Thread Info
  • State Not Answered
  • Replies 1 reply
  • Subscribers 3 subscribers
  • Views 230 views
  • Users 0 members are here
Options
Suggested

Strange behaviour regarding printer search of Windows Server OS VMs behind Sophos UTM Firewall

Bepo

Hello Community,

we use a Sophos UTM cluster consisting of two nodes running on Sophos UTM 9.718-5

This Cluster routes the traffic through specific vlans.

We have strange behavior with windows server vms that are operated in vlans behind the sophos utm.
If we open "Printers & Scanners" on the servers via the windows icon and want to search for printers that are shared in our directory (Active Directory), nothing is found.

If we then use the function: "the printer that i want isn't listed" and use: "find a printer in the directory...." then all printers that are published in the directory via the print server will be displayed.

If we switch the exact same server that doesn't work into a VLAN that is not routed via the firewall cluster, the problem doesn't exist and the printers are found directly


The problem does not occur with Windows 10 clients that are operated in VLANs behind the firewall.

We have excluded the following things:

- ANY firewall rules to exclude firewall
- Firewall rules between server vm and printerserver
- Firewall rules between server vm and active directory servers
- GPO settings checked
- Sites and Services checked
- DHCP & DNS checked

Has anyone ever had problems like this?

Best regards 

Benedict Poppe



edited things we excluded
[edited by: Bepo at 11:45 AM (GMT -7) on 23 Apr 2024]
  • 0

    I created a tcpdump directly on sophos utm (VLAN LAG interface) to see which traffic is sent by the windows server if i click on "add a printer or scanner"

