So i have a parrot VM, and i tried to use wireshark on the lo interface of it just for fun, now I'm seeing loads of ICMP packets, which seems to be Netbios inside(not sure why is Wireshark naming the protocol ICMP instead of Netbios either!) and they contain the word ckaaaaaa... in the Name of the query of Netbios!!!

i just installed this parrot too, maybe a week ago and haven't installed anything new on it either, I am also not sure why the src and dst IP is the same in the capture but different in packet?! so what the hell is this?

Here's a picture :

enter image description here

  • I don't see the Y.
    – JFL
    Aug 29, 2019 at 13:38
  • Why your host is doing something is off-topic here. You could try to ask that on Server Fault for a business network.
    – Ron Maupin
    Aug 29, 2019 at 14:30
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 15, 2019 at 7:56

2 Answers 2


First of all, there's no "Y" on the screenshot you show us, so the real content is "CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA".

From this page on docshare.tips

look at the CKAAAA… output. We’ll see in a couple of slides that this is a “wildcard” or generic search for resources. It does not specifically identify a NetBIOS name or hostname; it uses the “*” wildcard to query the host for its NetBIOS table.


The “SMB Name Wildcard” slide describes why we use a content of “CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA” to search for the wildcard. When NetBIOS names are sent over the network, they are mangled into a different format. This format takes each character in the NetBIOS name and divides it into two hex characters. For normal NetBIOS names, blanks pad any unused field for 16 character name. Finally, the value of 0x41 (uppercase A) is added to each of the characters. If we take a NetBIOS name of “”, it is a bit different because it is null padded. The “” character is 2A in hex. These two character are separated and each character is added to 0x41. So, 2 + 41 = 43 (ASCII C) and A + 41 = 4B (ASCII K). All the null fields are added with a hex 41, also with the resulting value of 41 (ASCII) A. So that is why the CKAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA value is used. 6 - 30

So you VM is trying to discover any NETBIOS resources available on host

It seems this host doesn't respond to ARP request since you got a "host unreachable" message. As explained by ZAC67 in his answer the ICMP message embed the original NETBIOS request IP header and first bytes, where you can see the original destination addresse and the famous CKAAA...

Why it is doing this lookup is out of scope of this site, but this probably something configured a preconfigured thing in your parrot software (whatever it is...)


ICMP destination unreachable returns the unsuccessful IP header + first eight bytes of the 'user data' (IP SDU).

  • So what is this query for name "CYKAA..." ?
    – Mery Ted
    Aug 29, 2019 at 13:34
  • How should we know?
    – Zac67
    Aug 29, 2019 at 13:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.