MS Windows NT Browser
Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when
originally published, but now link to sites or pages that no longer exist.
Abstract
This white paper provides information and procedures for implementing the Microsoft Windows NT Browser on Microsoft
Windows NT® 4.0 operating system–based client workstations and servers.
On This Page
Introduction
MS Browsing Overview
Microsoft TCP/IP and Name Resolution
Troubleshooting Browsing
For More Information
Appendix A: Browsing in a Switched Environment
Appendix B: The Multihomed Windows NT Browser
Appendix C: Windows NT Printer Browsing
Appendix D: Windows NT Browser Components
Appendix E: Windows NT Browser Registry Options
Appendix F: windows NT Browser Error Codes
Appendix G: Network Layers Involved in Browsing
Appendix H: Windows NT Browser Protocol Frames
Introduction
Maintaining an accurate and efficient browse list on the network is important topic for Microsoft customers. This technical
paper provides up-to-date information on Microsoft network browser architecture and reference material for advanced
troubleshooting of browsing issues.
The browse list can be accurately maintained in any environment if the browser architecture, capabilities, and the way in
which the network topology affects the browser's ability to gather information on the network are taken into consideration.
Understanding the operation of the browser services available on Microsoft operating systems is critical in effective
troubleshooting. For example, the browser service relies on broadcasts when gathering information locally and needs the
services of WINS or other name-resolution methods to pass a browse list to remote networks. The details of this process and
the methods used are presented in this paper.
This paper should dispel some common misunderstandings about the browse list. The presence or lack of a computer name in
the browse list does not give a clear indication of the computer's status on the network. A delay in gathering a browse list may
occur due to various circumstances; however, a system can typically be contacted directly even though it cannot be found in
Network Neighborhood. A system missing from the browse list should not be a cause for immediate concern, unless the
system is consistently missing.
Although the primary focus of this paper is to give network administrators an understanding of browser architecture, it also
deals with troubleshooting situations where the browse list is inaccurate or unavailable.
Top Of Page
MS Browsing Overview
The browser is a network resource enumeration tool first created for LAN Manager 1.0. Windows for Workgroups enhanced the
browser to make it truly client/server, and finally it was enhanced for domain browsing on a Windows NT® operating system–
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 2 of 31
based network. The Microsoft networking browser maintains a list called the browse list. The browse list is an enumeration of
all the available servers, workgroups, and domains (for Windows NT and LAN Manager networks). For example, when a user
attempts to connect to any network resource, using Network Neighborhood, the list of servers that appears is the browse list.
The browse list is provided by a browser in the local computer's workgroup or domain.
The Microsoft networking browser system consists of a domain master browser, master browsers, backup browsers, and client
computers. The domain master browser maintains the complete domain browse list. The master browsers periodically query
the domain master browser to obtain a complete list of domain resources. The master browser maintains the browse list and
periodically sends copies to the backup browsers. When a browser client needs information, it obtains the current browse list
by sending a NetServerEnum2 call to either the master browser or a backup browser.
NetServerEnum2 returns information about the server type (SV_TYPE_SERVER) entries in a domain or workgroup. It allows
client computers to view a specific set of servers in the workgroup or domain. NetServerEnum2 provides a server type mask
that allows users to query for various types of servers, such as workstations, servers, time servers, domain controllers, and so
on. Printer browsing and Windows Terminal Server clients rely on this type of browsing to enumerate their respective
resources
This centralized browser architecture for Windows networking resources reduces the number of broadcast datagrams on the
network. A datagram is a network packet that is sent to a mailslot on a specified computer (a directed datagram) or to a
mailslot on any number of computers (a broadcast datagram). The centralized browser architecture also reduces the demands
on the client computer's CPU and memory.
Note: For Microsoft networking using the Microsoft TCP/IP protocol, broadcast name resolution is a direct implementation of
Request for Comments (RFCs) 1001 and 1002 (NetBIOS Service Protocols). This implementation of NetBIOS over TCP/IP is
wholly compliant with the RFCs, and does not involve any method of what has been referred to as NetBEUI encapsulation. For
more information about NetBIOS over TCP/IP (NetBT), see the discussion of name resolution for Windows-based networking in
Windows NT Server NetworkingGuide.
In a Windows NT domain, every Windows NT Server–based computer is a browser. The primary domain controller (PDC), if
there is one, is the domain master browser, and the other computers running Windows NT Server, Windows NT Workstation,
or the Windows® 95 operating system are backup browsers. If there is more than one Windows NT Server–based computer in
the domain, no computer running Windows NT Workstation or Windows 95 should ever be a master browser in the domain. In
a workgroup containing computers running Windows 95 and Windows NT Workstation, there is always one master browser. If
there are at least two Windows 95- or Windows NT Workstation–based computers in the workgroup, there is also one backup
browser. For every 32 computers running Windows 95 and Windows NT Workstation in the workgroup, there is another
backup browser. The following section describes how computers become browsers and summarizes the roles played by master
and backup browsers.
Multiprotocol Considerations
The browser maintains all of its server information on a per-transport basis. A transport is the physical network card bound to
a protocol. When a client application issues a NetServerEnum call, the code running on the workstation enumerates all the
serviced networks and forwards the NetServerEnum call to a browser server for that particular transport. When a browser
server receives the request, it returns only those servers on the same network from which it received the transaction
originally. Therefore, browsing occurs on each transport independently, regardless of other available transports.
Each computer running Windows 95, Windows for Workgroups, Windows NT Workstation, or Windows NT Server has
configuration settings that determine whether that computer can become a browser. For servers running Windows NT, the
value for MaintainServerList for the browser service determines its possible role as a browser. By default, servers are
configured to have the potential to become browsers. Unless the server is specifically configured to never be a browser, the
Microsoft networking browser service starts automatically when the computer starts, and the server announces itself on the
networking using the special NetBIOS name <DOMAIN><1e>.
When a computer running Windows NT Server starts (that is, a preferred master browser is started)
When any server needs to force a master browser election, it notifies the other browsers on the system by broadcasting an
election datagram that contains the sending browser's election version and election criteria. The election datagram and
subsequent communications are sent to the NetBIOS name <DOMAIN><1e>.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 3 of 31
The election version is a constant value that identifies the version of the browser election protocol. If the election versions are
identical for both computers, the election criteria are compared. The election criteria consist of a 4-byte hexadecimal value.
