<div dir="ltr">Hi i have done tcpdump against AD ip<div><br></div><div><div><i><font color="#9900ff">10:21:34.033939 IP kwtpocpbis01.solipa.local.48731 > kwttestdc001.kwttestdc.com.domain: 39643+ SRV? _ldap._tcp.solipa.local. (41)</font></i></div><div><i><font color="#9900ff">10:21:34.034530 IP kwttestdc001.kwttestdc.com.domain > kwtpocpbis01.solipa.local.48731: 39643 1/0/1 SRV kwtpocpbis01.solipa.local.:389 0 100 (102)</font></i></div><div><i><font color="#9900ff">10:21:38.026794 IP kwtpocpbis01.solipa.local.42160 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [F.], seq 63944419, ack 521272023, win 165, options [nop,nop,TS val 6918912 ecr 248450971], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.027095 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42160: Flags [.], ack 1, win 511, options [nop,nop,TS val 248822622 ecr 6918912], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.027517 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42160: Flags [R.], seq 1, ack 1, win 0, length 0</font></i></div><div><i><font color="#9900ff">10:21:38.031732 IP kwtpocpbis01.solipa.local.34108 > kwttestdc001.kwttestdc.com.domain: 6437+ SRV? _ldap._<a href="http://tcp.kwttestdc.com">tcp.kwttestdc.com</a>. (42)</font></i></div><div><i><font color="#9900ff">10:21:38.032554 IP kwttestdc001.kwttestdc.com.domain > kwtpocpbis01.solipa.local.34108: 6437* 1/0/1 SRV kwttestdc001.kwttestdc.com.:389 0 100 (104)</font></i></div><div><i><font color="#9900ff">10:21:38.032827 IP kwtpocpbis01.solipa.local.48294 > kwttestdc001.kwttestdc.com.domain: 64621+ AAAA? <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>. (44)</font></i></div><div><i><font color="#9900ff">10:21:38.033191 IP kwttestdc001.kwttestdc.com.domain > kwtpocpbis01.solipa.local.48294: 64621* 0/1/0 (91)</font></i></div><div><i><font color="#9900ff">10:21:38.033268 IP kwtpocpbis01.solipa.local.39812 > kwttestdc001.kwttestdc.com.domain: 7211+ AAAA? <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>. (44)</font></i></div><div><i><font color="#9900ff">10:21:38.033797 IP kwttestdc001.kwttestdc.com.domain > kwtpocpbis01.solipa.local.39812: 7211* 0/1/0 (91)</font></i></div><div><i><font color="#9900ff">10:21:38.033836 IP kwtpocpbis01.solipa.local.37700 > kwttestdc001.kwttestdc.com.domain: 48543+ A? <a href="http://kwttestdc001.kwttestdc.com">kwttestdc001.kwttestdc.com</a>. (44)</font></i></div><div><i><font color="#9900ff">10:21:38.034193 IP kwttestdc001.kwttestdc.com.domain > kwtpocpbis01.solipa.local.37700: 48543* 1/0/0 A 172.16.104.231 (60)</font></i></div><div><i><font color="#9900ff">10:21:38.035587 IP kwtpocpbis01.solipa.local.48384 > kwttestdc001.kwttestdc.com.ldap: UDP, length 82</font></i></div><div><i><font color="#9900ff">10:21:38.035925 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.48384: UDP, length 188</font></i></div><div><i><font color="#9900ff">10:21:38.037107 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [S], seq 2172952938, win 14600, options [mss 1460,sackOK,TS val 6918922 ecr 0,nop,wscale 7], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.037577 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [S.], seq 4067674102, ack 2172952939, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 248822623 ecr 6918922], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.037594 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [.], ack 1, win 115, options [nop,nop,TS val 6918922 ecr 248822623], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.037627 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [P.], seq 1:75, ack 1, win 115, options [nop,nop,TS val 6918922 ecr 248822623], length 74</font></i></div><div><i><font color="#9900ff">10:21:38.038501 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [.], seq 1:1449, ack 75, win 514, options [nop,nop,TS val 248822623 ecr 6918922], length 1448</font></i></div><div><i><font color="#9900ff">10:21:38.038520 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [.], ack 1449, win 137, options [nop,nop,TS val 6918923 ecr 248822623], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.038526 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [.], seq 1449:2897, ack 75, win 514, options [nop,nop,TS val 248822623 ecr 6918922], length 1448</font></i></div><div><i><font color="#9900ff">10:21:38.038534 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [.], ack 2897, win 160, options [nop,nop,TS val 6918923 ecr 248822623], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.038703 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [P.], seq 2897:3228, ack 75, win 514, options [nop,nop,TS val 248822623 ecr 6918923], length 331</font></i></div><div><i><font