WinXP SP1 home ICS host intermittently refuses client control

[Guest]

I have a WinXP SP1 home system connected to an ISDN modem and several clients
sharing the connection. Most of the time everything works as expected, but
perhaps 40% of the time, the ICS host machine seems to ignore requests from
clients to connect or to disconnect. (As for the clients, one is a notebook
running WinXP Pro SP1, another is a notebook running WinXP Pro SP2, another
is an old desktop running Win98 which can't control the connection at any
time) Since things work most of the time, I think all my settings are OK.
Sometimes (but not always) when the ICS host doesn't want to respond, that
connection disappears from the Network Connections windows of the clients.
Since the ICS host machine is in another room, it's frustrating to have to
walk to the other room to connect or disconnect on the 4 or so out of 10
times the host ignores the client requests. Other than that, the connection
works fine. If anyone knows why this happens and/or how to fix it, I would
be very grateful for your response. (This is a repeat of a post I made nearly
a week ago and I got no responses, so if you can help, please do so. I
apologise for repeating the post, but few posts a week or more old are ever
heard from again, so I thought I'd better try again.)

 

[Chuck]

Xref: newscene.com microsoft.public.windowsxp.network_web:217177

I have a WinXP SP1 home system connected to an ISDN modem and several clients
sharing the connection. Most of the time everything works as expected, but
perhaps 40% of the time, the ICS host machine seems to ignore requests from
clients to connect or to disconnect. (As for the clients, one is a notebook
running WinXP Pro SP1, another is a notebook running WinXP Pro SP2, another
is an old desktop running Win98 which can't control the connection at any
time) Since things work most of the time, I think all my settings are OK.
Sometimes (but not always) when the ICS host doesn't want to respond, that
connection disappears from the Network Connections windows of the clients.
Since the ICS host machine is in another room, it's frustrating to have to
walk to the other room to connect or disconnect on the 4 or so out of 10
times the host ignores the client requests. Other than that, the connection
works fine. If anyone knows why this happens and/or how to fix it, I would
be very grateful for your response. (This is a repeat of a post I made nearly
a week ago and I got no responses, so if you can help, please do so. I
apologise for repeating the post, but few posts a week or more old are ever
heard from again, so I thought I'd better try again.)

Hey KK,

An interesting situation there.

How are the computers connected (wired / wireless)? What hardware connect each
unit (hub, switch, router - make and model?)?

Check for a browser conflict between the WinXP computers and the Win98
computers. I"m not talking about Internet Explorer here. The browser is the
program that allows any computer to see any other computer on the LAN. The
browsers for WinXP (WinNT/2K/XP) and Win98 (Win95/98/ME) don't work well
together on the same LAN.

Make sure the browser service is running on the ICS host. Control Panel -
Administrative Tools - Services. Verify that the Computer Browser, and the
TCP/IP NetBIOS Helper, services both show with Status = Started. Disable the
browser service / browse master on the other computers:
http://cms.simons-rock.edu/faq_by_subtopic/node138.html
http://www.compudentsystems.com/documentation/win98.html

After checking / disabling / enabling as above, power all computers off to reset
the browser settings on each. Once ALL computers have been powered off, power
them back on.

The Microsoft Browstat program will show us what browsers (I'm not talking about
Internet Explorer here) you have in your domain / workgroup, at any time.
http://support.microsoft.com/?id=188305

You can download Browstat from either:
<http://www.dynawell.com/reskit/microsoft/win2000/browstat.zip>
<http://rescomp.stanford.edu/staff/manual/rcc/tools/browstat.zip>

Browstat is very small (40K), and needs no install. Just unzip the downloaded
file, copy browstat.exe to any folder in the Path, and run it from a command
window, by "browstat status", on the XP systems. Make sure all computers list
the same master browser.
For more information about the browser subsystem (very intricate), see:
http://support.microsoft.com/?id=188001
http://support.microsoft.com/?id=188305
http://support.microsoft.com/?id=231312
<http://www.microsoft.com/technet/prodtechnol/winntas/deploy/prodspecs/ntbrowse.mspx>
<http://www.microsoft.com/technet/archive/win95/w95brows.mspx>

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Guest]

Hey KK,

An interesting situation there.

