L
Li'l Roberto
Chuck said:Chuck said:On Tue, 26 Jul 2005 12:31:31 +0930, "Li'l Roberto"
<[email protected]>
wrote:
On Mon, 25 Jul 2005 14:11:53 +0930, "Li'l Roberto"
<[email protected]>
wrote:
On Mon, 25 Jul 2005 11:29:21 +0800, Helob
<[email protected]>
wrote:
On Sun, 24 Jul 2005 21:47:36 +0930, "Li'l Roberto"
<[email protected]>
wrote:
<SNIP>
Chuck
here are the browstat and ipconfig files you requested, hope
this
gives
you a clearer picture
thanks
Robert
=================================================
XP Home system
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Robert Armitage>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : roberto
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8169/8110
Family
Gigabit
Ethernet NIC
Physical Address. . . . . . . . . : 00-0C-76-B9-62-CF
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 203.87.88.1
203.87.88.2
Lease Obtained. . . . . . . . . . : Sunday, 24 July 2005
10:10:39 AM
Lease Expires . . . . . . . . . . : Monday, 25 July 2005
10:10:39 AM
C:\Documents and Settings\Robert Armitage>
Status for domain MSHOME on transport
\Device\NetBT_Tcpip_{1709D4F2-524E-4407-9B9E-83517B0F1D18}
Browsing is active on domain.
Master browser name is: ROBERTO
Master browser is running build 2600
1 backup servers retrieved from master ROBERTO
\\ROBERTO
There are 1 servers in domain MSHOME on transport
\Device\NetBT_Tcpip_{1709D4F2-524E-4407-9B9E-83517B0F1D18}
There are 1 domains in domain MSHOME on transport
\Device\NetBT_Tcpip_{1709D4F2-524E-4407-9B9E-83517B0F1D18}
=====================================================================================
XP PRO system
Microsoft Windows XP [Version 5.1.2600]
(C) Copyright 1985-2001 Microsoft Corp.
C:\Documents and Settings\Roberto>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : pentium3
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : Yes
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : SiS 900-Based PCI Fast
Ethernet
Adap
ter
Physical Address. . . . . . . . . : 00-01-6C-AA-03-29
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.101
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 203.87.88.1
203.87.88.2
Lease Obtained. . . . . . . . . . : Sunday, 24 July 2005
9:29:21
PM
Lease Expires . . . . . . . . . . : Monday, 25 July 2005
9:29:21
PM
C:\Documents and Settings\Roberto>
Status for domain MSHOME on transport
\Device\NetBT_Tcpip_{B24E3489-E068-4654-A63D-C2170857ECE3}
Browsing is active on domain.
Master browser name is: ROBERTO
Could not connect to registry, error = 53 Unable to
determine
build
of browser master: 53
\\\\ROBERTO . Version:05.01 Flags: 51203 NT POTENTIAL
MASTER
1 backup servers retrieved from master ROBERTO
\\ROBERTO
There are 2 servers in domain MSHOME on transport
\Device\NetBT_Tcpip_{B24E3489-E068-4654-A63D-C2170857ECE3}
Unable to retrieve server list from ROBERTO: 64
========================================================================
Roberto,
OK, a good start. Here's what we know.
# Both computers are getting DHCP settings, so physical
connectivity
is
less
likely.
# Both computers are Node Type Unknown.
# Both computers are using only NetBIOS Over TCP/IP.
# Both computers have elected Roberto as the master browser.
# Pentium3 has problem resolving Roberto ("error = 53"). This is
in
keeping
with your stated symptoms.
# Roberto sees only 1 server from browstat, though Pentium3 sees
both
servers.
Check misconfigured / overlooked firewalls.
<http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-help.html>
Check registry setting restrictanonymous.
<http://nitecruzr.blogspot.com/2005/07/restrictanonymous-and-your-server.html>
Chuck,
I noticed that Pentium3 has WINS Proxy Enabled whereas
Roberto didn't.
Does it matter in this case?
Helob,
Good eye. The latency Roberto describes could well be WINS Proxy
activity
related.
Roberto,
Please edit
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters\EnableProxy]
on Pentium3, and change it from a "1" to "2". Instructions for
using
Regedit:
<http://nitecruzr.blogspot.com/2005/07/registry-editor.html>
Microsoft's articles on WINS Proxy:
<http://www.microsoft.com/resources/...00/server/reskit/en-us/cnet/cncd_win_vzlw.asp>
<http://support.microsoft.com/?id=121004>
--
Cheers,
Chuck, MS-MVP [Windows - Networking]
Chuck
changing the value to 2 and running ipconfig /all still showed
wins
proxy enabled, setting the value to 0 disabled wins proxy.