color="#9900ff">10:21:38.038711 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [.], ack 3228, win 182, options [nop,nop,TS val 6918924 ecr 248822623], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.039039 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [P.], seq 75:117, ack 3228, win 182, options [nop,nop,TS val 6918924 ecr 248822623], length 42</font></i></div><div><i><font color="#9900ff">10:21:38.039055 IP kwtpocpbis01.solipa.local.44461 > kwttestdc001.kwttestdc.com.ldap: Flags [F.], seq 117, ack 3228, win 182, options [nop,nop,TS val 6918924 ecr 248822623], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.039383 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [.], ack 118, win 514, options [nop,nop,TS val 248822623 ecr 6918924], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.039406 IP kwttestdc001.kwttestdc.com.ldap > kwtpocpbis01.solipa.local.44461: Flags [R.], seq 3228, ack 118, win 0, length 0</font></i></div><div><i><font color="#9900ff">10:21:38.042568 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [S], seq 3200525455, win 14600, options [mss 1460,sackOK,TS val 6918927 ecr 0,nop,wscale 7], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.042810 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [S.], seq 2793269455, ack 3200525456, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 248822624 ecr 6918927], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.042829 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [.], ack 1, win 115, options [nop,nop,TS val 6918928 ecr 248822624], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.043374 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1:195, ack 1, win 115, options [nop,nop,TS val 6918928 ecr 248822624], length 194SMB PACKET: SMBnegprot (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.043903 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1:210, ack 195, win 514, options [nop,nop,TS val 248822624 ecr 6918928], length 209SMB PACKET: SMBnegprot (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.043919 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [.], ack 210, win 123, options [nop,nop,TS val 6918929 ecr 248822624], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.044868 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 195:387, ack 210, win 123, options [nop,nop,TS val 6918930 ecr 248822624], length 192SMB PACKET: SMBsesssetupX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.045203 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 210:732, ack 387, win 513, options [nop,nop,TS val 248822624 ecr 6918930], length 522SMB PACKET: SMBsesssetupX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.045770 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 387:905, ack 732, win 131, options [nop,nop,TS val 6918931 ecr 248822624], length 518SMB PACKET: SMBsesssetupX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.047195 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 732:972, ack 905, win 511, options [nop,nop,TS val 248822624 ecr 6918931], length 240SMB PACKET: SMBsesssetupX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.047568 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 905:1027, ack 972, win 140, options [nop,nop,TS val 6918932 ecr 248822624], length 122SMB PACKET: SMBtconX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.047985 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 972:1032, ack 1027, win 511, options [nop,nop,TS val 248822624 ecr 6918932], length 60SMB PACKET: SMBtconX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.048235 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1027:1131, ack 1032, win 140, options [nop,nop,TS val 6918933 ecr 248822624], length 104SMB PACKET: SMBntcreateX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.048698 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1032:1139, ack 1131, win 511, options [nop,nop,TS val 248822624 ecr 6918933], length 107SMB PACKET: SMBntcreateX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.048989 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1131:1291, ack 1139, win 140, options [nop,nop,TS val 6918934 ecr 248822624], length 160SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.049378 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1139:1267, ack 1291, win 510, options [nop,nop,TS val 248822624 ecr 6918934], length 128SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.050552 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1291:1459, ack 1267, win 148, options [nop,nop,TS val 6918935 ecr 248822624], length 168SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.050950 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1267:1375, ack 