Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.os.linux.networking > #4244 > unrolled thread

Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share

Back to article view | Back to comp.os.linux.networking

Contents

  Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share "NY" <me@privacy.net> - 2018-09-02 20:18 +0100
    Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share Dan Purgert <dan@djph.net> - 2018-09-03 10:40 +0000
      Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share Jorgen Grahn <grahn+nntp@snipabacken.se> - 2018-09-03 14:55 +0000
        Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share Dan Purgert <dan@djph.net> - 2018-09-03 15:54 +0000
          Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share "NY" <me@privacy.net> - 2018-09-03 21:04 +0100
      Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share "NY" <me@privacy.net> - 2018-09-03 20:58 +0100
        Re: Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share Dan Purgert <dan@djph.net> - 2018-09-03 20:16 +0000

#4244 — Ubuntu 18.04 acting as client to Windows "server" - can't see list of Windows PC's shares or connect to a share

I've got a Windows PC with various public shared directories which can be 
accessed by other Windows PCs without needing username/password.

I'm trying to use the "Files" application of Ubuntu 18.04 to do the same 
thing. When I go to Other Locations, then Windows Network, WORKGROUP, 
<Windows PC> I get a response "Failed to receive share list from server: 
invalid argument".

I've looked at a Wireshark LAN trace and can see:

- negotiation of SMB2 (rather than SMB) protocol
- session setup NTLMSSP_AUTH
- tree connect \\martin-7\IPC$     (martin-7 is the Win 7 computer with the 
shares)
- Ubuntu attempts to create request file srvsvc but Martin-7 responds 
"access denied"

Any thoughts? This is a vanilla installation of Ubuntu, with "sudo apt 
install samba". If it's relevant, the converse process works fine: in Files, 
right-click on a folder Local Network Share (share this folder as <name>, 
allow others, guest) - the Windows PC can read/write to that shared folder.


I have a network-connected printer which shares its SD card reader, and the 
same operations allow Ubuntu to access and display its share list. I was 
hoping to get a LAN trace of that, to compare and look for differences, but 
I'm thwarted by modern networking technology (a switch rather than hub) 
which won't distribute any traffic to the monitoring PC (Windows - 
Wireshark) if its source (Ubuntu) or destination (printer) is on other 
Ethernet ports. I've got a bit of a logic puzzle:

- Windows PC has Ethernet but no wifi device
- laptop has Ethernet and wifi: this is the device that's running Ubuntu
- printer has Ethernet and wifi

I've tried with all three devices on Ethernet, to separate ports of the same 
hub/switch (an Ethernet-over-mains device with multiple Ethernet ports). 
Ubuntu laptop pinging printer - no traffic visible on Windows PC.

I was going to run Wireshark on the Ubuntu PC, which would mean it would be 
on a LAN segment that would see all the traffic, but I can't find a 
pre-built .deb installation package for Wireshark.

I don't have a USB wifi adaptor for the Windows PC, otherwise I'd try that - 
because wifi traffic will go everywhere.

I suppose all of this is academic and for curiosity of comparing traces. 
What I'm really after is a solution to the problem.


I've found web pages which imply that "it should just work", as should Other 
Locations | Connect to server with "smb://windows-PC/sharename" (that fails 
with "Failed to mount Windows share: file exists" when I connect as 
anonymous). 

[toc] | [next] | [standalone]

#4245

NY wrote:
> [...]
> I've looked at a Wireshark LAN trace and can see:
>
> - negotiation of SMB2 (rather than SMB) protocol
> - session setup NTLMSSP_AUTH
> - tree connect \\martin-7\IPC$     (martin-7 is the Win 7 computer
> with the shares)
> - Ubuntu attempts to create request file srvsvc but Martin-7 responds 
> "access denied"

SMBv2 shouldn't be a problem with Win7 -- but it's been ages since I've
run it.  Found this msft support link [1] which seems to have some info
about it.

Sounds like you're probably sending the wrong authentication
credentials.  I (fuzzily) recall that I would have to present them as
"COMPUTERNAME\username" instead of just "username", when I had windows
boxes.

>
>
> I have a network-connected printer which shares its SD card reader,
> and the same operations allow Ubuntu to access and display its share
> list. I was hoping to get a LAN trace of that, to compare and look for
> differences, but I'm thwarted by modern networking technology (a
> switch rather than hub) which won't distribute any traffic to the
> monitoring PC (Windows - Wireshark) if its source (Ubuntu) or
> destination (printer) is on other Ethernet ports. I've got a bit of a
> logic puzzle:

You have to enable "promiscuous mode" on the interface. You should still
see the traffic (especially if it's not a fully managed switch).

> [...]
> I was going to run Wireshark on the Ubuntu PC, which would mean it
> would be on a LAN segment that would see all the traffic, but I can't
> find a pre-built .deb installation package for Wireshark.

