admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

spike(R-6): S4b name-resolution finding — wsdd visible but flat name unresolvable

Browse Source 
Human Explorer leg exposed the split: FELHOM-SPIKE renders (WSD PASS) but the
double-click fails 0x80070035 — flat name resolves by no path (DNS/LLMNR/NetBIOS
all silent; disable netbios=yes). By-IP mount works => SMB is healthy, the gap is
name resolution. Fix verified live: adding nmbd (NetBIOS) => nbtstat lists
FELHOM-SPIKE, ping resolves, \FELHOM-SPIKE\spike-share mounts by name. R-7 must
ship smbd+wsdd+nmbd (+avahi/.local), not wsdd alone.
This commit is contained in:
authentik Default Admin
2026-07-18 10:46:53 +02:00
parent 900d3041fa
commit d3eb8099a3
2 changed files with 86 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/SPIKE-lan-discovery-2026-07-18.md
+84 -21
View File
@@ -41,13 +41,18 @@ container). Docker's default bridge cannot receive LAN multicast at all**, so WS
are dead there while a published unicast port still works. Empirically, guest-netns (S1) and
host-network (S2) are byte-for-byte equivalent and pass SSDP/mDNS/WSD in **both** directions; the
default bridge (S3) fails multicast RX for all three. A real **samba + wsdd** stack on host-network
is discovered by Windows 11 (ProbeMatch confirmed), answers on TCP 445, and serves an authenticated
read/write SMB round-trip. A real **SSDP `MediaServer:1`** advertisement from host-network is received
by both LAN clients. **Recommendation for R-7: run the samba/wsdd stack as a host-network infra
stack, LAN-bound.** For R-8: Jellyfin's built-in DLNA is physically viable on this topology **if it
runs host-network**. One caveat R-7/R-8 must carry: `vmbr0` runs with `multicast_snooping=1` and no
STP — it worked here because the household router (.1) is an active IGMP querier, but a customer LAN
with snooping-on-and-no-querier could prune the groups (§7d).
is discovered by Windows 11 (ProbeMatch confirmed + **FELHOM-SPIKE renders in Explorer**), answers on TCP
445, and serves an authenticated read/write SMB round-trip. A real **SSDP `MediaServer:1`**
advertisement from host-network is received by both LAN clients. **But the human leg exposed a second
requirement wsdd alone does not meet (S4b):** the Explorer *double-click* on FELHOM-SPIKE failed with
`0x80070035` because the flat name resolved by no path — WSD gives visibility, not name resolution.
Adding **nmbd (NetBIOS name service)** fixed it live (`\\FELHOM-SPIKE` then resolves and mounts).
**Recommendation for R-7: run the stack host-network, LAN-bound — `smbd` + `wsdd` (visibility) +
`nmbd` (flat-name resolution), and ideally `avahi`/`.local` for modern clients.** For R-8: Jellyfin's
built-in DLNA is physically viable on this topology **if it runs host-network**. One caveat R-7/R-8
must carry: `vmbr0` runs with `multicast_snooping=1` and no STP — it worked here because the household
router (.1) is an active IGMP querier, but a customer LAN with snooping-on-and-no-querier could prune
the groups (§7d).
---
@@ -141,7 +146,7 @@ Throwaway host-network stack in the guest: `spike-samba` (alpine + `apk add samb
| 1. WS-Discovery ProbeMatch | scripted Probe (`Types=wsdp:Device`) from the workstation | **PASS** — ProbeMatch from `192.168.0.127`; wsdd logged our exact `MessageID` from `192.168.0.110` |
| 2. Port 445 reachability | `Test-NetConnection 192.168.0.127 -Port 445` | **PASS** — `TcpTestSucceeded: True` |
| 3. SMB round-trip | `New-SmbMapping` as `spikeuser` → write `roundtrip.txt` → read back → byte-compare | **PASS** — `BYTE-COMPARE: PASS`; dir listed `README.txt` (24B) + `roundtrip.txt` (28B) |
| 4. Explorer Network view (human) | Viktor: Explorer → Network shows **FELHOM-SPIKE**, double-click opens the share | **PENDING — human leg; stack left live** |
| 4. Explorer Network view (human) | Viktor: Explorer → Network | **SPLIT: device VISIBLE (WSD PASS), double-click FAILED `0x80070035`** — see S4b |
wsdd log for leg 1:
```
@@ -151,8 +156,58 @@ wsdd log for leg 1:
The scripted client's friendly-name auto-fetch reported FAIL only because python-wsdd's metadata
HTTP endpoint (`:5357/<uuid>/`) requires the native WS-Discovery **Resolve→Transfer/Get** handshake
that Windows Explorer performs itself (a direct throwaway `Get` 404s). The **objective discovery gate
is the ProbeMatch (PASS)**; the `FELHOM-SPIKE` name is what wsdd is configured to present and is the
subject of the human leg. Optional S4.5 (mDNS `.local` name + phone) was **skipped**.