1459, win 509, options [nop,nop,TS val 248822625 ecr 6918935], length 108SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.051805 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1459:1593, ack 1375, win 148, options [nop,nop,TS val 6918937 ecr 248822625], length 134SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.052072 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1375:1655, ack 1593, win 509, options [nop,nop,TS val 248822625 ecr 6918937], length 280SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.053560 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1593:1727, ack 1655, win 156, options [nop,nop,TS val 6918938 ecr 248822625], length 134SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.053875 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1655:1755, ack 1727, win 514, options [nop,nop,TS val 248822625 ecr 6918938], length 100SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.060487 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1727:1905, ack 1755, win 156, options [nop,nop,TS val 6918945 ecr 248822625], length 178SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.061143 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1755:1999, ack 1905, win 514, options [nop,nop,TS val 248822626 ecr 6918945], length 244SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.063073 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1905:2065, ack 1999, win 165, options [nop,nop,TS val 6918948 ecr 248822626], length 160SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.069191 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 1999:2087, ack 2065, win 513, options [nop,nop,TS val 248822626 ecr 6918948], length 88SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.088743 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 2065:3421, ack 2087, win 165, options [nop,nop,TS val 6918974 ecr 248822626], length 1356SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.203820 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 2087:2195, ack 3421, win 514, options [nop,nop,TS val 248822640 ecr 6918974], length 108SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.205063 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 3421:3601, ack 2195, win 165, options [nop,nop,TS val 6919090 ecr 248822640], length 180SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.205715 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 2195:2303, ack 3601, win 514, options [nop,nop,TS val 248822640 ecr 6919090], length 108SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.206634 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 3601:3741, ack 2303, win 165, options [nop,nop,TS val 6919092 ecr 248822640], length 140SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.209567 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 2303:2391, ack 3741, win 513, options [nop,nop,TS val 248822640 ecr 6919092], length 88SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.210883 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 3741:3997, ack 2391, win 165, options [nop,nop,TS val 6919096 ecr 248822640], length 256SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.290133 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 2391:2479, ack 3997, win 512, options [nop,nop,TS val 248822647 ecr 6919096], length 88SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.291716 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 3997:4262, ack 2479, win 165, options [nop,nop,TS val 6919177 ecr 248822647], length 265SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.294583 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42260: Flags [P.], seq 2479:2571, ack 4262, win 511, options [nop,nop,TS val 248822649 ecr 6919177], length 92SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.333630 IP kwtpocpbis01.solipa.local.42260 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [.], ack 2571, win 165, options [nop,nop,TS val 6919219 ecr 248822649], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.713471 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [S], seq 1205005628, win 14600, options [mss 1460,sackOK,TS val 6919598 ecr 0,nop,wscale 7], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.713838 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [S.], seq 3996989028, ack 1205005629, win 8192, options [mss 1460,nop,wscale 8,sackOK,TS val 248822691 ecr 6919598], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.713861 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [.], ack 1, win 115, options [nop,nop,TS val 6919599 ecr 248822691], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.714196 