Specific groups of bytes are masked and their values set according to the following table:
Windows 95 0x01000000
When a browser receives an election datagram, the receiving browser compares the election version in the datagram with its
own. If the receiving browser has a higher election version than any other browser, it is elected, regardless of any other
election criteria. For example, a computer running any version of Windows NT is always elected over a computer running
Windows 95. If the election versions are identical, the receiving browser compares the election criteria as follows:
If the receiving browser has a higher election criterion than the sending browser, the receiving browser issues its own
election datagram and enters the election in progress state.
If the receiving browser does not have a higher election criterion than the sending browser, the receiving browser
attempts to determine which computer is the new master browser.
If there is still a tie, the browser that has been running longest is elected. If there is still a tie, the browser that has a
lexically lower name is elected. For example, when all other criteria are equal, a server named A1 is elected over a
server named B1.
When a browser receives an election datagram indicating that it is elected, the browser enters the running election state. In
the running election state, the browser sends an election request after a delay based on the browser's current browser role:
The browser broadcasts up to four election datagrams. If, after four election datagrams, no other browser with an election
criterion that would win the election has responded, the browser becomes the master browser. If the browser receives an
election datagram indicating that another system would be elected, the browser demotes itself to backup browser. To avoid
unnecessary network traffic, a browser that has lost an election does not broadcast any unsent election datagrams.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 4 of 31
The master browser maintains the browse list, which is the list of all servers in the master browser's domain or workgroup,
plus the list of all domains on the network. For a domain that spans more than one subnetwork or broadcast collision zone
(Like a V-LAN), the master browser maintains the browse list for the portion of the domain on its subnetwork or broadcast
collision zone. The rest of the domain is known based on domain announcements made by the domain master browser.
Individual servers running Windows NT Server, Windows NT Workstation, Windows 95, Windows for Workgroups, or LAN
Manager announce their presence by sending a directed datagram called a server announcement (HostAnnouncement)
datagram to the domain or workgroup's master browser. This announcement includes the server's NetBIOS name of
<01><02>MSBROWSE<02><01>, <DOMAIN><1d>, or <DOMAIN><1e>, as appropriate for the type of server. When the
master browser receives a server announcement from a computer, it adds that computer to the browse list. The master
browser then returns lists of backup browsers to computers running Windows NT Server, Windows NT Workstation, Windows
95, and Windows for Workgroups. When a computer starts that is configured to automatically become a browser if required,
the current master browser must tell that computer whether to become a backup browser. If its browse list is empty when a
computer first becomes a master browser, it can force all servers to register with it by broadcasting an announce request
(AnnouncementRequest) datagram. All computers receiving this datagram must respond by sending a server announcement
at a random time within the next 30 seconds. The randomized delay ensures that the network and the master browser itself
are not overwhelmed with responses. When a master browser receives a server announcement from another computer that
claims to be the master browser, the receiving master browser demotes itself and forces an election as described in the
previous section. This ensures that there is always only one master browser in each domain or workgroup.
Backup browsers call the master browser every 15 minutes to get the latest copy of the browse list, as well as a list of
domains. Each backup browser caches these lists and returns the list of servers to any clients that send a remote
NetServerEnum call to the backup browser. If the backup browser cannot find the master browser, it forces an election.
The browser service running on a domain's primary domain controller (PDC) has the special additional role of being the
domain master browser. The PDC of a domain has a bias in browser elections to ensure that it becomes the master browser.
On networks using TCP/IP where a domain spans more than one subnetwork, each subnetwork functions as an independent
browsing entity, with its own master browser and backup browsers. Name-query datagrams should not cross routers. When
routers or switches are misconfigured and propagate UDP port 137 and 138 broadcasts, large numbers of event 8003 appear
in the event log. For more information, see the following Knowledge Base articles:
To browse across the wide area network (WAN) to other subnetworks, at least one browser running Windows NT Server is
required on the domain for each subnetwork. On the subnetwork where the PDC is located, this Windows NT Server–based
computer is usually the PDC, which functions as the domain master browser. When a domain spans multiple subnetworks, the
master browser for each subnetwork announces itself as the master browser to the domain master browser by sending a
directed MasterAnnouncement datagram, using the computer's NetBIOS <DOMAIN><1d>. The domain master browser then
sends a remote NetServerEnum call to each master browser to collect each subnetwork's list of servers. The domain master
browser merges the server list from each subnetwork master browser with its own server list to form the browse list for the
domain. This process is repeated every 15 minutes to ensure that the domain master browser has a complete browse list of all
the servers in the domain.
The master browser on each subnetwork also sends a remote NetServerEnum call to the domain master browser to obtain
the complete browse list for the domain. This complete browse list is thus available to browser clients on the subnetwork.
Note: Microsoft networking workgroups cannot span multiple subnetworks. Any workgroup that spans subnetworks actually
functions as two separate workgroups with identical names. To span multiple collision zones, a Windows NT domain must
exist.
A failed server stops announcing itself. When the master browser does not receive a server announcement for three of the
server's current announcement periods, the master browser removes that server from the browse list. It might take up to an
additional 15 minutes for the backup browsers to retrieve the updated browse list from the master browser, so it could take as
long as 51 minutes from the time a server fails to the time when it is removed from all browse lists.
Because a backup browser announces itself in the same way as a server, the procedure when a backup browser fails is the
same as that for a server. If the name of this backup browser has been given to any clients, attempts made by those clients
to contact this backup browser fail. The client then retries the NetServerEnum call on another backup browser on the client's
list of browsers. If all the backup browsers that a client knows have failed, the client attempts to get a new list of backup
browsers from the master browser. If the client is unable to contact the master browser, it forces a browser election. The
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 5 of 31
client then returns an error to the application, indicating that the master browser could not be found.
When a master browser fails, the backup browsers detect the failure within 15 minutes. The first backup browser to detect the
failure forces an election to select a new master browser. Between the time that the master browser fails and the time that a
new master browser is elected, the domain could disappear from the list of domains in the browse list. If a client performs its
first NetServerEnum call after the old master browser has failed but before a backup browser detects the failure, the client
forces an election. If a master browser fails and there are no backup browsers, browsing in the workgroup or domain does not
work correctly.
When a domain master browser fails, other master browsers see only servers on their own local subnetwork. Eventually, all
servers that are not on the local subnetwork are removed from the browse list.
When a server is started, it announces itself by sending a host announcement to the master browser every minute. This
announcement uses the special NetBIOS name of <DOMAIN><1d>. As the computer continues running, the time between
server announcements is increased until it eventually becomes once every 12 minutes. If the master browser has not received
a server announcement from a computer for three announcement periods, the computer is removed from the browse list.
