Event 8003 causing reboot

[Guest]

I have captured what I believe to be the event that occurs just prior to the
reboot -- it follows below -- I did Google "Event ID 8003" and they say I
should disable forwarding of UDP broadcasts by our router, but I'm not sure
how to do that. Any ideas appreciated.

Thanks,

Harry

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 1/24/2006
Time: 12:58:40 PM
User: N/A
Computer: BKMSPC
Description:
The master browser has received a server announcement from the computer
MARYMORGAN that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{C89BE503-58AA-48D. The master browser is stopping or
an election is being forced.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

 

[Ron Lowe]

I have captured what I believe to be the event that occurs just prior to
the
reboot -- it follows below -- I did Google "Event ID 8003" and they say I
should disable forwarding of UDP broadcasts by our router, but I'm not
sure
how to do that. Any ideas appreciated.

Thanks,

Harry

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 1/24/2006
Time: 12:58:40 PM
User: N/A
Computer: BKMSPC
Description:
The master browser has received a server announcement from the computer
MARYMORGAN that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{C89BE503-58AA-48D. The master browser is stopping
or
an election is being forced.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

That's not really an error, it's just a normal part of the browser election
process that goes on all the time. The browsing system elects one of the
PCs as the Master browser, and sometimes a machine will challenge the others
for the role and force an election. This goes on behind the scenes without
user knowledge usually, just a note in the syslog like you see. I doubt if
it is the cause of the reboot. If it is, then there's something wrong with
the network card drivers. In which case, obtain the latest XP drivers for
the network card.

You can prevent a machine from participating in browser elections by
stopping the Browser service, and changing the startup type to 'Disabled'.
( start | Run | services.msc )

 

[Guest]

Ron

Thanks very much. Initially I think I'll disable the Browser Service on the
victim PC for 24 hours and see if it discourages such misbehavior -- I'll
post the result here tomorrow.

Typically, I can't go more that a couple of hours without this unwanted
reboot -- sometimes it's just over 10min... really strange... also seems a
bit odd that this selection/election process does not seem to ever cause a
reboot of the other PC -- unless, as you mentioned my driver software is out
of date.

As near as I can tell every reboot occurs seconds after such an error is
reported in the event log, and, all of the other messages in the event log
are seemingly routine (start/stop/etc) info messages with that nice blue
icon, whereas the only red/bad-news messages are the 8003 messages -- that
are entered right about reboot time.

btw: One other "browser thought" just jumped into my head -- do you think
that AOL's Internet Explorer "shell", or whatever it is, might be responsible
for this ? I ask because both my wife and daughter primarily use the AOL
(native) browser, but as I think about it, around about the time I started
having these reboot problems they had just recently downloaded an AOL routine
that puts an "AOL face" on XP Internet Explorer itself.

Harry

 

[Ron Lowe]

As near as I can tell every reboot occurs seconds after such an error is
reported in the event log, and, all of the other messages in the event log
are seemingly routine (start/stop/etc) info messages with that nice blue
icon, whereas the only red/bad-news messages are the 8003 messages -- that
are entered right about reboot time.

XP by default will re-boot when it encounters a STOP error ( 'Blue Screen Of
Death' ). You need to disable this auto re-boot so you can read what the
actual error is.

R-click 'My Computer' | Properties | 'Startup and Recovery' tab.
Un-check 'Automatically Restart'.

Next time it fails, you should have a Blue Screen with error information.
This will give a clue as to what is failing.
Post back with the *exact* message on the blue screen,
someone might beable to figure out what is failing.

btw: One other "browser thought" just jumped into my head -- do you think
that AOL's Internet Explorer "shell", or whatever it is, might be
responsible
for this ? I ask because both my wife and daughter primarily use the AOL
(native) browser, but as I think about it, around about the time I started
having these reboot problems they had just recently downloaded an AOL
routine
that puts an "AOL face" on XP Internet Explorer itself.

The browser we're talking about here is nothing to do with the *web* browser
like Internet Explorer or AOL. The Browser Service is the behind-the-scenes
system that gathers the names of all the computers on the LAN to display
them in My Network Places 'View all workgroup computers' window.