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1:195, ack 1, win 115, options [nop,nop,TS val 6919599 ecr 248822691], length 194SMB PACKET: SMBnegprot (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.714773 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 1:210, ack 195, win 514, options [nop,nop,TS val 248822691 ecr 6919599], length 209SMB PACKET: SMBnegprot (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.714787 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [.], ack 210, win 123, options [nop,nop,TS val 6919600 ecr 248822691], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.715561 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 195:387, ack 210, win 123, options [nop,nop,TS val 6919600 ecr 248822691], length 192SMB PACKET: SMBsesssetupX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.715981 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 210:732, ack 387, win 513, options [nop,nop,TS val 248822691 ecr 6919600], length 522SMB PACKET: SMBsesssetupX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.716465 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 387:905, ack 732, win 131, options [nop,nop,TS val 6919601 ecr 248822691], length 518SMB PACKET: SMBsesssetupX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.718165 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 732:972, ack 905, win 511, options [nop,nop,TS val 248822691 ecr 6919601], length 240SMB PACKET: SMBsesssetupX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.718455 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 905:1027, ack 972, win 140, options [nop,nop,TS val 6919603 ecr 248822691], length 122SMB PACKET: SMBtconX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.718773 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 972:1032, ack 1027, win 511, options [nop,nop,TS val 248822691 ecr 6919603], length 60SMB PACKET: SMBtconX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.719028 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1027:1135, ack 1032, win 140, options [nop,nop,TS val 6919604 ecr 248822691], length 108SMB PACKET: SMBntcreateX (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.719404 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 1032:1139, ack 1135, win 511, options [nop,nop,TS val 248822691 ecr 6919604], length 107SMB PACKET: SMBntcreateX (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.719791 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1135:1295, ack 1139, win 140, options [nop,nop,TS val 6919605 ecr 248822691], length 160SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.720098 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 1139:1267, ack 1295, win 510, options [nop,nop,TS val 248822691 ecr 6919605], length 128SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.720995 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [P.], seq 1295:1465, ack 1267, win 148, options [nop,nop,TS val 6919606 ecr 248822691], length 170SMB PACKET: SMBtrans (REQUEST)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.721306 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [P.], seq 1267:1395, ack 1465, win 509, options [nop,nop,TS val 248822692 ecr 6919606], length 128SMB PACKET: SMBtrans (REPLY)</font></i></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff">10:21:38.722086 IP kwtpocpbis01.solipa.local.42261 > kwttestdc001.kwttestdc.com.microsoft-ds: Flags [F.], seq 1465, ack 1395, win 156, options [nop,nop,TS val 6919607 ecr 248822692], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.722665 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [.], ack 1466, win 509, options [nop,nop,TS val 248822692 ecr 6919607], length 0</font></i></div><div><i><font color="#9900ff">10:21:38.722735 IP kwttestdc001.kwttestdc.com.microsoft-ds > kwtpocpbis01.solipa.local.42261: Flags [R.], seq 1395, ack 1466, win 0, length 0</font></i></div></div><div><i><font color="#9900ff"><br></font></i></div><div><i><font color="#9900ff"><br></font></i></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Mar 4, 2015 at 10:07 AM, Alexander Bokovoy <span dir="ltr"><<a href="mailto:abokovoy@redhat.com" target="_blank">abokovoy@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On Wed, 04 Mar 2015, Ben .T.George wrote:<br>
</span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">
HI<br>
<br>
i have re-installed IPA with latest 4.1 version.<br>
<br>
installed packages by using<br>
<a href="https://copr.fedoraproject.org/coprs/mkosek/freeipa/" target="_blank">https://copr.fedoraproject.<u></u>org/coprs/mkosek/freeipa/</a> repos<br>
<br>
# ipa-server-install went successfully without any error an it says the<br>
same on log files<br>