Therefore, there might be up to a 36-minute delay between the time that a server goes down and the time that it is removed
from the browse list. Client computers sometimes need to retrieve lists of domains, as well as lists of servers in those
domains. To support this, when a browser becomes a master browser, it broadcasts a DomainAnnouncement datagram every
minute for the first five minutes, and then broadcasts once every 15 minutes after that. Master browsers in domains and
workgroups announce their presence to the special NetBIOS name of <01><02>MSBROWSE<02><01> and register their
names with this group. Master browsers on other domains receive these DomainAnnouncement datagrams and add the
specified domain to the browse list.
DomainAnnouncement datagrams contain the name of the domain, the name of the domain master browser, and whether the
master browser is running Windows NT Server, Windows NT Workstation, or Windows 95. If the master browser is running
Windows NT Server, the datagram also specifies whether that browser is the domain's PDC. If a domain has not announced
itself for three consecutive announcement periods, the domain is removed from the browse list. Therefore, a domain might be
down for as long as 45 minutes before it is removed from the browse list. When a master browser is shut down correctly, it
sends a ForceElection broadcast so that a new master browser can be elected. When a backup browser is shut down correctly,
it sends an announcement to the master browser that it is shutting down. To do this, it sends a server announcement that
does not include the browser service in the list of running services.
In a LAN environment using any protocol or combination of protocols, all Microsoft network browsing activities are maintained
using broadcasts and special NetBIOS names that identify the type of resource. All browsing services are provided on a per-
protocol basis to prevent, for example, a NetBEUI-only client from enumerating a TCP/IP-only server in the process of
querying the browser. The NetBIOS name space is not hierarchical, so all names must be unique on the network. Resources
are identified by NetBIOS names, which are registered dynamically when the computer starts, a service starts, or a user logs
on. The special NetBIOS names used in Microsoft networking are indicated by adding a hexadecimal value as a sixteenth byte
at the end of the 15-character computer name or domain name. If the computer or domain name is less than 15 characters,
spaces are used to pad the name to the sixteenth byte. The discussion of browsing in this paper uses the special NetBIOS
names to explain how names are registered and resolved for browsing on Microsoft networks. The following table shows some
of these special names:
<USERNAME><03> Used to register the name of the user currently logged on in the WINS database
so that users can receive net send commands sent to their user names
<COMPUTER><03> Used as the computer name that is registered for the messenger service on a
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 6 of 31
<COMPUTER><20> Used as the name that is registered for the server service on a Windows NT–
based computer that is a WINS client.
<COMPUTER><Be> Used as the unique name that is registered when the Network Monitor agent is
started on the computer.
<COMPUTER><Bf> Used as the group name that is registered when the Network Monitor agent is
started on the computer. If this name is not 15 characters in length, it is padded
with plus (+) symbols
<COMPUTER><1f> Used as the unique name that is registered for network dynamic data exchange
(DDE) when the NetDDE service is started on the computer.
<01><02>MSBROWSE<02><01> Used by master browser servers to periodically announce their domain on a local
subnet. This announcement contains the domain name and the name of the
master browser server for the domain. In addition, master browser servers
receive the domain announcements sent to this name and maintain them in their
internal browse list along with the announcer's computer name.
<DOMAIN><1b> Used to identify the domain master browser name, which is a unique name that
only the primary domain controller (PDC) can add. The PDC processes
GetBrowserServerList requests on this name. WINS assumes that the computer
that registers a domain name with the <1b>character is the PDC. The 1B entry is
resolved to when NetGetDcName is called.
<DOMAIN><1c> Used for the internet group name, which the domain controllers register. The
internet group name is a dynamic list of up to 25 computers that have registered
the name. This is the name used to find a Windows NT domain controller for pass-
through authentication. The 1C entry is resolved to when NetGetAnyDcName is
called.
<DOMAIN><1d> Used to identify a segment master browser (not a domain master browser). The
master browser adds this name as a unique NetBIOS name when it starts.
Workstations announce their presence to this name so that master browsers can
build their browse list.
<DOMAIN><1e> Used for all domain-wide announcements by browser servers in a Windows NT–
based server domain. This name is added by all browser servers and potential
servers in the workgroup or domain. All browser election packets are sent to this
name.
The following example shows a sample NetBIOS name table for a Windows NT 4.0 primary domain controller (PDC), based on
the list that appears if you type nbtstat -n at the command prompt. This example shows the sixteenth byte for special
names, plus the type of NetBIOS name (unique or group).
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 7 of 31
In this example, several special names are identified for the Windows NT Primary Domain Controller (DOMAINPDC in the
previous example) and the domain (DOMAINNAME), including the following:
computer\0x00 (shown as <00> in the example) indicates the computer name associated with the Workstation service.
computer\0x20 (shown as <20> in the example) indicates the computer name associated with the Server service.
domain\0x1e indicates that this computer can serve as a backup browser in this domain.
computer\0x03 indicates the computer name associated with the Messenger service.
When an application running on a client computer makes a NetServerEnum call, the client sends the call to a browser. If this
is the first time this call has been made by an application on this client, the client must first determine which computers are
the browsers in its workgroup or domain. This datagram is in the form of a Get Backup List Request datagram sent to the
special NetBIOS <DOMAIN><1d> name that the master browser has registered. This request is processed by the master
browser for the client's domain and subnetwork. The master browser then returns a list of browsers active in the workgroup or
domain being queried, via the Get Backup List Response datagram. The client selects the names of three browsers from the
list, and then stores these names for future use. The client computer randomly chooses a browser from one of the three
browser names and calls NetServerEnum, requesting a list of servers or domains. The browser server returns the list to the
client, which then can be displayed in Network Neighborhood.
If the user selects a domain name in the browse list, a new set of browser servers must be found for the new domain. In this
case, a Get Backup List Request frame is sent to the new domain name. After a user selects a server, the browser is no longer
involved in the process of contacting the server for a list of available resources. The transport protocols on the client computer
use whatever name resolution methods are available to find and connect to the server. When the client workstation attempts
to connect to a server, a NetBIOS session is established between the two computer names. For example, when a Windows
NT–based client workstation on an IP network connects to a Windows NT Server, the following occurs:
The client sends a NetBIOS session request to the server name over the TCP connection.
The client and server negotiate a higher-level protocol to use over the NetBIOS session.
Only one NetBIOS session at a time is established between two computers. Additional connections for file or printer sharing
are multiplexed over the same NetBIOS session.
