Hey all, we have a Ricoh copier that is no longer able to send scanned documents to the server holding user's files. I can change the destination to other machines and it works just fine. I ran WS on the server and then tried to scan some documents to it and found something -- I'm getting a "Negative session response, Called name not present" response back from the server to the copier. We don't use any user names; the files go to each user's fully shared folder on the server. So, what "Called name" is it looking for? A device name? Is it NOW looking for a user name? An old girlfriend's name? Any help here would be greatly appreciated. Thanks, Joe B asked 01 Jul '16, 09:52  jbruyet closed 01 Jul '16, 11:53  Jaap ♦ showing 5 of 6 show 1 more comments |
One Answer:
You didn't bother to indicate what protocol this was, but "Negative session response, Called name not present" sounds like something from a NetBIOS Session Service error reply packet. The details of the NetBIOS-over-TCP protocols are documented in RFC 1002; see section 4.3.4 "NEGATIVE SESSION RESPONSE PACKET". One of the errors is "Called name not present". A later comment says this means that "[the] called name does not exist on [the] remote node". The architecture of NetBIOS-over-TCP is documented in RFC 1001; it explains that, for the NetBIOS Session Service, when a client connects to a server, it provides its own NetBIOS name as the "calling name" and the NetBIOS name of the remote host and service as the "called name". The error means that the "called name" in question isn't known to the server; NetBIOS host names, by convention, have 15 characters of host name and one character indicating a service, so either it's the wrong host name or the service in question isn't supported on the server. It's not a user name, and it's not a device name. We'd have to see name in question - all 16 characters, the last of which might not be a printable character, so we'd need its value as two hex digits as well - in order to determine anything more. But before you ask us anything more, you might want to make sure that 1) the SMB file server is running on the machine in question and is supporting NetBIOS-over-TCP, not just SMB-over-TCP (Microsoft might either have made NetBIOS-over-TCP not supported by default, or not supported at all, in more recent versions of Windows; I don't know whether Samba or Apple's SMBX server have done the same) and 2) the copier thinks the server's NetBIOS name is the NetBIOS name the server actually uses. answered 05 Jul '16, 11:14  Guy Harris ♦♦ edited 05 Jul '16, 11:14 |
May I have some explanation as to why this question is "off-topic or not relevant?" I can understand the Ricoh part of this post not being relevant but I'm trying to find out what "Called name not present" is asking for. So is that NOT a Wireshark question?
Thanks,
Joe B
The relation of this question to Wireshark is very limited if existing aT all. The questions and answers on this Q&A site are intended to serve as a knowledge base for Wireshark users in using Wireshark and solving networking problems. The stated problem here is an application problem between (proprietary) Ricoh equipment and unknown client software. These fall outside of the scope of this Q&A site IMHO.
@jbruyet, as you haven't provided a link to a capture file (not a screenshot) documenting the error, we cannot even say whether the protocol the Ricoh box uses to deliver the scans is proprietary or not. If it is not, the "protocol analysis" part of the "questions must be related to" list from the site FAQ might apply, but as @Jaap has pointed out, what you encounter is more likely an application layer issue than a protocol layer one.
If you want to try your luck, please provide also a link to a capture of a successful case (delivery of the document to another server as you've mentioned in the OP).
Hey everyone, thanks for the information. I did some other testing with another Ricoh copier and that one is working fine, and it's pointing to the same server. We just put in a service request with Ricoh.
Additionally, I learned our VPN went down around the same time we stopped being able to scan to the server. The failing copier is at the other end of that VPN.
Thanks,
Joe B
I'm also experiencing the same issue here (with a Ricoh) as well but there isn't a VPN connection between the offices. I have been able to scan successfully to another computer though. I've run a wireshark capture while sending a scan, but am not quite sure what I'm looking for. Any help would be awesome.
Copier: Ricoh MP 2400W (192.168.5.xx) // Server: Windows 2008R2 (192.168.1.xx) - scan to folder not working // Other machine: Windows 7 (192.168.1.xx) - scan to folder working
Unfortunately, providing product names does not really help.
On a general level, you might want to check your NetBIOS configuration. SMB1 has a lot of tuning knobs for two nodes in different IP subnets. I have a observed a lot of weird SMB implementations in print servers.
Guy Harris already nicely summed up all the relevant points.
For greater detail, a trace file might be helpful. In this special situation a trace taken from the Ricoh printer would be a good start.