is the ProbeMatch (PASS)**; the `FELHOM-SPIKE` name is what wsdd is configured to present. Optional
S4.5 (mDNS `.local` name + phone) was **skipped**.
## S4b — the Explorer double-click failure (THE sharpest R-7 finding)
Viktor's human leg surfaced a split result Windows-side that the by-IP scripted tests had masked:
- **Visibility: PASS.** Explorer → Network → **Computer** renders **`FELHOM-SPIKE`** (wsdd/WSD works
as a discovery beacon — screenshot on file).
- **Double-click: FAIL** → `Windows cannot access \\FELHOM-SPIKE` · **`0x80070035` "network path
not found."**
Diagnosis from the workstation (192.168.0.110) isolates the cause as **flat-name resolution, not
SMB**:
| Check | Result |
|---|---|
| `Test-NetConnection 192.168.0.127 -Port 445` + `New-SmbMapping \\192.168.0.127\spike-share` | **PASS** — mounts by IP, lists files. SMB/auth/445 are fine. |
| `Resolve-DnsName FELHOM-SPIKE` (DNS) | fail — "DNS name does not exist" |
| `Resolve-DnsName FELHOM-SPIKE -LlmnrNetbiosOnly` | fail — timeout (nobody answers LLMNR) |
| `ping FELHOM-SPIKE` | "could not find host" |
| `nbtstat -A 192.168.0.127` | "Host not found" — no NetBIOS name service (`disable netbios=yes`) |
**Root cause:** WSD hands Explorer a device *icon* named FELHOM-SPIKE, but the double-click issues a
plain UNC `\\FELHOM-SPIKE`, whose flat name Windows must resolve via DNS → LLMNR → NetBIOS. With
`disable netbios=yes` and no mDNS/LLMNR responder, **nothing answers** → `0x80070035`. Mounting by IP
bypasses all name resolution and works — proving the SMB server itself is healthy.
**Fix verified live (S4b relaunch: samba with `disable netbios=no` + `nmbd`):**
| Check (after nmbd) | Result |
|---|---|
| `nbtstat -A 192.168.0.127` | **`FELHOM-SPIKE <00>/<03>/<20> Registered`** |
| `ping FELHOM-SPIKE` | **`Reply from 192.168.0.127`** — flat name resolves via NetBIOS broadcast |
| `New-SmbMapping \\FELHOM-SPIKE\spike-share` | **MOUNT BY NAME: OK** — lists the share |
**Conclusion for R-7:** `wsdd` alone makes the box *visible* but is **not sufficient** for the
one-click UX — a **flat-name resolver is required** for `\\FELHOM-SPIKE` to open. Options, in order of
how well they serve the exact WSD-shown flat name:
1. **nmbd / NetBIOS name service** (samba's `disable netbios=no` + run nmbd) — *directly resolves the
flat `\\FELHOM-SPIKE`*, proven here. The catch: NetBIOS-over-TCP is legacy (Microsoft is slowly
deprecating it) and can be off on hardened client networks; needs UDP 137/138 and
`interfaces = eth0` + `bind interfaces only = yes` in production (nmbd bound the docker 172.x
bridges too here — must be pinned to the LAN iface).
2. **mDNS / avahi** advertising `felhom-spike.local` — Windows 10/11 resolve `.local` natively and
it is the future-proof path, **but** it serves `\\felhom-spike.local\…`, not the flat name the
WSD icon double-clicks — so it's an *additional* access path, not a drop-in fix for the Explorer
double-click. (Not tested live — R-7 should.)
3. **Accept "mount by IP / by `.local`"** and treat WSD as visibility-only — the weakest UX.