How are the computers connected (wired / wireless)? What hardware connect each
unit (hub, switch, router - make and model?)?

Check for a browser conflict between the WinXP computers and the Win98
computers. I"m not talking about Internet Explorer here. The browser is the
program that allows any computer to see any other computer on the LAN. The
browsers for WinXP (WinNT/2K/XP) and Win98 (Win95/98/ME) don't work well
together on the same LAN.

Make sure the browser service is running on the ICS host. Control Panel -
Administrative Tools - Services. Verify that the Computer Browser, and the
TCP/IP NetBIOS Helper, services both show with Status = Started. Disable the
browser service / browse master on the other computers:
http://cms.simons-rock.edu/faq_by_subtopic/node138.html
http://www.compudentsystems.com/documentation/win98.html

After checking / disabling / enabling as above, power all computers off to reset
the browser settings on each. Once ALL computers have been powered off, power
them back on.

The Microsoft Browstat program will show us what browsers (I'm not talking about
Internet Explorer here) you have in your domain / workgroup, at any time.
http://support.microsoft.com/?id=188305

You can download Browstat from either:
<http://www.dynawell.com/reskit/microsoft/win2000/browstat.zip>
<http://rescomp.stanford.edu/staff/manual/rcc/tools/browstat.zip>

Browstat is very small (40K), and needs no install. Just unzip the downloaded
file, copy browstat.exe to any folder in the Path, and run it from a command
window, by "browstat status", on the XP systems. Make sure all computers list
the same master browser.
For more information about the browser subsystem (very intricate), see:
http://support.microsoft.com/?id=188001
http://support.microsoft.com/?id=188305
http://support.microsoft.com/?id=231312
<http://www.microsoft.com/technet/prodtechnol/winntas/deploy/prodspecs/ntbrowse.mspx>
<http://www.microsoft.com/technet/archive/win95/w95brows.mspx>

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

Hi Chuck,
Thanks for the reply. The computers are connected (wired) via a D-Link
switch. Based on what I've read here previously, the browser service is off
on all but the ICS host. TCP/IP NetBIOS Helper is running on all machines.
Messenger service on ICS Host only (whether that's relevant or not I don't
know). I've been using these settings for quite some time.

In the following Browstat listings, I've replaced the actual name of the ICS
host with "<ICS Host>" and the name of the workgroup with "<local
workgroup>". At the time I ran these browstat queries, there were 3 PCs
active on the LAN: the ICS host (Win XP SP1, windows firewall active); Win XP
SP2 client (Norton IS Firewall active); Win 98SE client (no firewall) and the
Win XP SP2 machine is not shown on the workgroup listing and the ICS sharing
is working perfectly well. I'll try browstat again the next time the ICS
sharing fails and see if there's any difference, but I expect there won't be.

Browstat from the WinXP SP2 client:
Status for domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}
Browsing is active on domain.
Master browser name is: <ICS Host>
Could not connect to registry, error = 53 Unable to determine build
of browser master: 53
\\\\<ICS Host> . Version:05.01 Flags: 51203 NT POTENTIAL MASTER
1 backup servers retrieved from master <ICS Host>
\\<ICS Host>
There are 2 servers in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}
There are 1 domains in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}

Browstat from the ICS Host:
Status for domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}
Browsing is active on domain.
Master browser name is: <ICS Host>
Master browser is running build 2600
1 backup servers retrieved from master <ICS Host>
\\<ICS Host>
There are 2 servers in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}
There are 1 domains in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}

It may also be relevant that the Windows firewall is disabled on the WinXP
SP2 machine and I'm running Norton Internet Security firewall with all local
machines specifically listed on it as "trusted" by name (i.e,
PCNAME.mshome.net). It may also be of interest that the WinXP XP2 machine
appears in the workgroup (on itself and all others on the network) for a
while after it's booted, but then vanishes, even on its own "View Workgroup"
Windows explorer listing. Since that has no effect on my ability to share
resources on the LAN I've given up trying to fix that.

