As a result of some rushed planning, all of our Windows desktops and any NT/2000 applications that need to access one of our filers do so using the UNC path "\na1". We would like to change that to "\corp-na1" for a variety of reasons. I know about the cifs.netbios_aliases option, so the filer will answer to both "\na1" and "\corp-na1". We can change our NT login scripts so the default mappings are updated, but I'm worried that there may be untold number of other applications, saved path lists, config files, etc. still referencing "\na1".

Is there a way on the filer or on the PDC to log CIFS sessions attaching to one NETBIOS name vs. the other, and the source of that connection? I'd like to know if we are faced with hundreds of users and processes still using the old name (which will break when we take it away), or just a few here and there. I could resort to doing pktt's on the filer and picking apart netbios packets, but I'd rather avoid that if possible. ;-)