Top Of Page
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 8 of 31
Microsoft TCP/IP uses NetBIOS over TCP/IP, as specified in RFC 1001 and RFC 1002, which define a software interface that
supports name resolution for NetBIOS client and server programs in the WAN environment. All Microsoft networking products
use NetBIOS over TCP/IP for registering and locating NetBIOS resources on IP networks. The various methods used for name
resolution include the following:
IP subnet broadcasts
DNS servers
The order of methods use for NetBIOS name resolution depends on the node type (as defined in RFC 1001/1002) and the
particular computer configuration for TCP/IP. The following are the node types:
P-node, which uses point-to-point communications with a NetBIOS name server to resolve names
M-node, which uses broadcasts first (b-node), and then name queries (p-node) if broadcasts are not successful
H-node, which uses name queries first (p-node), and then broadcasts (b-node) if the name server is unavailable or if the
name is not registered in the WINS database
If WINS is enabled on a Windows 95 computer, the system uses h-node by default. Without WINS, the system uses b-node by
default. To see which node type is configured on a Windows NT–based computer, check the value for NodeType in the
following registry key:
Computer Name and Host Name Resolution with NetBIOS over TCP/IP
The following diagrams summarize the methods for attempting name resolution with TCP/IP.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 9 of 31
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 10 of 31
WINS solves two problems for browsing in the WAN: the building of a comprehensive domain list and name resolution for
members within a domain or workgroup. The following list summarizes issues for browsing in a WAN environment with WINS:
Workgroups still cannot span subnetworks because they have no equivalent to the domain master browser.
The process of building domain lists uses the WINS database and domain\0x1b names to locate the domain master
browser. Workgroup lists are still based on members' announcing their presence periodically. For example, an isolated
workgroup on an island subnet with no domain members is invisible to the WAN until a domain member is added that
shares the presence of the subnet.
The ability to expand a workgroup or domain depends on the ability to resolve the master browser's computer name. If
WINS-enabled computers are running in workgroups and domains, this is adequate.
The ability to connect to a resource in a workgroup depends on the ability to resolve the resource's name. Again, WINS-
enabled computers support this adequately. It is possible to connect to a resource that you cannot browse and to browse
a resource that you cannot connect to.
Tip for browsing with WINS Because of how PDCs register the domain\0x1b entry with WINS, ensure that all clients and
servers are members of a domain.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 11 of 31
The unique NetBIOS name of domain\0x1b that the PDCs register is treated specially by WINS and is used to build a table of
all domains on a WAN network. The browser on the client periodically connects to WINS and learns of all the systems that
registered the domain\0x1b name. The browser then uses a NetGetDCName call on each of the domain\0x1b names,
followed by an attempt on the domain\0x1c names. The browser then adds the domain master browser's name to its domain
and workgroup list. This eliminates the need to strategically place workgroup or domain members on subnets to ensure that
comprehensive domain and workgroup lists are built. With WINS, the domain\0x1e name registration is ignored and treated
as a normal group name. This forces browser elections to remain on subnetworks, rather than extending elections to the WAN.
This increases fault tolerance and reduces periodic network-wide traffic. The same is true for the domain\0x1d and
<01><02>MSBROWSE<02><01> group names. This also reduces the scope of the announcement broadcasts on the
subnetwork. The unique domain\0x1b name and the internet group domain\0x1c name are maintained by WINS and are used
during logon and for NetGetAnyDCName calls.
Top Of Page
Troubleshooting Browsing
While there is no centralized method to determine if the browse lists across the WAN are complete, there are techniques to
determine if the servers on a particular segment are represented in the browse list on a remote segment. These techniques
can be applied on all segments throughout the WAN, but the results of these tests can vary due to the roles of the servers
changing when browser elections occur. Only if all the servers in a domain throughout the WAN are completely static and no
servers come on or off-line, do the results of these tests have meaning over time. The tests described in this section rely on
the Windows NT Resource Kit utility Browstat.exe. Example output is for the TCP/IP protocol only. Also, as with most network
problem diagnosis, to troubleshoot the browser service the administrator must have full knowledge of the network segment
boundaries, switches, and router configurations on the network. For example, if a client on a remote segment does not have a
server in its browse list that is located on another segment, it is not advisable start troubleshooting until after the 48-minute
cycle described above has passed. Remember that name resolution between all browsers is critical, and it is most important to
establish a robust name resolution infrastructure with WINS. For browsing to work, name resolution must be functional.
1. Find the master browser on the segment where the server resides.
The following command must be executed on the segment where the missing server resides:
BROWSTAT STATUS
Status for domain <DomainName> on transport \Device\NetBT_IEEPRO1
Browsing is active on domain.
Master browser name is: <MasterBrowser>
Master browser is running build 1381
1 backup servers retrieved from master <BackupBrowser>
\\SmallerServer
There are 100 servers in domain DomainName on transport \Device\NetBT_IEEPRO1
There are 1500 domains in domain DomainName on transport \Device\NetBT_IEEPRO1
This should tell you which server is acting as the master browser on the segment. If the local master browser is slow to
respond, you may have received this information from another master browser.
The results of this command gives you the "\Device\Protocol_NIC" string and can be used with other Browstat
commands.
To find the local master browser on the client's segment, execute the following:
Using the Status or Getmaster switch issues a DomainName<1d> query and returns the current master browser for
that segment.
Now you must determine which master browser is on the segment that contains the missing server's name. If a master
browser cannot be found, you can force an election by stopping and starting the browser service on a domain controller
that is on the server's segment. In a few minutes, re-run this test. Alternatively, on the console of a server on the
server's segment you can force an election by executing the following command:
2. Does the master browser have the server's name in its list?
The master browser is the first server in the chain of communication that must contain the missing server's name. This
test determines if the master browser has received the server's Host Announcement frame. Note that the "\device…"
string is obtained from the output above. Execute the following:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 12 of 31
If the master browser has the server in its list, the command returns something similar to the following:
If the local master browser does not have the server's name, the following can be executed from any computer on the
missing server's segment:
It may be useful to verify that the missing server can map a network drive to the master browser to verify network
connectivity. Also, the server can be rebooted to force a Host Announcement frame.
3. Does the PDC receive the server's name from the master browser?
If the server's name is missing, this is probably due to name resolution problems. For the PDC to obtain the list of
servers from the master browser, the server's master browser must be able to resolve the DomainName<1b> name so
that it can send the directed Master Announcement frame, using UDP port 138. For the PDC to respond to this
announcement to obtain the server's name, it must be able to resolve the master browser's computer name. (For the
server's master browser to obtain the domain-wide list from the PDC, it too must be able to resolve the PDC's
computer name.) Name resolution in both directions is critical. To verify that the server's master browser can resolve
the DomainName<1b> entry, execute the following:
To verify that both the PDC and the master browser can resolve each other's computer names, map a network drive
from the master browser to the PDC and from the PDC to the master browser. If any of these steps fail, resolve the
name resolution problem.
