDP PACKET(138)

Finally, the Local Browse Master responds with the list of local backup browsers. The Domain Controller also responds with it's list of backup browsers.

20:31:50.630532 128.2.6.95.138 > 128.2.6.192.138: NBT UDP PACKET(138)
20:31:50.640532 128.2.35.60.138 > 128.2.6.192.138: NBT UDP PACKET(138)

Where Did the List Come From?

As you can see, none of this transaction actually contained the list of hosts available in the current workgroup. I believe this is due to the fact that the local client is synchronizing it's local browse list with the LBM on a regular basis, in hopes of someday becoming a backup browser.

Raw Data: win95-browse.tcpdump
Verbose Decoded Data: win95-browse.verbose.txt

Ryan Troll

Last modified: Tue Sep 8 13:12:12 EDT