Finally, I've had a look at a couple of the MS KB articles you've suggested
and it's very apparent that, as you said, this is complicated! Thanks for
your help.

 

[Chuck]

Hi Chuck,
Thanks for the reply. The computers are connected (wired) via a D-Link
switch. Based on what I've read here previously, the browser service is off
on all but the ICS host. TCP/IP NetBIOS Helper is running on all machines.
Messenger service on ICS Host only (whether that's relevant or not I don't
know). I've been using these settings for quite some time.

In the following Browstat listings, I've replaced the actual name of the ICS
host with "<ICS Host>" and the name of the workgroup with "<local
workgroup>". At the time I ran these browstat queries, there were 3 PCs
active on the LAN: the ICS host (Win XP SP1, windows firewall active); Win XP
SP2 client (Norton IS Firewall active); Win 98SE client (no firewall) and the
Win XP SP2 machine is not shown on the workgroup listing and the ICS sharing
is working perfectly well. I'll try browstat again the next time the ICS
sharing fails and see if there's any difference, but I expect there won't be.

Browstat from the WinXP SP2 client:
Status for domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}
Browsing is active on domain.
Master browser name is: <ICS Host>
Could not connect to registry, error = 53 Unable to determine build
of browser master: 53
\\\\<ICS Host> . Version:05.01 Flags: 51203 NT POTENTIAL MASTER
1 backup servers retrieved from master <ICS Host>
\\<ICS Host>
There are 2 servers in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}
There are 1 domains in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{CFE60A53-C499-4D18-B835-93B295128697}

Browstat from the ICS Host:
Status for domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}
Browsing is active on domain.
Master browser name is: <ICS Host>
Master browser is running build 2600
1 backup servers retrieved from master <ICS Host>
\\<ICS Host>
There are 2 servers in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}
There are 1 domains in domain <local workgroup> on transport
\Device\NetBT_Tcpip_{91648D0A-4F0B-4D43-942D-05C6EC6FC581}

It may also be relevant that the Windows firewall is disabled on the WinXP
SP2 machine and I'm running Norton Internet Security firewall with all local
machines specifically listed on it as "trusted" by name (i.e,
PCNAME.mshome.net). It may also be of interest that the WinXP XP2 machine
appears in the workgroup (on itself and all others on the network) for a
while after it's booted, but then vanishes, even on its own "View Workgroup"
Windows explorer listing. Since that has no effect on my ability to share
resources on the LAN I've given up trying to fix that.

Finally, I've had a look at a couple of the MS KB articles you've suggested
and it's very apparent that, as you said, this is complicated! Thanks for
your help.

KK,

OK, the browser situation looks stable, so no help there. Even as an incidental
factor (not causative), browser is apparently insignificant.

You are sure that the browse master is disabled on the Win98 computer?

Your LAN is wired (I was thinking maybe WLAN congestion causing loss of control
/ network connection icon, but, if wired that's not it either). Your observed
40% of time loss of control sort of rules out firewalls which should produce any
given problem 100% of the time.

Anything in the Event Logs for either computer? Any observed network events?

How about you get PingPlotter (free) from http://www.pingplotter.com/ and set it
to repeatedly ping each computer from the other, see if any of these 40% loss of
control situations correspond to any noticeable network anomaly.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Guest]

KK,

OK, the browser situation looks stable, so no help there. Even as an incidental
factor (not causative), browser is apparently insignificant.

You are sure that the browse master is disabled on the Win98 computer?

Your LAN is wired (I was thinking maybe WLAN congestion causing loss of control
/ network connection icon, but, if wired that's not it either). Your observed
40% of time loss of control sort of rules out firewalls which should produce any
given problem 100% of the time.

Anything in the Event Logs for either computer? Any observed network events?

