Re: MacGate Revival

[Lisa2dotcom <lisa2dotcom@gmail.com>]

Miles,
But what you posted sure looks like TCP/IP traffic to me.

This is an example of a wireshark summary for a MacIP frame:

170	42.528520000	65280.232	0.255	NBP	63	Op: lookup  Count: 1

In this example, my computer is trying to contact the MacIP GW to talk to the DNS server.  The data inside is this:

0000   09 00 07 ff ff ff 00 00 94 b5 09 fd 00 31 aa aa  .............1..
0010   03 08 00 07 80 9b 00 29 00 00 00 00 ff 00 ff e8  .......)........
0020   02 02 02 21 a0 ff 00 e8 02 00 08 31 30 2e 30 2e  ...!.......10.0.
0030   31 2e 31 09 49 50 41 44 44 52 45 53 53 01 2a     1.1.IPADDRESS.*

You see in there is the address of the DNS server in plain text.  

I don't think that wireshark would ever decode the source and destination IP address in the summary display for MacIP frames, its only going to show the appletalk node numbers like in my example, because they are appletalk frames that just happen to have some IP data in the payload.

Are you seeing frames like this??

I hope this helps.
Rick

 
> This is the summary when trying to connect using a hostname.  .103 is the IIGS  .101 is my actual DNS server, but I don't see any evidence that this reaches the LAN:
> 
> 
> 
> 64505	2187.794859	192.168.60.103	192.168.1.101	DNS	85	Standard query A a2server.groupwhere.pri
> 
> 
> 
> This is an example when trying to telnet by ip address to the a2server host.  60.103 again is the IIGS.  60.1 is the ipddp0 ip address on the host:
> 
> 
> 
> 303020	25906.889238	192.168.60.103	192.168.60.1	TCP	56	ams > telnet [SYN] Seq=0 Win=16384 Len=0
> 
> 
> 
> I would have expected this to NOT show up as TCP traffic as you suggested.