Should be in the repos. A simple 'sudo apt-get install wireshark' should
do it for you (note, the recommended approach of using it on Linux is to
add yourself to the wireshark group, rather than running wireshark as
root.  You'll need to logout/login for that new group to take effect)


[1]
https://support.microsoft.com/en-gb/help/2696547/how-to-detect-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4246

On Mon, 2018-09-03, Dan Purgert wrote:
> NY wrote:
...
>> I have a network-connected printer which shares its SD card reader,
>> and the same operations allow Ubuntu to access and display its share
>> list. I was hoping to get a LAN trace of that, to compare and look for
>> differences, but I'm thwarted by modern networking technology (a
>> switch rather than hub) which won't distribute any traffic to the
>> monitoring PC (Windows - Wireshark) if its source (Ubuntu) or
>> destination (printer) is on other Ethernet ports. I've got a bit of a
>> logic puzzle:
>
> You have to enable "promiscuous mode" on the interface. You should still
> see the traffic

That doesn't sound right.  If you have three hosts A, B, C connected
through a normal switch, A is going to see very little of the B--C
communication because the switch is smarter than a hub and won't flood
all traffic on all ports.  A can put its NIC into promiscuous mode,
but that won't help when no traffic is sent out on the corresponding
port!

> (especially if it's not a fully managed switch).

No; if it's a managed switch you're better off: you could tell the
switch "port 14 should be a mirror port".

/Jorgen

-- 
  // Jorgen Grahn <grahn@  Oo  o.   .     .
\X/     snipabacken.se>   O  o   .

[toc] | [prev] | [next] | [standalone]

#4247

Jorgen Grahn wrote:
> On Mon, 2018-09-03, Dan Purgert wrote:
>> NY wrote:
> ...
>>> I have a network-connected printer which shares its SD card reader,
>>> and the same operations allow Ubuntu to access and display its share
>>> list. I was hoping to get a LAN trace of that, to compare and look for
>>> differences, but I'm thwarted by modern networking technology (a
>>> switch rather than hub) which won't distribute any traffic to the
>>> monitoring PC (Windows - Wireshark) if its source (Ubuntu) or
>>> destination (printer) is on other Ethernet ports. I've got a bit of a
>>> logic puzzle:
>>
>> You have to enable "promiscuous mode" on the interface. You should still
>> see the traffic
>
> That doesn't sound right.  If you have three hosts A, B, C connected
> through a normal switch, A is going to see very little of the B--C
> communication because the switch is smarter than a hub and won't flood
> all traffic on all ports.  A can put its NIC into promiscuous mode,
> but that won't help when no traffic is sent out on the corresponding
> port!

Works fine when dealing with dumb switches around here. Although it does
work better when one can use a managed switch and mirror the port.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [next] | [standalone]

#4251

"Dan Purgert" <dan@djph.net> wrote in message 
news:slrnpoqm9t.u91.dan@xps-linux.djph.net...
> Jorgen Grahn wrote:
>> On Mon, 2018-09-03, Dan Purgert wrote:
>>> NY wrote:
>> ...
>>>> I have a network-connected printer which shares its SD card reader,
>>>> and the same operations allow Ubuntu to access and display its share
>>>> list. I was hoping to get a LAN trace of that, to compare and look for
>>>> differences, but I'm thwarted by modern networking technology (a
>>>> switch rather than hub) which won't distribute any traffic to the
>>>> monitoring PC (Windows - Wireshark) if its source (Ubuntu) or
>>>> destination (printer) is on other Ethernet ports. I've got a bit of a
>>>> logic puzzle:
>>>
>>> You have to enable "promiscuous mode" on the interface. You should still
>>> see the traffic
>>
>> That doesn't sound right.  If you have three hosts A, B, C connected
>> through a normal switch, A is going to see very little of the B--C
>> communication because the switch is smarter than a hub and won't flood
>> all traffic on all ports.  A can put its NIC into promiscuous mode,
>> but that won't help when no traffic is sent out on the corresponding
>> port!
>
> Works fine when dealing with dumb switches around here. Although it does
> work better when one can use a managed switch and mirror the port.

I thought the whole point of a switch (as opposed to a hub) was that it 
learned which device (and therefore IP address) was on each port, and 
filtered traffic so each port only saw data to or from the IP of that device 
(and broadcasts etc).

It does mean that you need to run the LAN monitoring program on one of the 
two devices that is engaged in the conversation that you want to capture.

With a dumb hub, all traffic goes out of all Ethernet ports (plus wifi) so 
you don't have the problem as long as the LAN monitor's adaptor is 
promiscuous. 