    %fwname%:/home/login # tcpdump -i lag1 src host 192.168.91.20 and not dst host 192.168.17.100 and dst host not 192.168.17.248
tcpdump: WARNING: lag1: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on lag1, link-type EN10MB (Ethernet), capture size 65535 bytes
14:03:13.456356 IP 192.168.91.20 > igmp.mcast.net: igmp v3 report, 1 group record(s)
14:03:13.461680 IP 192.168.91.20 > igmp.mcast.net: igmp v3 report, 1 group record(s)
14:03:13.464148 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:13.464576 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:13.464845 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:13.465149 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:13.467272 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:13.467480 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipps._tcp.local. (34)
14:03:13.468548 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:13.470132 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [SEW], seq 1782462921, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.470167 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [SEW], seq 1782462921, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.470435 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 3144984031, win 8195, length 0
14:03:13.470451 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1, win 8195, length 0
14:03:13.470478 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 0:160, ack 1, win 8195, length 160
14:03:13.470488 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 0:160, ack 1, win 8195, length 160
14:03:13.470832 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 160:328, ack 109, win 8194, length 168
14:03:13.470841 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 160:328, ack 109, win 8194, length 168
14:03:13.471313 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [P.], seq 550953508:550953712, ack 786569420, win 1023, length 204
14:03:13.471325 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [P.], seq 0:204, ack 1, win 1023, length 204
14:03:13.471706 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [P.], seq 204:344, ack 205, win 1022, length 140
14:03:13.471714 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [P.], seq 204:344, ack 205, win 1022, length 140
14:03:13.473875 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 3629184564, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.473904 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 3629184564, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.474116 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1265090436, win 1026, length 0
14:03:13.474133 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1, win 1026, length 0
14:03:13.474635 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4905, ack 1, win 1026, length 4905
14:03:13.474646 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4905, ack 1, win 1026, length 4905
14:03:13.476379 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4905:5062, ack 213, win 1025, length 157
14:03:13.476387 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4905:5062, ack 213, win 1025, length 157
14:03:13.476495 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:13.476745 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5062:5218, ack 384, win 1025, length 156
14:03:13.490878 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 377, win 8193, length 0
14:03:13.490880 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 1024, length 0
14:03:13.490890 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 1024, length 0
14:03:13.490891 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 377, win 8193, length 0
14:03:13.490878 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [.], ack 345, win 1022, length 0
14:03:13.490901 IP 192.168.91.20.50231 > DCSRV08.%DOMAIN_NAME%.local.49668: Flags [.], ack 345, win 1022, length 0
14:03:13.506513 IP 192.168.91.20 > igmp.mcast.net: igmp v3 report, 1 group record(s)
14:03:13.525117 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:13.525601 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:13.547312 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5218:5303, ack 558, win 1024, length 85
14:03:13.547328 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5218:5303, ack 558, win 1024, length 85
14:03:13.547819 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 3614, win 1026, length 0
14:03:13.547831 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 3614, win 1026, length 0
14:03:13.549637 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5303:5347, ack 3614, win 1026, length 44
14:03:13.549649 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5303:5347, ack 3614, win 1026, length 44
14:03:13.549799 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 5347, ack 3614, win 1026, length 0
14:03:13.549811 IP 192.168.91.20.50239 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 5347, ack 3614, win 1026, length 0
14:03:13.550692 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2730824728, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.550731 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2730824728, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.551074 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 121058201, win 8195, length 0
14:03:13.551093 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1, win 8195, length 0
14:03:13.551602 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4905, ack 1, win 8195, length 4905
14:03:13.551616 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4905, ack 1, win 8195, length 4905
14:03:13.553501 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4905:5062, ack 213, win 8194, length 157
14:03:13.553512 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4905:5062, ack 213, win 8194, length 157
14:03:13.554088 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5062:5218, ack 384, win 8193, length 156
14:03:13.554099 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5062:5218, ack 384, win 8193, length 156
14:03:13.569005 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.569028 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.584851 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:13.617144 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5218:5337, ack 558, win 8193, length 119
14:03:13.617156 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5218:5337, ack 558, win 8193, length 119
14:03:13.623002 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [SEW], seq 747338663, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.623033 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [SEW], seq 747338663, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.623261 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 3796944145, win 8195, length 0
14:03:13.623277 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1, win 8195, length 0
14:03:13.623293 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 0:160, ack 1, win 8195, length 160
14:03:13.623303 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 0:160, ack 1, win 8195, length 160
14:03:13.623639 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 160:328, ack 109, win 8194, length 168
14:03:13.623647 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 160:328, ack 109, win 8194, length 168
14:03:13.624109 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 4139061443:4139061647, ack 4245423566, win 8195, length 204
14:03:13.624120 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 0:204, ack 1, win 8195, length 204
14:03:13.624471 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 204:472, ack 205, win 8194, length 268
14:03:13.624479 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 204:472, ack 205, win 8194, length 268
14:03:13.625390 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 472:612, ack 585, win 8193, length 140
14:03:13.625401 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 472:612, ack 585, win 8193, length 140
14:03:13.626160 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 328:496, ack 377, win 8193, length 168
14:03:13.626168 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 328:496, ack 377, win 8193, length 168
14:03:13.626525 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 612:816, ack 725, win 8192, length 204