 

[Guest]

Ron

OK -- I disabled the auto-restart function -- will update you by noon
tomorrow.

fyi: at this point, it's been a good solid 6 hours without an "8003-reboot"
-- i.e., since I disabled the Browser Service as you recommended... guess I
gotta get more network savvy to survive in today's PC world.

Harry

"A boat is a hole in the water into which you throw money"

As near as I can tell every reboot occurs seconds after such an error is
reported in the event log, and, all of the other messages in the event log
are seemingly routine (start/stop/etc) info messages with that nice blue
icon, whereas the only red/bad-news messages are the 8003 messages -- that
are entered right about reboot time.

XP by default will re-boot when it encounters a STOP error ( 'Blue Screen Of
Death' ). You need to disable this auto re-boot so you can read what the
actual error is.

R-click 'My Computer' | Properties | 'Startup and Recovery' tab.
Un-check 'Automatically Restart'.

Next time it fails, you should have a Blue Screen with error information.
This will give a clue as to what is failing.
Post back with the *exact* message on the blue screen,
someone might beable to figure out what is failing.

btw: One other "browser thought" just jumped into my head -- do you think
that AOL's Internet Explorer "shell", or whatever it is, might be
responsible
for this ? I ask because both my wife and daughter primarily use the AOL
(native) browser, but as I think about it, around about the time I started
having these reboot problems they had just recently downloaded an AOL
routine
that puts an "AOL face" on XP Internet Explorer itself.

The browser we're talking about here is nothing to do with the *web* browser
like Internet Explorer or AOL. The Browser Service is the behind-the-scenes
system that gathers the names of all the computers on the LAN to display
them in My Network Places 'View all workgroup computers' window.

 

[Guest]

The good news is that I went about 18 hours without a reboot -- just got
another "8003 reboot" a few minutes ago. The bad news is that there was no
blue screen of death -- it just restarted. I double-checked to make sure
that the "auto restart" box was not checked -- it was not.

I'll be back around noon EST, and compare the driver info on both PCs --
both run XP Pro and have identical DLink cards (Router is DLink also).

Harry

--
"A boat is a hole in the water into which you throw money"

As near as I can tell every reboot occurs seconds after such an error is
reported in the event log, and, all of the other messages in the event log
are seemingly routine (start/stop/etc) info messages with that nice blue
icon, whereas the only red/bad-news messages are the 8003 messages -- that
are entered right about reboot time.

XP by default will re-boot when it encounters a STOP error ( 'Blue Screen Of
Death' ). You need to disable this auto re-boot so you can read what the
actual error is.

R-click 'My Computer' | Properties | 'Startup and Recovery' tab.
Un-check 'Automatically Restart'.

Next time it fails, you should have a Blue Screen with error information.
This will give a clue as to what is failing.
Post back with the *exact* message on the blue screen,
someone might beable to figure out what is failing.

btw: One other "browser thought" just jumped into my head -- do you think
that AOL's Internet Explorer "shell", or whatever it is, might be
responsible
for this ? I ask because both my wife and daughter primarily use the AOL
(native) browser, but as I think about it, around about the time I started
having these reboot problems they had just recently downloaded an AOL
routine
that puts an "AOL face" on XP Internet Explorer itself.

The browser we're talking about here is nothing to do with the *web* browser
like Internet Explorer or AOL. The Browser Service is the behind-the-scenes
system that gathers the names of all the computers on the LAN to display
them in My Network Places 'View all workgroup computers' window.

 

[Guest]

I just noticed that I may have been a bit sloppy when disabling the "Computer
Browser" service, since it was enabled when I checked a few minutes ago...
I'm thinking that when I did it for the first time yesterday, I just clicked
"OK", so this time I've clicked "Apply" then "OK". Anyway, I'll check it
periodically to make sure it's really disabled.

I just checked the NIC drivers on both PCs -- both NICs are internal DLink
530TX+ devices, however, her PC (the one not having the random reboot
problem) is using this driver (I think it came with the NIC):

RealTek RTL8139 version 5.396.530.2001 dated 07/01/2001

whereas mine (the one having the random reboot problem) is using this driver
(which came on the ASUS Utilities CD):

3Com Gigabit LOM (3c940) version 1.00.00.0042 dated 04/17/2003

Do you think it would help if I installed the RealTek driver on my PC, such
that we'd both be using the same driver ???