[toc] | [prev] | [next] | [standalone]

#4250

"Dan Purgert" <dan@djph.net> wrote in message 
news:slrnpoq3tk.u91.dan@xps-linux.djph.net...
> NY wrote:
>> [...]
>> I've looked at a Wireshark LAN trace and can see:
>>
>> - negotiation of SMB2 (rather than SMB) protocol
>> - session setup NTLMSSP_AUTH
>> - tree connect \\martin-7\IPC$     (martin-7 is the Win 7 computer
>> with the shares)
>> - Ubuntu attempts to create request file srvsvc but Martin-7 responds
>> "access denied"
>
> SMBv2 shouldn't be a problem with Win7 -- but it's been ages since I've
> run it.  Found this msft support link [1] which seems to have some info
> about it.
>
> Sounds like you're probably sending the wrong authentication
> credentials.  I (fuzzily) recall that I would have to present them as
> "COMPUTERNAME\username" instead of just "username", when I had windows
> boxes.

After comparing traffic from Windows to Windows share with Ubuntu to Window 
share, I found the difference: the Session Setup gives a non-blank username, 
password and workgroup for a Windows client, but even if you fill in 
username and workgroup fields on ubuntu's Authentication dialog, all the 
fields are blank unless you *also* fill in a non-blank password. I fell into 
the trap of thinking that if I was going to have to specify a username, the 
password should be correct for that username - ie blank, in my case.

The trick is to set the three fields to any old *non-blank* rubbish, and 
then it works - in my case where the share is configured not to validate the 
credentials and to give guest access.

Also, it is a mistake to use a user that exists on the Ubuntu client, no 
matter whether the password is correct or not - instead fill in gibberish 
that does not match an existing user.



> You have to enable "promiscuous mode" on the interface. You should still
> see the traffic (especially if it's not a fully managed switch).

Yes I have promiscuous mode turned on. I knew about that. I assumed that the 
problem was that traffic between B and C was never arriving at the Wireshark 
PC "A", rather than that Wireshark was filtering it out if it wasn't to or 
from A.

>> [...]
>> I was going to run Wireshark on the Ubuntu PC, which would mean it
>> would be on a LAN segment that would see all the traffic, but I can't
>> find a pre-built .deb installation package for Wireshark.
>
> Should be in the repos. A simple 'sudo apt-get install wireshark' should
> do it for you (note, the recommended approach of using it on Linux is to
> add yourself to the wireshark group, rather than running wireshark as
> root.  You'll need to logout/login for that new group to take effect)

I found it. Up until today I'd been running Ubuntu in trial mode, because I 
couldn't find a power supply (like a laptop uses) for the PC that I was 
going to install on, so I was testing it on my laptop. The available 
packages in trial mode are considerably less than in real install mode. I 
found wireshark and got it running fine.

As a matter of interest, can you set up a single display filter that only 
shows traffic between two devices, or do you have to do it as four rules: 
(src=A and dest=B) or (src=B and dest=A). I expected that this would be the 
default action if I right-clicked on a packet from A to B and chose 
"generate rule", but it simply created a src=A rule.


Interesting: when I worked on "LAN Manager for UNIX" for ICL *twenty five* 
years ago (how time flies) we had to buy a dedicated laptop and dedicated 
capture and protocol analysis software, the Sniffer, at great expense. Now 
any old laptop can run Wireshark for free and get the same functionality and 
more detailed breakdown of individual fields in protocols. Ironically the 
bottom dropped out of our product after a few years when Novell started 
bundling an SMB server package with their OS, whereas we were selling ours 
as an added extra. Such is life! 

[toc] | [prev] | [next] | [standalone]

#4252

NY wrote:
> "Dan Purgert" <dan@djph.net> wrote in message 
> news:slrnpoq3tk.u91.dan@xps-linux.djph.net...
>> NY wrote:
>>> [...]
>>> I was going to run Wireshark on the Ubuntu PC, which would mean it
>>> would be on a LAN segment that would see all the traffic, but I can't
>>> find a pre-built .deb installation package for Wireshark.
>>
>> Should be in the repos. A simple 'sudo apt-get install wireshark' should
>> do it for you (note, the recommended approach of using it on Linux is to
>> add yourself to the wireshark group, rather than running wireshark as
>> root.  You'll need to logout/login for that new group to take effect)
>
> I found it. Up until today I'd been running Ubuntu in trial mode, because I 
> couldn't find a power supply (like a laptop uses) for the PC that I was 
> going to install on, so I was testing it on my laptop. The available 
> packages in trial mode are considerably less than in real install mode. I 
> found wireshark and got it running fine.

Um, no, theres no difference in the repos.
>
> As a matter of interest, can you set up a single display filter that only 
> shows traffic between two devices, or do you have to do it as four rules: 
> (src=A and dest=B) or (src=B and dest=A). I expected that this would be the 
> default action if I right-clicked on a packet from A to B and chose 
> "generate rule", but it simply created a src=A rule.

Should work as one rule.


-- 
|_|O|_| Registered Linux user #585947
|_|_|O| Github: https://github.com/dpurgert
|O|O|O| PGP: 05CA 9A50 3F2E 1335 4DC5  4AEE 8E11 DDF3 1279 A281

[toc] | [prev] | [standalone]

Back to top | Article view | comp.os.linux.networking

csiph-web