How about you get PingPlotter (free) from http://www.pingplotter.com/ and set it
to repeatedly ping each computer from the other, see if any of these 40% loss of
control situations correspond to any noticeable network anomaly.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

Hi Chuck,

Yes, I'm sure the Browse Master is disabled on the Win 98 machine (checked
it just before my last post). Nothing I can see in the event logs. I did
download PingPlotter just in case, but (with all respect to the program and
programmers) I really don't like to install utilities like this that diddle
with the registry during installation. I have never had any trouble pinging
the ICS Host from any of the clients (latency always <1ms), so I don't really
see any benefit. If you do, you might persuade me to install and run it. I
certainly agree that the diagnosis is seriouly complicated by the
intermittency. As luck would have it, I have had no trouble all day today. I
had thought for a while that a ping or two from the client to the host opened
things up again, so I put an icon on my desktop which does ping the host, but
that doesn't seem to help after all (I thought a ping might "wake up" some
process on the host).

 

[Chuck]

Hi Chuck,

Yes, I'm sure the Browse Master is disabled on the Win 98 machine (checked
it just before my last post). Nothing I can see in the event logs. I did
download PingPlotter just in case, but (with all respect to the program and
programmers) I really don't like to install utilities like this that diddle
with the registry during installation. I have never had any trouble pinging
the ICS Host from any of the clients (latency always <1ms), so I don't really
see any benefit. If you do, you might persuade me to install and run it. I
certainly agree that the diagnosis is seriouly complicated by the
intermittency. As luck would have it, I have had no trouble all day today. I
had thought for a while that a ping or two from the client to the host opened
things up again, so I put an icon on my desktop which does ping the host, but
that doesn't seem to help after all (I thought a ping might "wake up" some
process on the host).

It's your dime (nowadays your quarter).

You've got an intermittent problem. Most of the diagnoses and repairs, which I
and the other helpers here would recommend, focus on consistent problems.
Without you identifying a pattern in your problem, I'm not too sure what we can
check. The first step in identifying a pattern is to authoritatively define
precisely when the problem is occurring.

I personally use PingPlotter a lot - from diagnosing a problem with my router,
to documenting an ongoing problem with my broadband service. But if you can
authoritatively state that manual pings already performed make this unnecessary,
I'll go with that.

As an alternative, let's see if I can think of some hints. What other events
are happening when this problem is observed, or when it was first observed?
- Any combination of the other computers online or offline?
- Any specific program being run on any computer?
- Any websites of interest surfed to recently, or when the problem is noted?
- Any external events - microwave oven or cordless phone (admittedly more
applicable to wireless networks but in your case...) being used?
- Any time of day / week pattern?
- Any software installed or un installed?

Any ideas from my hints?

As an aside, and having noted your frustration in the first post in this thread,
I looked for your previous post of a week ago, without success. Did you make
that post under this same nym "KumbiaKid"?

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

 

[Guest]

It's your dime (nowadays your quarter).

You've got an intermittent problem. Most of the diagnoses and repairs, which I
and the other helpers here would recommend, focus on consistent problems.
Without you identifying a pattern in your problem, I'm not too sure what we can
check. The first step in identifying a pattern is to authoritatively define
precisely when the problem is occurring.

I personally use PingPlotter a lot - from diagnosing a problem with my router,
to documenting an ongoing problem with my broadband service. But if you can
authoritatively state that manual pings already performed make this unnecessary,
I'll go with that.

As an alternative, let's see if I can think of some hints. What other events
are happening when this problem is observed, or when it was first observed?
- Any combination of the other computers online or offline?
- Any specific program being run on any computer?
- Any websites of interest surfed to recently, or when the problem is noted?
- Any external events - microwave oven or cordless phone (admittedly more
applicable to wireless networks but in your case...) being used?
- Any time of day / week pattern?
- Any software installed or un installed?

Any ideas from my hints?

As an aside, and having noted your frustration in the first post in this thread,
I looked for your previous post of a week ago, without success. Did you make
that post under this same nym "KumbiaKid"?

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.