14:03:13.626536 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 612:816, ack 725, win 8192, length 204
14:03:13.626777 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 816:1084, ack 929, win 8191, length 268
14:03:13.626786 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 816:1084, ack 929, win 8191, length 268
14:03:13.627576 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1084:1224, ack 1309, win 8190, length 140
14:03:13.627584 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1084:1224, ack 1309, win 8190, length 140
14:03:13.627915 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5337:5485, ack 707, win 8192, length 148
14:03:13.627927 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5337:5485, ack 707, win 8192, length 148
14:03:13.628610 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5485:5667, ack 912, win 8191, length 182
14:03:13.628621 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5485:5667, ack 912, win 8191, length 182
14:03:13.629843 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 12333, win 8195, length 0
14:03:13.629854 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 12333, win 8195, length 0
14:03:13.630237 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5667:5752, ack 12333, win 8195, length 85
14:03:13.630248 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5667:5752, ack 12333, win 8195, length 85
14:03:13.630566 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 15389, win 8195, length 0
14:03:13.630577 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 15389, win 8195, length 0
14:03:13.632061 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:13.632444 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:13.634674 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5752:5925, ack 15389, win 8195, length 173
14:03:13.634687 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5752:5925, ack 15389, win 8195, length 173
14:03:13.635097 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5925:6132, ack 15581, win 8194, length 207
14:03:13.635115 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5925:6132, ack 15581, win 8194, length 207
14:03:13.635485 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 18886, win 8195, length 0
14:03:13.635504 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 18886, win 8195, length 0
14:03:13.635844 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6132:6454, ack 18886, win 8195, length 322
14:03:13.635855 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6132:6454, ack 18886, win 8195, length 322
14:03:13.637902 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6454:6498, ack 18941, win 8195, length 44
14:03:13.637912 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6454:6498, ack 18941, win 8195, length 44
14:03:13.638006 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 6498, ack 18941, win 8195, length 0
14:03:13.638028 IP 192.168.91.20.50240 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 6498, ack 18941, win 8195, length 0
14:03:13.639025 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2248374794, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.639054 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2248374794, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.639254 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1830014591, win 8195, length 0
14:03:13.639269 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1, win 8195, length 0
14:03:13.639986 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4998, ack 1, win 8195, length 4998
14:03:13.639999 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4998, ack 1, win 8195, length 4998
14:03:13.641666 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4998:5155, ack 213, win 8194, length 157
14:03:13.641675 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4998:5155, ack 213, win 8194, length 157
14:03:13.641991 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5155:5311, ack 384, win 8193, length 156
14:03:13.641999 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5155:5311, ack 384, win 8193, length 156
14:03:13.647124 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 645, win 8192, length 0
14:03:13.647129 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [.], ack 1449, win 8189, length 0
14:03:13.647139 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 645, win 8192, length 0
14:03:13.647141 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [.], ack 1449, win 8189, length 0
14:03:13.662777 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.662785 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.704330 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5311:5418, ack 558, win 8193, length 107
14:03:13.704342 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5311:5418, ack 558, win 8193, length 107
14:03:13.704764 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5418:5537, ack 694, win 8192, length 119
14:03:13.704771 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5418:5537, ack 694, win 8192, length 119
14:03:13.707411 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5537:5581, ack 843, win 8192, length 44
14:03:13.707420 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5537:5581, ack 843, win 8192, length 44
14:03:13.707559 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 5581, ack 843, win 8192, length 0
14:03:13.707574 IP 192.168.91.20.50242 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 5581, ack 843, win 8192, length 0
14:03:13.708590 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2139254128, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.708632 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [SEW], seq 2139254128, win 64240, options [mss 1460,nop,wscale 8,nop,nop,sackOK], length 0
14:03:13.709015 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 2433276194, win 8195, length 0
14:03:13.709034 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 1, win 8195, length 0
14:03:13.709756 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4998, ack 1, win 8195, length 4998
14:03:13.709769 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 0:4998, ack 1, win 8195, length 4998
14:03:13.713441 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4998:5155, ack 213, win 8194, length 157
14:03:13.713452 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 4998:5155, ack 213, win 8194, length 157
14:03:13.713840 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5155:5311, ack 384, win 8193, length 156
14:03:13.713850 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5155:5311, ack 384, win 8193, length 156
14:03:13.725254 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.725266 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 558, win 8193, length 0
14:03:13.741157 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:13.741830 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:13.780229 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5311:5430, ack 558, win 8193, length 119
14:03:13.780240 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5311:5430, ack 558, win 8193, length 119
14:03:13.785371 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 496:664, ack 645, win 8192, length 168
14:03:13.785398 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 496:664, ack 645, win 8192, length 168
14:03:13.785965 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1224:1428, ack 1449, win 8189, length 204
14:03:13.785982 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1224:1428, ack 1449, win 8189, length 204
14:03:13.786356 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1428:1696, ack 1653, win 8195, length 268
14:03:13.786367 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1428:1696, ack 1653, win 8195, length 268
14:03:13.787301 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1696:1836, ack 2033, win 8193, length 140
14:03:13.787311 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1696:1836, ack 2033, win 8193, length 140
14:03:13.788500 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 664:832, ack 913, win 8191, length 168
14:03:13.788511 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [P.], seq 664:832, ack 913, win 8191, length 168
14:03:13.789025 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1836:2040, ack 2173, win 8193, length 204