This is done using the same steps as in number 1 above, but is executed on the client's segment.
If the server has the entry, the output should be similar to the following:
If the master browser does not have the missing server's name, it is probably due to a name resolution problem. Verify
that the master browser on the client's segment is able to resolve the DomainName<1b> name by executing the
following:
The master browser must be able to resolve the computer name of the PDC. To verify this, map a network drive to the
PDC. If either of these tests fail, resolve the name resolution problem.
To reduce demands on the segment master browser, when a client requests a browse list, it chooses a backup browser,
if one is available. Therefore, it is more likely that all clients will use backup browsers. There are two ways to determine
the local backup browsers for this segment. From the master browser's console, execute the following:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 13 of 31
To have the master browser perform this command remotely, execute the following:
For all clients on this segment to retrieve a reliable browse list, every backup browser must be checked for the missing
server's name. For each backup browser, execute the following:
If a backup browser does not contain the missing server's name, verify that the backup browser can map a network
drive to the master browser. The backup browser role is the most dynamic browser role. Master browsers instruct
potential browsers to become backup browsers, depending on the browser load.
8. Other considerations:
To avoid experiencing intermittent browser functioning and having to perform these tests, you may need to dedicate
computers on each segment to maintain a consistent domain-wide list. If servers are frequently shut down and
restarted, consider placing a BDC if the number of segments is not large, or at minimum a Windows NT Member Server
on each segment with the IsDomainMaster registry setting set to true. This gives the server an edge during elections in
becoming the master browser for the segment.
For all the previous steps, if none of the suggestions allow you to proceed to the next step, verify that none of the browser
servers that you have identified have a "name in conflict" error. This can be seen by executing the following:
NBTSTAT –n
The browser is very sensitive to the configuration of the routers throughout the WAN. Since the browser roles are determined
by broadcast elections, UDP broadcasts must not be forwarded. Unpredictable behavior can occur if UDP broadcast traffic is
forwarded in one direction but not the other. This may generate 8003 Browser events, causing a continuous cycle of elections.
Additionally you can resolve problems with a protocol analyzer such as the Microsoft Network Monitor. To view the browser
exchanges directly, the browser service can be stopped, and then restarted. Unfortunately, there is no guarantee that a
browser will assume the same role that it had before stopping and starting the browser service. However, this method can be
especially useful to verify the communication when the master browser requests the domain-wide list from the PDC, and
immediately following when the PDC requests the local list from the master browser. After the browser service has started on
the master browser, the full exchange should take place within one or two minutes. Configure the protocol analyzer's capture
buffer and frame size settings to allow for this quantity of traffic. The list of servers returned by the browse service prior to
Windows NT 4.0 was limited to 64 KB in size. When this size is exceeded, the user sees a truncated alphabetical list of
servers. To avoid this behavior, all browsers must be running Windows NT version 4.0 or later.
Top Of Page
Top Of Page
LAN switching is a technology that replaces hubs and shared media with a switch. A switch is a device that operates at layer 2
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 14 of 31
and/or layer 3 of the OSI model, building dedicated segments between two computers, thus eliminating the congestion
associated with shared media. The net effect of switches is increased bandwidth to the desktop. LAN switching builds upon the
concept of microsegmentation, or the ability to provide a dedicated segment to the desktop. Each port on the switch provides
that dedicated segment. Switches working at layer 2 of the OSI model have the ability to build tables that associate a specific
port with MAC addresses, which then allows packets to be forwarded directly to the appropriate port.
A connection can be dynamically generated between two ports on the same switch or directly from a specific port to the
default gateway. Switches can have multiple data streams passing through them simultaneously. However, when a switch
receives a broadcast or multicast packet, the switch must flood all of the ports except the originating port. This is a technique
known as broadcast flooding. Under this circumstance the switch is operating like a simple bridge, and a network that is built
only on switch technology appears flat. A flat network is a network that is comprised of only one broadcast collision domain. A
network that is reduced to one collision domain is susceptible to broadcast storms and does not scale well.
Modern switches support VLANs as a mechanism to administer and scale switched networks. The VLAN in its simplest form is a
grouping or collection of specified ports that form a single collision domain. Advanced VLAN configurations can be defined on a
per-protocol basis or even by a user-defined specification. VLANs provide a great amount of flexibility in designing collision
domains.
Browsing in a switched environment follows the same principles that were established in the previous sections of this paper.
Additionally, you should consider the impact of VLAN design on the collision domains. Do the VLANs map to the IP subnets or
not? The same steps that were discussed in the troubleshooting browsing section still apply, but they must be extended to
include the VLANs as collision domains. You can no longer just consider physical segments as collision domains; a VLAN may
be the new broadcast boundary.
Top Of Page
Windows NT 4.0 provides a new registry parameter that allows the computer browser service to be disabled on one or more
network interfaces. When the UnboundBindings registry parameter is added, it enables a multihomed domain master browser
to provide a comprehensive browse list to computers on all subnets.
135404: Multihomed Master Browser May Cause Event ID 8021 and 8032
Top Of Page
Shared printers are found when a user browses for a printer in a domain. A remote procedure call (RPC) (EnumPrinters) is
made to the browse master. The RPC returns only the computers in the browse list that have set the printer flag
(SV_TYPE_PRINT) in their host announcements.
The following is a network trace fragment that illustrates a client browsing a Windows NT Print Server:
Client request:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 15 of 31
Server response:
Windows NT Server- and Workstation–based computers update the browse master by default every 10 minutes with print
share information. This is done by the AddPrinter function.
The following is a network trace fragment that demonstrates a client enumerating shared resources to the print browse
master:
The following is a list of registry entries that manipulate client and server behavior in regard to print browsing:
HLM\SYSTEM\CurrentControlSet\Control\Print
DisableServerThread – REG_DWORD
Range: 0 or 1
Default: 0 (false)
Set this to 1 (true) to disable the browse thread on the current computer. This thread is used to call other print servers
to notify them that this printer exists.
ServerThreadTimeout – REG_DWORD
Range: Milliseconds
Specifies the amount of time that the ServerThread sleeps before it calls all the other print servers to notify them of the
printers on this computer.