But still no resolution of the problem.
I run F-PROT for windows Ver 3.16c only - no firewall
Robert
How about some background about your LAN? How old are the computers?
How long
have they been setup this way? When did you first observe this
problem?
Any
chance you could have a friend over, or borrow another computer, and
see
if the
problem reproduces itself on another computer?
Chuck
here are the system details, I have posted in line hope you are
comfortable with this.
Main PC; Pentium4 2.8GHz 512MB RAM on board Realtek 8110S chip
10/100/1000Mb LAN , fully patched with only critical updates and
runs
mainly business software Office, MYOB etc, system is 6 months old.
Pentium3; AMD Opteron 2600 CPU 256MB RAM XP PRO +SP2 Realtek 8139D chip
10/100Mb LAN has just been built and doesn't have any additional
software
installed.
I noticed the problem when the network setup was completed and I
was
testing it, [I have had other XP Home PCs connected in the past
in
same configuration without this behaviour so it's new to me].
Last night I set up another PC [P3 1GHz 256MB RAM Realtek NIC and
got
the same results EG if I turn off the XP firewall everything
works
as expected.
When you display Network Neighborhood on the computer with the shared
folders,
is it displaying its own shared folders, but with no delay? What's
special
about the folders being displayed - any folders with a lot of content?
Large
size?
All shares are displayed in both shortcut to MNP on the Desktop
and
in Explorer on both PCs, at this point only the default shared
Documents folder is shared on the P4, I have shared the D: drive
on
the P3, which has one folder [couple of small files]. All shared
folders are visible and there is no delay in opening them. Only
when
I D/Click "View workgroup computers" to open the computer icon from
either location [explorer or MNP] does the delay occur.
*This only occurs from the P3, not the other way*.
What happens if you close Network Neighborhood and reopen - does the
problem
repeat?
Every time
Try analysing what the computers are doing. Get Process Explorer
(free)
from
<http://www.sysinternals.com/ntw2k/freeware/procexp.shtml>. PE is
like
Task
Manager, but it displays way more information. You can display tasks
sorted by
CPU utilisation percentage, by start time, and by a finer metric,
context
switches and context switches delta (the latter 3 you add to the
default
view
from View - Select Columns). Start PE on both computers, then try
doing
the
Network Neighborhood display. Sort the displays on both computers in
various
ways, and see what task pops up to the top of the list. Run Task
Manager
too,
and watch the Network Utilisation display.
I have installed PE,set the view the way you described and
observed
the proceedings.
Whilst D/Ling PE from the net to P3 the network utilisation was
sitting
on 0.23%, when I reproduce the hang Task Manager shows CPU usage
going
to 7% then quickly dropping back to zero , network utilisation at
zero.
I'm not familiar with PE, so you may have to guide me through
what
I am looking for. Should I post a screen dump ? most don't like
this
so I don't want to get off side here.
Robert
Robert,
That's a good start. So now you've experimented with 3 computers, and
observed
the same problem on 2 of them. Does the third computer (the one NOT
exhibiting
the problem) display the same shares and folders as the other two (in
other
words, its own shares, and the shares of the computer exhibiting the
problem)?
If that's the case, then I think you should be examining the computer
with
the
shares. So run Process Explorer and Task Manager on the server (the one
causing
the problem). Task Manager will display network activity, and Process
Explorer
will display application and system activity.
With regard to Process Explorer, what I'm after is what processes are
using
resources when the problem is being observed. One of the most obvious
resource
metrics is CPU activity, but even that is not precise enough sometimes.
So the
developer of PE found another metric - Context Switch Delta - which is
another
measure of activity. You can sort on either metric, by clicking on the
specific
column. Watch what happens when you do that. Then watch the PE and TM
displays, when you are accessing MNP from one of the clients.
Let's not worry with screen dumps. What you're looking for you will
have
to
observe as your problem is happening anyway. You'll just have to watch
Task
Manager and Process Explorer, and see what activity is happening while
you
are
observing the problem, that isn't happening when you're not observing
the
problem. Then see what is happening when the client (either client?)
has
firewall disabled, and compare to what happens when the firewall is
enabled.
Now to your problem descriptions, which occasionally are a little vague
in
specifics. The details are OK, but I have trouble tracking the players
in
the
game.
Chuck
sorry for the confusion, my replies are in line below
Which computer are you turning the firewall off and on? The server
(which
is
Roberto?) or the client (which is Pentinum3?)?? Did I get the
relationships
right?