Hi again Chuck,
I understand what you're saying about narrowing down the possibilities. I'm
a trained researcher (PhD) and IT professional with a reputation for well
above average trouble shooting skills. I've just been very frustrated by this
one. Maybe we've (to use an Australian expression) "put the wind up" the
gremlin that causes this problem because it hasn't recurred since you first
responded to my query. I have wondered about the state of the host machine
when the problem raises its ugly head but haven’t yet been able to pinpoint
anything. Since I’m not the primary user of that machine, I can’t really
account for what has or hasn’t been done on it every time which makes the
process all that more frustrating. I will, however, be paying very close
attention to, and documenting, what is going on with that machine when next
the problem occurs. (including pinging from both directions). To help with my
paranoia (your signature in mind), can you tell me what changes, if any,
PingPlotter makes to the registry? It looks as though it doesn’t modify or
replace any existing dlls, so maybe I’ll have a go with it anyway.

With regard to your specific hints:
- The same computers have been on line the whole time
* Specific programs being run - needs further investigation (see above)
- Websites. That’s an interesting one. Could you elaborate on why that might
be important? If you’re thinking malware, I routinely keep an eye on AdAware,
SpyBot, and HijackThis, so I think malware is unlikely.
- the microwave is a long ways away and has been used without ill effect;
cordless phone is close, but has also been used without ill effect and, as
you hinted, not likely that these things would have any effect on a Cat 5
network
- the problem has occurred at all times of day/week
- no software installs/uninstalls between working and not working

As for my previous post, yes it was under the same name -- just search for
"KumbiaKid" and you should find it (the original was on the 9th of March).

Cheers,
KumbiaKid

 

[Chuck]

On Mon, 14 Mar 2005 17:27:01 -0800, KumbiaKid

Hi again Chuck,
I understand what you're saying about narrowing down the possibilities. I'm
a trained researcher (PhD) and IT professional with a reputation for well
above average trouble shooting skills. I've just been very frustrated by this
one. Maybe we've (to use an Australian expression) "put the wind up" the
gremlin that causes this problem because it hasn't recurred since you first
responded to my query. I have wondered about the state of the host machine
when the problem raises its ugly head but haven’t yet been able to pinpoint
anything. Since I’m not the primary user of that machine, I can’t really
account for what has or hasn’t been done on it every time which makes the
process all that more frustrating. I will, however, be paying very close
attention to, and documenting, what is going on with that machine when next
the problem occurs. (including pinging from both directions). To help with my
paranoia (your signature in mind), can you tell me what changes, if any,
PingPlotter makes to the registry? It looks as though it doesn’t modify or
replace any existing dlls, so maybe I’ll have a go with it anyway.

With regard to your specific hints:
- The same computers have been on line the whole time
* Specific programs being run - needs further investigation (see above)
- Websites. That’s an interesting one. Could you elaborate on why that might
be important? If you’re thinking malware, I routinely keep an eye on AdAware,
SpyBot, and HijackThis, so I think malware is unlikely.
- the microwave is a long ways away and has been used without ill effect;
cordless phone is close, but has also been used without ill effect and, as
you hinted, not likely that these things would have any effect on a Cat 5
network
- the problem has occurred at all times of day/week
- no software installs/uninstalls between working and not working

As for my previous post, yes it was under the same name -- just search for
"KumbiaKid" and you should find it (the original was on the 9th of March).

The only registry entries that I can find for PingPlotter (apart from a few
MRUs, shortcuts, and a file association for .pp2) appears to be the registration
key for the software (PP is one of the few products I've paid for - I paid $15 4
years ago, and they periodically send free upgrades, with no additional bill).

You're right about the .dll bit - when you upgrade all you are told is "Close
any copies of PP currently running", and afterwards "Do you want to start PP
now?". Apparently no system interactions at all. Very discrete install.

WRT my hints, those were simply idle thoughts that might help get a handle on a
pattern of incidents. Sounds like you've got that in hand, so I'll leave you to
it.

--
Cheers,
Chuck
Paranoia comes from experience - and is not necessarily a bad thing.
My email is AT DOT
actual address pchuck sonic net.