I was debugging a user who was having problems connecting through our PM3
with a USR 28.8 (PCMCIA) modem. The problem actually seems to be that his
win95 DUN has been corrupted. However, running dring on the output from
the user's port returns this (it was received in response to an IPCP
request to use VJ compression):
Received UNKNOWN on port S6 of 518 bytes containing:
[NULL] [?][DC2] [ACK] [NULL] [NULL] [NULL] [SOH] [DC1] [ENQ] [NULL]
[SOH] [EOT] [?]' * * * * * * *
d ^ [?][?][?][ACK] [NULL] [NULL] [NULL] [NULL] [?]
[ACK] [NULL] [NULL] [NULL] [NULL] [?][?]G R R [SP]
[SP] [SP] [SP] [SP] [SP] [SP] [SP] [SP] [SP] [ETX] [SOH]
M R . [SP] L U S E R S [SP]
N A M E [ETX] [SOH] [STX] [CR] [NULL] [BEL] [NULL]
[EOT] [NULL] [NULL] W E I R D + [?]a
i n , [CR] [NL] [CR] [NL] > [SP] > [SP]
49 I
Here's what's interesting about this:
1) The 7 *'s are part of the S6 user's password (the first letter seems
to have been truncated). I have used *'s to protect the real password.
2) The rest of the data below the *'s is information from the user that is
on port _S5_. Again I have changed the details, but MR. LUSERS NAME is
the full name of the user that was on port S5, and WEIRD is his username.
I thought this might just old buffer output from a previous login, but the
user that was on S5 had not logged into S6 in (at least) the last 36 hours.
Could someone tell me how data from the two ports (S5 & S6) could be
returned together like this?
Richard Morrell
edNET system admin
richard@ednet.co.uk