Harry
--
"A boat is a hole in the water into which you throw money"

As near as I can tell every reboot occurs seconds after such an error is
reported in the event log, and, all of the other messages in the event log
are seemingly routine (start/stop/etc) info messages with that nice blue
icon, whereas the only red/bad-news messages are the 8003 messages -- that
are entered right about reboot time.

XP by default will re-boot when it encounters a STOP error ( 'Blue Screen Of
Death' ). You need to disable this auto re-boot so you can read what the
actual error is.

R-click 'My Computer' | Properties | 'Startup and Recovery' tab.
Un-check 'Automatically Restart'.

Next time it fails, you should have a Blue Screen with error information.
This will give a clue as to what is failing.
Post back with the *exact* message on the blue screen,
someone might beable to figure out what is failing.

btw: One other "browser thought" just jumped into my head -- do you think
that AOL's Internet Explorer "shell", or whatever it is, might be
responsible
for this ? I ask because both my wife and daughter primarily use the AOL
(native) browser, but as I think about it, around about the time I started
having these reboot problems they had just recently downloaded an AOL
routine
that puts an "AOL face" on XP Internet Explorer itself.

The browser we're talking about here is nothing to do with the *web* browser
like Internet Explorer or AOL. The Browser Service is the behind-the-scenes
system that gathers the names of all the computers on the LAN to display
them in My Network Places 'View all workgroup computers' window.

 

[Ron Lowe]

The only driver I'd install are the ones from your hardware vendor.
Is the NIC embedded in the motherboard?
Go to the ASUS website, follow the link to the Downoad page, and hunt for
the motherboard model you have. Download and install the latest drivers
for Windows XP.

 

[Guest]

No -- both NICs are DLink DFE-530TX+ expansiion boards -- I guess I'll make
mine the same as her's... as the RealTek driver is what came with the NIC
(the 3Com one came with the PC).

Harry

--
"A boat is a hole in the water into which you throw money"

The only driver I'd install are the ones from your hardware vendor.
Is the NIC embedded in the motherboard?
Go to the ASUS website, follow the link to the Downoad page, and hunt for
the motherboard model you have. Download and install the latest drivers
for Windows XP.

 

[Ron Lowe]

Then obtain the drivers from D-link:
http://www.dlink.com/products/support.asp?pid=122&sec=0#drivers

 

[Guest]

OK -- I think I'm all set -- no issues in about 24 hrs.

One last question -- what is the downside of just leaving the "Computer
Browser" function disabled anyway, since we are not doing anything fancy with
our networking... no file sharing; no printer sharing: just linking the
broadband connection via the WAN port to two PCs ???

btw: after comparing the event logs on both PCs backwards in time, it
appears as though the 8003/reboot on my PC would consistently occur seconds
after the other PC was shut down; conversely, with the other PC powered on,
my PC would not experience any 8003/reboot events; finally, with the other PC
powered off, my PC would experience 8003/reboot events at different sets of
fixed invtervals of time... sometimes every 45min, or so, sometimes every
15min, or so.

Harry

 

[Ron Lowe]

No major downside really.

The ability to see all the computers in My Network Places is what the
browser system provides.

Normally, all the machines are running the browser service, and so are all
potential candidates to become the master browser. Elections are held from
time to time automatically, for example when a new machine boots up. This
is what you are seeing in your logs. This can make the browser system a
little unstable, especially if the machines are turned on and off a lot.
Elections are held all the time, and the role of master browser gets shunted
around a lot.

On a bigger network, a server machine ( which is always up ) has extra
weight in the election, and always wins. This gives better browsing
stability.

On a smaller network, you can limit which machines assume the role of master
browser if you wish, by shutting down the browser service on other more
transient machines. This can make browsing a littke more stable.

So long as at least one machine is up and running the browser service, then
this will continue to work.

You can shut down the browser service on all machines, and the only
down-side is that browsing the entire workgroup from My Network Places will
fail.

It would, however, be better to have simply have Network Drivers that didn't
go belly up whan a browser election is called.