File sharing breaks while already in use

[Chuck]

Chuck, are you still watching?

This is getting interesting again.
Right after rebooting the Master Browser (PRINCE this time)
Firewall comes up. I have verified that, with or without the firewall,
you need that mapped drive, and it needs to be active. Otherwise you
get the Error 53 on Registry fetch from other workgroup machines.

This message is interesting in another way. Reboot starts the firewall.
I know I need to wait for the completion of one or more of the 12
minute browser process cycles before BROWSTAT results get consistent.

I can't seem to get rid of this message:
"Unable to retrieve server list from PRINCE: 64" until I shut down the
Kerio Firewall. (I will do some testing with Zone Alarm tomorrow).

I have also noticed that often, after 2 or three of the 12 minute
browser process cycles, that message may go away, anyway. I would love
to know what that is all about.

I also notice, without a Firewall, if I break the mapped drive link, a
few seconds later, BROWSTAT (From remote workgroup (KING-DADDY) still
gives all good results. ...but wait a minute or two, and the message:
"Unable to retrieve server list from PRINCE: 64"
message returns. I expected that. What surprises me is the:
"Master browser is running build 2195."
is present instead of the error 53 for the registry fetch.

Without the mapped drive, how can he fetch the registry data for browser
build without the link? But can't get the server list? Maybe the build
list is considered not so dynamic, but the server list is dynamic?

Still here, Carl.

The firewall is probably affecting the browser results. Browstat only reports
what the browser service sees.

I wish you would not use tinyurl. I can't keep track of what you're
referencing. Here's my "bible" about the browser.
<http://www.microsoft.com/technet/archive/winntas/deploy/prodspecs/ntbrowse.mspx?mfr=true>
http://www.microsoft.com/technet/archive/winntas/deploy/prodspecs/ntbrowse.mspx?mfr=true

The confusion that you're expressing is that the browser uses SMBs (Server
Message Blocks) to communicate thru the LAN. Some SMBs are broadcast (point to
multipoint), others are individually addressed (point to point). Browser
elections (and thus knowledge of who is the master browser) uses broadcast SMBs.
Browstat sends point to point queries to the master browser, and thus requires
name resolution, and remote registry access.

You also need to know about SMBs hosted over NetBIOS (NetBT) vs SMBs hosted
directly (over TCP).
<http://support.microsoft.com/?id=204279>
http://support.microsoft.com/?id=204279

 

[lurker]

Carl,

You asked a lot of questions, not all using "?" though. From the end upwards:

The NetBIOS Over TCP affects name resolution. If you turn off NetBT, and setup
a DNS server for local name resolution, Windows XP will work just fine.
<http://support.microsoft.com/?id=204279>
http://support.microsoft.com/?id=204279

You can interpret the "Error = 53" by using "net view" in the combination that
CDiag does.
<http://www.microsoft.com/resources/...00/server/reskit/en-us/cnet/cnbd_trb_ettg.asp>
http://www.microsoft.com/resources/...00/server/reskit/en-us/cnet/cnbd_trb_ettg.asp

Regarding the browser, Carl, Windows XP Home and Pro are equal to Windows 2000.
Windows 95 / 98 / ME are subservient. See the browser white paper, and search
for "Master Browser Elections". There's a chart "Election Criterion" a dozen or
so lines after that heading. The interesting thing is that this chart is for
Windows NT (remember Windows XP is Windows NT V5.1), and Windows 95 / 98 / ME
does not always follow the chart.
<http://nitecruzr.blogspot.com/2005/05/windows-9x-9598me-and-browser.html>
http://nitecruzr.blogspot.com/2005/05/windows-9x-9598me-and-browser.html

If you're going to talk about articles that you've found, the URLs might be
useful. It wouldn't be the first time I've found Microsoft articles that
contradict each other.

When I'm researching a network problem, I always examine at least 2 computers -
and 3 if there are that many. Many tests, between computers A and B, if they
fail, you never know if the problem is with Computer A or Computer B. So I will
continue to ask that you include diagnostics from King-Daddy, and take all
diagnostics simultaneously.

What do you mean by "LMHOSTS is enabled on QUEENIE"? Is the selection "Enable
LMHOSTS lookup" checked, even with no content in LMHOSTS? Maybe the chart in
the browser white paper will be of interest to you. Find "Microsoft TCP/IP and
Name Resolution", and then "Computer Name and Host Name Resolution with NetBIOS
over TCP/IP".
<http://www.microsoft.com/library/me...ive/winntas/deploy/prodspecs/ntbrow01_big.gif>
http://www.microsoft.com/library/me...ive/winntas/deploy/prodspecs/ntbrow01_big.gif

Keep reading, Carl. And when you find an interesting document, note the URL.
Please.

Sunbelt Software (Kerio) has opened a problem ticket.
The problem I have been chasing here does not happen with Zone Alarm
Personal.

The Kerio problem exists ONLY with Windows 2000 and only when it is the
Master Browser.

I can't reproduce the exact problem "at will", but it happens several
times a day "intermittently", even with no one using the computer.

I have trapped failure time frames precisely enough to prove:
There are no Windows Event Viewer events tied to the problem.

There are no Kerio logs with information (error, debug, warning.log).

I have found a way to provoke "part of the symptoms" at will. I believe
if this is fixed, it will all be fixed. Test scenario is here:
http://rpchc.com/kingdom/purposely-drop-mapped-drive.htm