NetPrinterDecayPeriod – REG_DWORD
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 16 of 31
Range: Milliseconds
RefreshTimesPerDecayPeriod – REG_DWORD
Range: 1–5
Default: 2
Specifies how many times to inform the browse masters and backup servers per decay period. The default value is two
times per hour. Do not set a 0 value if you specify both RefreshTimesPerDecayPeriod and ServerThreadTimeout; the
system waits for the maximum of either the ServerThreadTimeout or the RefreshTimesPerDecayPeriod.
Top Of Page
At system startup, the Windows NT Service Controller starts Services.exe (formerly Lmsvcs.exe, the LanmanServer service).
For each service under its control, Services.exe creates a thread that begins execution at the service's service routine entry
point. The browser service's service routine, in Browser.dll, proceeds as follows:
1. Registers a service control routine for the browser service stop, pause, and continue
3. Sends initialization information to the kernel mode datagram receiver (Browser.sys/Rdr.sys) code
4. Starts the thread that does the actual work of the service
Browser.dll is a user mode component responsible for maintaining the browse list, forwarding APIs, and managing the various
roles of the browser. When using Wnet functions to browse Windows NT network resources, the functions resolve, by the
NTLM API (NETAPI32.DLL), to the NTLM service DLL Browser.dll. Browser.dll uses an internal API to work with the kernel
mode NTLM datagram receiver to carry out the requested resource browsing functions. Both Lmsvcs.exe and Services.exe can
be found under \<Winnt root>\System32 for their respective operating system versions.
The kernel mode portion of the browser functions as a datagram and remote mailslot receiver (second-class datagram-based
mailslot messages). Datagrams of interest to browser services include NetServerEnum. In Windows NT 3.1, the kernel mode
functions resided in Browser.sys, but for Windows NT 3.5x and Windows NT 4.0 these functions are incorporated into Rdr.sys.
All browser datagrams destined for computers running LAN Manager, Windows for Workgroups–, Windows 95–, Windows NT
Workstation–, or Windows NT Server–based computers are sent to the mailslot name \Mailslot\Lanman. Browser datagrams
destined only for computers running Windows NT Workstation or Windows NT Server are sent to the mailslot name
\Mailslot\Msbrowse. Both Browser.sys and Rdr.sys are located in \<Winnt root>\System32\Drivers.
Top Of Page
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 17 of 31
Default: Auto
If this value is Yes, this server becomes a browser. It attempts to contact the master browser to get a current browse
list. If it cannot find the master browser, it forces an election and is, of course, a candidate to become the master. In
addition, setting MaintainServerList to Yes causes an election to be generated when the browser starts
If the value is Auto, this server becomes a browser if the master browser for the domain considers it appropriate for the
server to be a browser.
IsDomainMaster – REG_SZ
Default: False
This parameter gives the server an advantage during the election of a master browser in the domain. The PDC has this
value set to True. For WAN environments, this specifies a workstation within a workgroup, which, as a potential browser,
should be included in the global Lmhosts file. This helps with WAN browsing. It has two values:
Setting this parameter to True forces the elevation of a workstation's priority for the browser.
UnboundBindings – REG_MULTI_SZ
If you have more than two network adapters in the multihomed Windows NT–based server, enter each driver instance
that you wish to disable on a separate line in the String field.
BackupBrowserRecoveryTime - REG_DWORD
When a backup browser fails in three attempts to contact the master browser, the backup browser shuts down for this
length of time.
CacheHitLimit – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 1
A browser maintains a cache of responses to NetServerEnum requests, and this parameter helps to control that cache.
To guarantee that it is worth keeping a response to a client in the cache, the browser waits until it sees CacheHitLimit
browse requests of a given type before it adds the request to the cache. Every 15 minutes (or QueryDriverFrequency on
a master browser), the browser ages the cache. Any entries in the cache that have had less than CacheHitLimit hits since
the previous flush are discarded.
CacheResponseSize – REG_DWORD
Range: 10 to 0xFFFFFFFF
Default: 10
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 18 of 31
This specifies the maximum number of cached browse responses for each transport that the browser keeps.
QueryDriverFrequency – REG_DWORD
Default: 30
This parameter is only valid on the master browser TCP/IP. When the browser is a master browser, it queries the
browser driver every QueryDriverFrequency seconds. This parameter is also used to control how often the response
cache is flushed on a master browser. Decreasing this value increases the accuracy of browse responses; however, it
increases the CPU load on the server. Increasing this value decrease the load on the server, but also decrease the
accuracy of the browse responses.
HLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation
\ParametersOtherDomains – REG_SZ
Default: <none>
Each workstation can be configured with up to four OtherDomains. The Domains are LAN Manager–only domains that the
workstation is interested in browsing. If any OtherDomains are configured on a domain master browser, the
OtherDomains are provided to all members of the domain
HLM\SYSTEM\CurrentControlSet\Services\LanmanServer
Range: 0 or 1
Default: 0
This determines whether the server's computer name and comment can be viewed by other computers in the domain. If
the value is configured to 0, the server's name and comment can be viewed by other computers in the domain. If the
value is configured to 1, the server's name and comment cannot be viewed by other computers in the domain.
LMAnnounce – REG_DWORD
Range: 0 or 1
Default: 0
This option causes the browser to announce itself with a LAN Manager 2.x–compatible server announcement. By default,
this option is configured not to send announcements to LAN Manager 2.x servers. Setting this parameter to 1, True,
causes the server to announce itself to LAN Manager workstations. Set this parameter to 0, False, to not generate any
LAN Manager broadcasts.
SizReqBuf - REG_DWORD
Default: 4096
This specifies the size of request buffers that the server uses. Small buffers use less memory; large buffers may improve
performance. The exact value that works best in a specific environment depends on the configuration of that
environment, but 14596 is a value that has been shown to work well in a fairly standard Ethernet environment. For more
information, see the following Knowledge Base article:
177266: Remote Directory Lists Are Slower Than Local Directory Listings
HLM\System\CurrentControlSet\Services\RDR\Parameters
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 19 of 31
HLM\System\CurrentControlSet\Services\DGRcvr\Parameters
BrowserServerDeletionThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This parameter is only valid on master browsers. If the browser driver ages out more than
BrowserServerDeletionThreshold servers in a single 30-second interval, the browser generates an event indicating a
possible network problem. Its value is the number of servers. The default for this parameter is 0xffffffff, indicating that
the event should never be generated.
BrowserDomainDeletionThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This is only valid on master browsers. It controls the number of domains permitted for the browser driver to age out in a
30-second interval, before generating an event indicating a possible network problem. Its value is the number of
domains. The default for this parameter is 0xffffffff, indicating that the event should never be generated.