Roberto is the server, Pentium3 is the client
Roberto has the firewall turned on and then of during the tests
*This only occurs from the P3, not the other way*. Please define
"from".
Is "from" the computer observing the problem, or the computer with the
shares?
How about you say "The problem is observed when opening MNP on Pentium3,
with
the bulk of the shares being present on Roberto", in other words
identify
the
client (where you observe the problem), and identify the server (the
computer
with the shares). And identify them by name, so I can match the
symptoms
to the
ipconfig logs.
OK
Now as to the third computer, you refer to "the same results EG if
I
turn
off the XP firewall everything works as expected". WTF is expected?
What
do you expect? Would "the observation when using the third computer
(maybe a
computer name here too) is the same as when using Pentium3, ie the 20
second
delay when opening MNP, with the firewall enabled on that computer" be a
more
accurate description?
I expect the same behaviour from either PC when accessing shares - no
delay in opening shares
To keep it simple perhaps we can disregard the third PC as the
delay
appears using it or Pentium3, so it tends to point to something
amiss
on Roberto ?.
I have done the following on Roberto with firewall enabled :
opened TM and PE
from Pentium3 I have D/Clicked on show workgroup computers, and
observed
TM & PE
PE shows Cswitch delta value
system idle procees 96%
process explorer 160
interupts 136
DPCs 73
csrrs.exe 75
System 42
there were no sudden spikes in those numbers during the process
TM showed
network utilisation 0
if you are happy with these proceedures I will do the tests again
with
the firewall turned off on Roberto
thanks
Robert
Chuck
here are the new ipconfig files as requested, plus PE & TM results
If the problem originates from Roberto, you need to watch what Roberto is
doing
while Pentium3 is apparently waiting for it (System idle = 97%).
maybe I threw a red herring by saying the problem is coming from
Roberto ?, they were my thoughts only -shall we disregard it?
When you disable the firewall, are you disabling it on Pentium3 or on
Roberto?
I am disabling the firewall on Roberto, firewall on Pentium3 is on [on
or off doesn't make a difference as far as the test goes]
How about posting updated "ipconfig /all" for both Pentium3 and Roberto?
This is the "server" it has no problem accessing client [Pentium3]
C:\Documents and Settings\Robert Armitage>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : roberto
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Realtek RTL8169/8110 Family
Gigabit
Ethernet NIC
Physical Address. . . . . . . . . : 00-0C-76-B9-62-CF
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.100
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 203.87.88.1
203.87.88.2
Lease Obtained. . . . . . . . . . : Wednesday, 27 July 2005 9:06:11
AM
Lease Expires . . . . . . . . . . : Thursday, 28 July 2005 9:06:11
AM
C:\Documents and Settings\Robert Armitage>
==========================================================
This is the "client" which is hanging whilst accessing server [Roberto]
C:\Documents and Settings\Technician>ipconfig /all
Windows IP Configuration
Host Name . . . . . . . . . . . . : pentium3
Primary Dns Suffix . . . . . . . :
Node Type . . . . . . . . . . . . : Unknown
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : SiS 900-Based PCI Fast Ethernet
Adap
ter
Physical Address. . . . . . . . . : 00-01-6C-AA-03-29
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.101
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.1
DHCP Server . . . . . . . . . . . : 192.168.1.1
DNS Servers . . . . . . . . . . . : 203.87.88.1
203.87.88.2
Lease Obtained. . . . . . . . . . : Wednesday, 27 July 2005 9:15:42
AM
Lease Expires . . . . . . . . . . : Thursday, 28 July 2005 9:15:42
AM
C:\Documents and Settings\Technician>
============================================================
When I am doing the test I have PE open on the server [Roberto] and
watching what is happening as
Pentium3 is accessing Roberto.
Does this clarify which PC is accessing, and which PC is being
accessed ?.
Here are my observations using PE, the list of processes below for
each PC did not change whilst running the test
EG nothing jumped up to the top, all and were stable.
Roberto
system idle process 96.07%
interrupts
DPCs
smss.exe
csrss.exe
winlogon.exe
=========================================
Pentium3
system idle process 99.69%
interupts
DPCs
smss.exe
csrss.exe
winlogon.exe
==========================================
Here are my observations from TM when I D/Click on the Pentium4[Roberto
icon]
Pentium3 to Roberto [observed on Pentium3]
network utilisation went to 0.08%
same test observed from Roberto
network utilisation remained at 0%
==========================================
going in reverse direction, from Roberto to Pentium3
network utilisation on Roberto went to 0.1%
same test [observed from Pentium3]
network utilisation 0.1%
hope this information is useful to you
thanks
Robert