<br></span>
*[root@kwtpocpbis01 ~]# kinit admin*<br>
*Password for admin@SOLIPA.LOCAL:*<br>
*[root@kwtpocpbis01 ~]# klist*<br>
*Ticket cache: KEYRING:persistent:0:0*<br>
*Default principal: admin@SOLIPA.LOCAL*<br>
<br>
*Valid starting Expires Service principal*<br>
*03/04/2015 08:36:55 03/05/2015 08:36:51 krbtgt/SOLIPA.LOCAL@SOLIPA.<u></u>LOCAL*<br>
*[root@kwtpocpbis01 ~]# geten*<br>
*getenforce getent*<br>
*[root@kwtpocpbis01 ~]# getent passwd admin*<br>
*admin:*:4400000:4400000:<u></u>Administrator:/home/admin:/<u></u>bin/bash*<br>
<br>
<br>
*# ipa-adtrust-install --netbios-name=SOLIPA -a Passw0rd* also successfully<span class=""><br>
went .<br>
<br>
DNS is working fine as expected.<br>
<br></span>
*[root@kwtpocpbis01 ~]# dig SRV _ldap._<a href="http://tcp.kwttestdc.com" target="_blank">tcp.kwttestdc.com</a><br>
<<a href="http://tcp.kwttestdc.com" target="_blank">http://tcp.kwttestdc.com</a>>*<br>
<br>
*; <<>> DiG 9.9.4-RedHat-9.9.4-20.el7.<u></u>centos.pkcs11 <<>> SRV<br>
_ldap._<a href="http://tcp.kwttestdc.com" target="_blank">tcp.kwttestdc.com</a> <<a href="http://tcp.kwttestdc.com" target="_blank">http://tcp.kwttestdc.com</a>>*<br>
*;; global options: +cmd*<br>
*;; Got answer:*<br>
*;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 26944*<br>
*;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2*<br>
<br>
*;; OPT PSEUDOSECTION:*<br>
*; EDNS: version: 0, flags:; udp: 4000*<br>
*;; QUESTION SECTION:*<br>
*;_ldap._<a href="http://tcp.kwttestdc.com" target="_blank">tcp.kwttestdc.com</a> <<a href="http://tcp.kwttestdc.com" target="_blank">http://tcp.kwttestdc.com</a>>. IN SRV*<br>
<br>
*;; ANSWER SECTION:*<br>
*_ldap._<a href="http://tcp.kwttestdc.com" target="_blank">tcp.kwttestdc.com</a> <<a href="http://tcp.kwttestdc.com" target="_blank">http://tcp.kwttestdc.com</a>>. 600 IN SRV<br>
0 100 389 <a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a> <<a href="http://kwttestdc001.kwttestdc.com" target="_blank">http://kwttestdc001.<u></u>kwttestdc.com</a>>.*<br>
<br>
*;; ADDITIONAL SECTION:*<br>
*<a href="http://kwttestdc001.kwttestdc.com" target="_blank">kwttestdc001.kwttestdc.com</a> <<a href="http://kwttestdc001.kwttestdc.com" target="_blank">http://kwttestdc001.<u></u>kwttestdc.com</a>>. 3600 IN<br>
A 172.16.104.231*<br>
<br>
*;; Query time: 0 msec*<br>
*;; SERVER: 172.16.104.231#53(172.16.104.<u></u>231)*<br>
*;; WHEN: Wed Mar 04 08:41:26 AST 2015*<br>
*;; MSG SIZE rcvd: 115*<br>
<br>
*[root@kwtpocpbis01 ~]# dig SRV _ldap._tcp.solipa.local*<br>
<br>
*; <<>> DiG 9.9.4-RedHat-9.9.4-20.el7.<u></u>centos.pkcs11 <<>> SRV<br>
_ldap._tcp.solipa.local*<br>
*;; global options: +cmd*<br>
*;; Got answer:*<br>
*;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 6196*<br>
*;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 2*<br>
<br>
*;; OPT PSEUDOSECTION:*<br>
*; EDNS: version: 0, flags:; udp: 4000*<br>
*;; QUESTION SECTION:*<br>
*;_ldap._tcp.solipa.local. IN SRV*<br>
<br>
*;; ANSWER SECTION:*<br>
*_ldap._tcp.solipa.local. 11944 IN SRV 0 100 389<br>
kwtpocpbis01.solipa.local.*<br>
<br>
*;; ADDITIONAL SECTION:*<br>
*kwtpocpbis01.solipa.local. 1200 IN A 172.16.107.244*<br>
<br>
*;; Query time: 2 msec*<br>
*;; SERVER: 172.16.104.231#53(172.16.104.<u></u>231)*<br>
*;; WHEN: Wed Mar 04 08:41:34 AST 2015*<br>
*;; MSG SIZE rcvd: 113*<span class=""><br>
<br>
But when i try to trust add AD, i am getting error<br>
<br>
[root@kwtpocpbis01 ~]# ipa trust-add --type=ad <a href="http://kwttestdc.com" target="_blank">kwttestdc.com</a> --admin<br>
adm-ben.george --password<br>
Active Directory domain administrator's password:<br>
ipa: ERROR: AD DC was unable to reach any IPA domain controller. Most<br>
likely it is a DNS or firewall issue<br>
<br>
I checked from firewall status on both IPA and AD, and it was in off state.<br>
</span></blockquote>
You really need to find out what is wrong between AD and IPA. The<br>
message above is based on what AD DC reports back to IPA when it tried<br>
to validate the trust and was not able to contact IPA DCs.<br>
<br>
We cannot influence ourselves this part, as AD DC uses SRV records in<br>
DNS to find out which domain controller to contact and if it fails to<br>
contact us for any reason (firewall, DNS is broken from AD DC<br>
perspective, routing brings it to a different IP address, etc), it will<br>
complain like that and never proceed.<br>
<br>
You may try to run tcpdump or wireshark and see what happens on the<br>
network at the time of 'ipa trust-add', specifically, whom AD DC is<br>
talking to and where it takes a DNS record.<span class="HOEnZb"><font color="#888888"><br>
<br>
-- <br>
/ Alexander Bokovoy<br>
</font></span></blockquote></div><br></div>