R-7 recommendation: ship **wsdd + nmbd (LAN-bound)** for the classic one-click experience *and*
**avahi/.local** for the modern clients, so both the flat name and `.local` resolve.
## S5 — SSDP / DLNA pre-check for R-8 (scripted only)
@@ -185,14 +240,18 @@ future deployment must avoid host-network port collisions (§7c).
| mDNS 5353 RX / TX | PASS / PASS | PASS / PASS | **FAIL / FAIL** · unicast-publish PASS | not run |
| WSD 3702 RX / TX | PASS / PASS | PASS / PASS | **FAIL / FAIL** · unicast-publish PASS | not run |
| SMB 445 unicast | n/a | **PASS** (S4) | publish PASS | not run |
| Explorer visibility (human) | n/a | **PENDING** (S4.4) | n/a | not run |
| Explorer visibility (human) | n/a | **PASS** — FELHOM-SPIKE renders (S4.4) | n/a | not run |
| Explorer double-click → open share | n/a | **FAIL w/ wsdd-only → PASS w/ nmbd** (S4b) | n/a | not run |
**(a) Recommended transport for the R-7 SMB stack — HOST-NETWORK, LAN-bound.** The matrix is
unambiguous: WSD (Windows Explorer's actual discovery) and mDNS require the responder in the guest
netns; the default docker bridge is categorically deaf to LAN multicast. So samba + wsdd (and any
avahi) must run `network_mode: host`. Bind SMB to the LAN interface only; **never expose 445 over the
tunnel** (the LAN-only rule R-7 already states). This is the expected outcome — and the matrix, not
the expectation, now backs it.
**(a) Recommended transport + services for the R-7 SMB stack — HOST-NETWORK, LAN-bound, THREE
daemons.** The matrix is unambiguous on transport: WSD (Explorer's actual discovery) and mDNS require
the responder in the guest netns; the default docker bridge is categorically deaf to LAN multicast.
So the stack must run `network_mode: host`, SMB bound to the LAN interface only, **never over the
tunnel**. On *services*, S4b proved wsdd is not enough: ship **`smbd` (445) + `wsdd` (WSD visibility)
+ `nmbd` (NetBIOS flat-name resolution, so the Explorer double-click on `\\FELHOM-SPIKE` actually
opens) + ideally `avahi` (`.local` for modern/Apple clients)**. Pin every daemon to the LAN iface
(`interfaces = eth0` + `bind interfaces only = yes`) — nmbd otherwise also binds the docker 172.x
bridges. Without nmbd/mDNS the box is *visible but not openable by name* (`0x80070035`).
**(b) R-8 "try Jellyfin built-in DLNA first" — PLAUSIBLE on this topology.** SSDP `MediaServer:1`
adverts physically reach both LAN clients (S5). The only structural requirement carried over from
@@ -216,7 +275,10 @@ generalizes.
## NOT tested (explicit)
- **Explorer Network render** (S4.4) — human leg, pending Viktor; stack left live.
- **mDNS / avahi `.local`** as a flat-name/`.local` resolver alternative to nmbd (S4b option 2) —
NOT tested; R-7 should validate `\\felhom-spike.local` on Win11 + Apple/phone clients.
- **LLMNR responder** as a third name-resolution path — not tested (client LLMNR is on, but nothing
on the box answered it).
- **macvlan** (S6) — not needed (host-net passed).
- **Real DLNA client / TV** rendering actual media — R-8 owns.
- **Phone mDNS** `.local` resolution (optional S4.5) — skipped.
@@ -229,9 +291,10 @@ generalizes.
## CLEANUP
Throwaway containers `spike-hostnet-*`, `spike-bridge-*`, `spike-ssdp-ms` and all guest-netns
responder processes were `docker rm -f` / `pkill`'d at the end of each leg. **Intentionally left
live for the S4.4 human leg:** `spike-samba` + `spike-wsdd` (host-network), share
`\\192.168.0.127\spike-share` as **FELHOM-SPIKE**. Teardown one-liner once Viktor confirms Explorer:
responder processes were `docker rm -f` / `pkill`'d at the end of each leg. **Left live through the
S4/S4b legs:** `spike-samba` (now with nmbd) + `spike-wsdd` (host-network), share
`\\FELHOM-SPIKE\spike-share` / `\\192.168.0.127\spike-share`. Teardown one-liner (all objective legs
done — safe to run any time):
```
ssh felhom-pve "pct exec 9201 -- docker rm -f spike-samba spike-wsdd; \