14:03:13.789035 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 1836:2040, ack 2173, win 8193, length 204
14:03:13.789289 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 2040:2308, ack 2377, win 8192, length 268
14:03:13.789299 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 2040:2308, ack 2377, win 8192, length 268
14:03:13.790139 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 2308:2448, ack 2757, win 8191, length 140
14:03:13.790149 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [P.], seq 2308:2448, ack 2757, win 8191, length 140
14:03:13.790521 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5430:5578, ack 707, win 8192, length 148
14:03:13.790547 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5430:5578, ack 707, win 8192, length 148
14:03:13.791231 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5578:5760, ack 912, win 8191, length 182
14:03:13.791243 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5578:5760, ack 912, win 8191, length 182
14:03:13.792455 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 12333, win 8195, length 0
14:03:13.792467 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 12333, win 8195, length 0
14:03:13.792871 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5760:5845, ack 12333, win 8195, length 85
14:03:13.792881 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5760:5845, ack 12333, win 8195, length 85
14:03:13.793219 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 15389, win 8195, length 0
14:03:13.793228 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 15389, win 8195, length 0
14:03:13.796775 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5845:6018, ack 15389, win 8195, length 173
14:03:13.796786 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 5845:6018, ack 15389, win 8195, length 173
14:03:13.797300 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6018:6225, ack 15581, win 8194, length 207
14:03:13.797312 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6018:6225, ack 15581, win 8194, length 207
14:03:13.797739 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 18886, win 8195, length 0
14:03:13.797749 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [.], ack 18886, win 8195, length 0
14:03:13.797922 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6225:6547, ack 18886, win 8195, length 322
14:03:13.797934 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6225:6547, ack 18886, win 8195, length 322
14:03:13.800005 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6547:6591, ack 18941, win 8195, length 44
14:03:13.800024 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [P.], seq 6547:6591, ack 18941, win 8195, length 44
14:03:13.800139 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 6591, ack 18941, win 8195, length 0
14:03:13.800174 IP 192.168.91.20.50243 > DCSRV03.%DOMAIN_NAME%.local.ldap: Flags [F.], seq 6591, ack 18941, win 8195, length 0
14:03:13.803379 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1181, win 8190, length 0
14:03:13.803379 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [.], ack 2897, win 8190, length 0
14:03:13.803394 IP 192.168.91.20.50235 > DCSRV03.%DOMAIN_NAME%.local.49668: Flags [.], ack 2897, win 8190, length 0
14:03:13.803396 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1181, win 8190, length 0
14:03:13.803462 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:14.226110 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:14.459771 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QM)? _ipp._tcp.local. (33)
14:03:14.459956 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QM)? _ipps._tcp.local. (34)
14:03:14.460112 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QM)? _ipp._tcp.local. (33)
14:03:14.851089 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:14.851743 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:14.959926 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:14.960352 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:15.053496 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:15.069596 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:15.070450 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:16.459711 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:16.459738 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:16.459739 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:16.459812 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:16.459958 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:16.460147 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:16.460315 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipps._tcp.local. (34)
14:03:16.709790 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:17.163459 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:17.164039 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:17.272481 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:17.273047 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:17.382205 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:17.382767 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:18.725556 IP 192.168.91.20.50712 > 239.255.255.250.3702: UDP, length 624
14:03:19.459715 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:19.459736 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:19.459736 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:19.459767 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:20.475696 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipps._tcp.local. (34)
14:03:20.476295 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:20.476471 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:22.459710 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:22.459731 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:22.459747 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:22.459750 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:23.460045 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:23.460466 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:23.569786 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:23.570438 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:23.678731 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 136 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (209)
14:03:23.679172 IP 192.168.91.20.50904 > mdns.mcast.net.mdns: 137 [2q] [2au] PTR (QU)? _alljoyn._tcp.local. PTR (QU)? _alljoyn._udp.local. (224)
14:03:25.459779 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:25.459798 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:25.459798 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:25.459859 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:26.645140 ARP, Reply 192.168.91.20 is-at 50:6b:8d:ab:f1:e1 (oui Unknown), length 46
14:03:27.350638 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [F.], seq 328, ack 377, win 8193, length 0
14:03:27.350679 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [F.], seq 328, ack 377, win 8193, length 0
14:03:27.350762 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [F.], seq 832, ack 1181, win 8190, length 0
14:03:27.350791 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [F.], seq 832, ack 1181, win 8190, length 0
14:03:27.350947 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 378, win 8193, length 0
14:03:27.350983 IP 192.168.91.20.50238 > DCSRV08.%DOMAIN_NAME%.local.epmap: Flags [.], ack 378, win 8193, length 0
14:03:27.351188 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1182, win 8190, length 0
14:03:27.351205 IP 192.168.91.20.50241 > DCSRV03.%DOMAIN_NAME%.local.epmap: Flags [.], ack 1182, win 8190, length 0
14:03:28.459779 IP 192.168.91.20.50715 > 192.168.91.255.22222: UDP, length 28
14:03:28.459807 IP 192.168.91.20.50716 > 192.168.91.255.enpc: UDP, length 14
14:03:28.459828 IP 192.168.91.20.50714 > 192.168.91.255.22222: UDP, length 28
14:03:28.459896 IP 192.168.91.20.10004 > 255.255.255.255.10004: UDP, length 83
14:03:28.475790 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:28.476714 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipp._tcp.local. (33)
14:03:28.476965 IP 192.168.91.20.mdns > mdns.mcast.net.mdns: 0 PTR (QU)? _ipps._tcp.local. (34)

    The Wireshark Capture on the windows server vm shows:

Unfiltered HTML