Hello All,
Browsing via network neighborhood is always resolved via broadcast and/or
WINS. Browsing is an antiquated technology that has not been re-engineered
since windows 3.11. Because the browser service relies on server
broadcasts, its communication is connectionless and by definition
unreliable. Because a server's browser role is defined dynamically with
periodic
elections, determining the flow of communication used to provide the browse
list to a specific client computer can be difficult.
Below is some information on how browsing works along with some
troubleshooting steps.
Resolving the 0x1b record
The very first step the client takes in its attempt to browse is to try and
resolve the 1b record for its domain or workgroup NetBIOS name. This can
happen through three different name resolution methods:
1. Broadcast for the <domain/workgroup name><0x1b>
2. Query the WINS server
3. Via an LMHOST file on the machine
Broadcasting for the name will work in most situations in a situation where
all the machines in question are on the same logical IP subnet. So long as
the Computer Browser service is running on the PDC/PDC Emulator, then it
should respond to this broadcast. If it is not responding then take a
Network Monitor trace while you restart the Computer Browser service on the
PDC. You should see the server initiate an election.
It is important to ensure that the PDC is winning the election and is the
Master Browser (use ‘Browstat status’ after the election to determine
this), and that it is the only one with the Domain Master Browser flag set
(you can filter on that one property in the trace to verify).
Browsing Fails on the local subnet:
The only thing that a machine should need for browsing to the local subnet,
is that the Computer Browser service be running on at least one machine on
that IP subnet that can perform in the role of Master Browser. This is
because NetBIOS name resolution can happen through broadcasts, and thus the
client should be able to find all the required records via the broadcast.
The browse list will get enumerated through host announcements (broadcasts)
happening at 12 minute intervals on all machines. So if browsing isn’t
working on the local subnet, and you have verified that there is are 3rd
party applications (such as a firewall) that could be blocking NetBIOS
traffic, then start getting a NetMon trace running. In this we should see
the client broadcasting for the workgroup or domain name (0x1b record).
The Domain Master Browser (DMB) should respond, followed by the client
sending a Get Backup List query to the DMB. Upon receiving this list, the
client will query a backup browser for the browse list.
188305 Troubleshooting the Microsoft Computer Browser Service
http://kb/article.asp?id=Q188305
Browstat.exe -
One of the most useful tools in troubleshooting browsing problems is
browstat.exe. This tool allows the client to:
ELECT (EL) - Force election on remote
domain
GETBLIST (GB) - Get backup list for domain
GETMASTER (GM) - Get remote Master Browser name
(using NetBIOS)
GETPDC (GP) - Get PDC name (using NetBIOS)
LISTWFW (WFW) - List WFW servers that are
actually running browser
STATS (STS) - Dump browser statistics
STATUS (STA) - Display status about a domain
TICKLE (TIC) - Force remote master to stop
VIEW (VW) - Remote NetServerEnum to a
server or domain on transport
DUMPNET (DN) - Display the list of transports
bound to browser
One of the most useful is “browstat status”, as seen below:
c:\>browstat status
Status for domain NORTHAMERICA on transport
\Device\NetBT_Tcpip_{48F66F5D-0A47-480F-AAFB-DFE01C890C95}
Browsing is active on domain.
Master browser name is: BAMBAM26
Could not connect to registry, error = 5 Unable to determine build
of browser master: 5
Unable to determine server information for browser master: 5
1 backup servers retrieved from master BAMBAM26
\\NA-DC-03
Unable to retrieve server list from BAMBAM26: 51
Status for domain NORTHAMERICA on transport
\Device\NetBT_Tcpip_{D0FFA5CF-3552-489F-AD68-FCEF23359D63}
Browsing is active on domain.
Master browser name is: BAMBAM26
Could not connect to registry, error = 53 Unable to determine build
of browser master: 53
Unable to determine server information for browser master: 51
2 backup servers retrieved from master BAMBAM26
\\JIANGE
\\BAMBAM26
Unable to retrieve server list from BAMBAM26: 51
First notice how the utility will get the status from every interface where
NetBIOS is bound. It will list the Master browser and the Backup browsers
per interface. In this case it then attempted to download the browse list
from BAMBAM26 and was unable to do so. To find out what error 51 is,
simply run “net helpmsg 51”, and it will give the verbatim of the message:
C:\>net helpmsg 51
Windows cannot find the network path. Verify that the network path is
correct and the destination computer is not busy or turned off. If Windows
still cannot find the network path, contact your network administrator.
In this case, this machine is still able to browse the network. Most
likely because the other browser is working correctly. But only a trace
will prove this.
To test if a specific machine is in the DMBs browse list, perform the
following test. Note that the “\device…” string, and the name of the
Master Browser are obtained from the output of Browstat status. Run the
following from the command line:
BROWSTAT VIEW \Device\NetBT_Tcpip_{D0FFA5CF-3552-489F-AD68-FCEF23359D63}
\\<MasterBrowser> | FINDSTR /i <MissingServer>
if the master browser has the server in its list, the command returns
something similar to the following:
\\<MissingServer> NT 04.00 (W,S,NT,PBR,DFS)
If the local master browser does not have the server’s name, the following
can be executed from any computer on the missing server’s segment:
BROWSTAT FORCEANNOUNCE
\Device\NetBT_Tcpip_{D0FFA5CF-3552-489F-AD68-FCEF23359D63} <DomainName>
Or the following can be executed from the missing server’s console:
BROWSTAT ANNOUNCE
\Device\NetBT_Tcpip_{D0FFA5CF-3552-489F-AD68-FCEF23359D63} <DomainName>
It may be useful to verify that the missing server can map a network drive
to the master browser to verify network connectivity. Also, the server can
be rebooted to force a Host Announcement frame.
Another very useful function within Browstat is the ability to have a
machine query for and find the PDC/PDC Emulator.
Browstat GETPDC
\Device\NetBT_Tcpip_{D0FFA5CF-3552-489F-AD68-FCEF23359D63} <DomainName>
This will cause that machine to do a <1b> query to find the PDC/PDC
Emulator. If this fails, then browse from this subnet to other subnets
will fail and vice versa.
I hope this helps.
Larry Brasher
MCSE (2000,NT),MCSA, A+
Microsoft Platforms Support
Windows NT/2000 Networking