FindMasterTimeout – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This specifies the time out for FindMaster requests in seconds. On a slow network, it may be necessary to increase this
value.
BrowserMinimumConfiguredBrowsers – REG_DWORD
Default: 1
This parameter indicates the number of configured browsers that are considered the minimum before the browser
promotes other browsers to be backup browsers.
GetBrowserListThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This represents the threshold that the browser uses before logging an error indicating that too many of these requests
have been missed. If more requests than the value of GetBrowserServerList are missed in an hour, the browser logs an
event indicating that this has happened.
MailslotDatagramThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This represents the threshold that the browser uses before logging an error indicating that too many of these requests
have been missed. If more mailslots than the value of MailslotDatagramThreshold are missed in an hour, the browser
logs an event indicating that this has happened.
Top Of Page
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 20 of 31
Severity: Error
SymbolicName: EVENT_BOWSER_OTHER_MASTER_ON_NET
The master browser has received a server announcement from the computer %2 that believes that it is the master
browser for the domain on transport %3. The master browser is stopping, or an election is being forced.
Severity: Warning
SymbolicName: EVENT_BOWSER_PROMOTED_WHILE_ALREADY_MASTER
A request has been submitted to promote the computer to backup when it is already a master browser.
Severity: Warning
SymbolicName: EVENT_BOWSER_NON_MASTER_MASTER_ANNOUNCE
The browser has received a server announcement indicating that the computer %2 is a master browser, but this
computer is not a master browser.
Severity: Warning
SymbolicName: EVENT_BOWSER_ILLEGAL_DATAGRAM
The browser has received an illegal datagram from the remote computer %2 to name %3 on transport %4. The data is
the datagram.
Severity: Error
SymbolicName: EVENT_BROWSER_STATUS_BITS_UPDATE_FAILED
The browser was unable to update the service status bits. The data is the error.
Severity: Error
SymbolicName: EVENT_BROWSER_ROLE_CHANGE_FAILED
The browser was unable to update its role. The data is the error.
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED
The browser was unable to promote itself to master browser. The computer that currently believes it is the master
browser is %1.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 21 of 31
Severity: Error
SymbolicName: EVENT_BOWSER_NAME_CONVERSION_FAILED
The browser driver was unable to convert a character string to a Unicode string.
Severity: Error
SymbolicName: EVENT_BROWSER_OTHERDOMAIN_ADD_FAILED
Severity: Success
SymbolicName: EVENT_BOWSER_ELECTION_RECEIVED
The browser driver has received an election packet from computer %2 on network %3. The data is the packet received.
Severity: Informational
SymbolicName: EVENT_BOWSER_ELECTION_SENT_GETBLIST_FAILED
The browser driver has forced an election on network %2 because it was unable to find a master browser to retrieve a
backup list on that network.
Severity: Informational
SymbolicName: EVENT_BOWSER_ELECTION_SENT_FIND_MASTER_FAILED
The browser driver has forced an election on network %2 because it was unable to find a master browser for that
network.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STARTED
The browser has forced an election on network %1 because a Windows NT Server (or domain master) browser is started.
Severity: Error
SymbolicName: EVENT_BOWSER_ILLEGAL_DATAGRAM_THRESHOLD
The browser driver has received too many illegal datagrams from the remote computer %2 to name %3 on transport %
4. The data is the datagram. No more events will be generated until the reset frequency has expired.
Severity: Error
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 22 of 31
SymbolicName: EVENT_BROWSER_DEPENDANT_SERVICE_FAILED
The browser has failed to start because the dependent service %1 had invalid service status %2.
Status Meaning
1 Service Stopped%n
2 Start Pending%n
3 Stop Pending%n
4 Running%n
5 Continue Pending%n
6 Pause Pending%n
7 Paused%n
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED_STOPPING
The browser was unable to promote itself to master browser. The browser will continue to attempt to promote itself to
the master browser but will no longer log any events in the event log in Event Viewer.
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED_NO_MASTER
The browser was unable to promote itself to master browser. The computer that currently believes it is the master
browser is unknown.
Severity: Warning
SymbolicName: EVENT_BROWSER_SERVER_LIST_FAILED
The browser was unable to retrieve a list of servers from the browser master %1 on the network %2. The data is the
error code.
Severity: Warning
SymbolicName: EVENT_BROWSER_DOMAIN_LIST_FAILED
The browser was unable to retrieve a list of domains from the browser master %1 on the network %2. The data is the
error code.
Severity: Warning
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 23 of 31
SymbolicName: EVENT_BROWSER_ILLEGAL_CONFIG
The value for the parameter %1 to the browser service was illegal.
Severity: Informational
SymbolicName: EVENT_BOWSER_OLD_BACKUP_FOUND
The backup browser server %2 is out of date. Consider upgrading this computer.
Severity: Success
SymbolicName: EVENT_BROWSER_SERVER_LIST_RETRIEVED
The browser has retrieved a list of servers from remote computer %1 on transport %2.%n There were %3 entries read
and %4 total entries.
Severity: Success
SymbolicName: EVENT_BROWSER_DOMAIN_LIST_RETRIEVED
The browser has retrieved a list of domains from remote computer %1 on transport %2.%n There were %3 entries read
and %4 total entries.
Severity: Informational
SymbolicName: EVENT_BOWSER_PDC_LOST_ELECTION
The browser running on the domain controller has lost an election. The computer that won the election is %2 on the
transport %3.%n The data contains the election version, election criteria, remote computer time up, and the same
information for the current computer.
Severity: Informational
SymbolicName: EVENT_BOWSER_NON_PDC_WON_ELECTION
The browser running on this computer has won a browser election on network %2. This computer is a member of a
domain, so the domain controller should become the master browser.
SymbolicName: EVENT_BOWSER_CANT_READ_REGISTRY
The browser driver was unable to initialize variables from the registry.
SymbolicName: EVENT_BOWSER_MAILSLOT_DATAGRAM_THRESHOLD_EXCEEDED
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 24 of 31
SymbolicName: EVENT_BOWSER_GETBROWSERLIST_THRESHOLD_EXCEEDED
Severity: Error
SymbolicName: EVENT_BROWSER_BACKUP_STOPPED
The browser service has failed to retrieve the backup list too many times on transport %1. The backup browser is
stopping.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STOPPED
The browser has forced an election on network %1 because a master browser was stopped.
Severity: Error
SymbolicName: EVENT_BROWSER_GETBLIST_RECEIVED_NOT_MASTER
The browser has received a GetBrowserServerList request when it is not the master browser.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_ROLE_CHANGED
The browser has forced an election on network %1 because the Domain controller (or server) has changed its role
Severity: Error
SymbolicName: EVENT_BROWSER_NOT_STARTED_IPX_CONFIG_MISMATCH
The browser has failed to start because of an error in the DirectHostBinding parameter to the browser.
Top Of Page
MAC Layer
Most browser frames are sent as broadcast or multicast at the MAC layer. The advantage of using broadcast is that everyone
receives the frame. Additionally, the overhead of a sessions is not needed. However, broadcast traffic must be processed by
all systems, including ones not interested in browsing. One potential ramification of using broadcast datagrams is that
browsing is limited to a broadcast collision zone. This side effect occurs because most routers and switches are configured to
not forward NetBIOS broadcast traffic.
Network Layer
All browser frames are sent to the broadcast network address. For example, if a station has an IP address of 130.20.1.1 and a
subnet mask of 255.255.0.0, all browser frames are addressed to 130.20.255.255. Obviously this does not apply for transport
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 25 of 31
NetBIOS Layer
Most Microsoft protocols contain a NetBIOS protocol layer. Examples include NBFP in NetBEUI or NetBT in the TCP/IP stack.
The browser uses an elaborate NetBIOS naming scheme to direct traffic. The names are controlled by adding a special code in
the sixteenth character of the domain name. Even though a frame is broadcast at the MAC and network layer, only stations
that have the special NetBIOS name registered accept the frames. The following is an example of an Windows NT 3.1 NBT
[NetBIOS over TCP\IP] browser frame. Notice the destination NetBIOS name.
SMB Layer
All Browser frames ride on top of SMB Transact frames. Because the frame contains an SMB, it must also contain a NetBIOS
layer, which contains one of the NetBIOS names discussed previously. The SMB Transact carries the command "Mailslot
Write." Since the browser service is a mailslot receiver, the browser accepts mailslots addressed to \Mailslot\Browse. The
mailslot data following the mailslot address is the Browser frame. The first byte is the browser command code. The following is
an example of the SMB layer of a browser frame:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 26 of 31
The following are Windows NT browser frames and their command codes:
The Server Type field appears in many of the browser frames. This field contains flag bits that indicate the current status of
the server.
The Announce Packet is used to announce servers in the domain. When a Windows NT (or Windows For Workgroups) server
announces itself, it sends a directed Announce to the unique master name for that workgroup <DOMAIN><1d>. When a
Windows NT (or Windows for Workgroups) master browser announces itself, it sends a broadcast to the group election name
<DOMAIN><1e>.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 27 of 31
1. It indicates to backup browsers that the master has changed. Backup browsers notice this packet and update their
saved version of the master browser name.
2. The master browser places its information in its local browse list.
If a master browser receives an announcement packet from another computer that believes that it is the master
browser, the master shuts down, discards its local browser list, and forces an election. This allows the correct master to
be determined.
UpdateCount: The UpdateCount field is used to indicate that information has been updated in the servers'
announcement list. If contents of the master browser's server or domain list has modified, it increments
UpdateCount and announces. This allows backup browsers to pick up these updates.
Periodicity: Below this is referred to as the Update Interval, and it is converted to minutes. The announcement
frequency of the server. The server is removed from the browse list if it has not been heard from in three times
its announcement frequency.
Example:
This frame is basically the same as the Host Annoucement frame. It is used by the master browser to announce itself. These
frames are usually sent to the special NetBIOS name <DOMAIN><1e>, which is used by all browsers.
Example:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 28 of 31
This frame is sent by the master browser to announce the existence of the domain. Other master browsers in different
domains store these announcements along with the server's name. This is one way that they build their domain list. These
frames are sent to the special NetBIOS name <01><02>__MSBROWSE__<02><01>.
Name: For this frame, Name is set to the Domain name, not the server name.
Server Name: The master browser that is announcing the domain. This name is stored by master browsers in other
domains. This is used to double hop.
Example:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 29 of 31
This frame causes all local browsers to announce themselves. This frame is sent at browser client startup to find the master
browser for the domain. The frame is usually broadcast to the special NetBIOS name <DOMAIN><1d>, which is only
registered by a master browser. Sometimes it is sent directly to the master browser.
Example:
Election Frame
This frame is sent when a master browser election is required. This usually occurs when the master browser goes down or
when the network is starting up.
Criteria: Specifies the election criteria of the client. This contains two subfields.
Operating System: Specifies the operating system type and version which is one of the election criteria.
Election Desire: Contains items that help determine the election criteria. Some items deal with current browser state,
such as Current Backup Browser.
TimeUp: The amount of time that the server has been up, which is one of the election criteria.
Example:
This frame is used by the master browser to tell a potential browser to become a backup. To see how the master browser
determines this refer to the backup ration chart in the Master Browser section. Even though this message is only intended for
one particular system, the master browser still broadcasts this frame.
Example:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 30 of 31
This frame is broadcast to get a list of backup browsers from a particular domain. The domain is specified by the special
NetBIOS name in the NetBIOS frame section. It is sent with the name <DOMAIN><1d>. The workstation stores a maximum
of three of the names returned. The GetBackupListRequest is also unicast to the domain master browser, which handles the
case in which the queried domain has no members on the subnet. From this list it picks one at random to which to send
NetServerEnum2.
Fields:
Requested Count: Indicates the maximum number for browser server names to return. It may return fewer.
Token: Used by the sender to correlate a request with a response. The client might send multiple requests on multiple
transports for different domain names.
Example:
Example:
This frame is sent by the master browser on a subnet to the PDC (DomainMaster). It announces the presence of the master
on the domain to allow the PDC to retrieve the local subnets domain list. This is one of the few browser frames that is sent
directly to the master browser; it is a directed datagram.
Example:
This frame is a diagnostic packet that can be used to force a master browser to stop functioning as a master browser.
Options:
RESET_STATE_STOP_MASTER (0x01)
This indicates that the master browser should stop functioning as a master. This means that it should remove the master
name and the domain announcement name and fall back as a backup browser.
RESET_STATE_CLEAR_ALL (0x02)
This indicates that a browser should clear its browser state. This means that the browser should discard its server list
and effectively restart.
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009
MS Windows NT Browser Page 31 of 31
RESET_STATE_STOP (0x04)
This indicates that the browser should stop functioning at all. For security reasons, the NT browser does not support this
packet.
Example:
http://technet.microsoft.com/en-us/library/cc767893(printer).aspx 14-04-2009