If you have more than two network adapters in the multihomed Windows NT–based server, enter each driver instance that you wish to disable on a separate line in the String field.
When a backup browser fails in three attempts to contact the master browser, the backup browser shuts down for this length of time.
This specifies the maximum number of cached browse responses for each transport that the browser keeps.
This parameter is only valid on the master browser TCP/IP. When the browser is a master browser, it queries the browser driver every QueryDriverFrequency seconds. This parameter is also used to control how often the response cache is flushed on a master browser. Decreasing this value increases the accuracy of browse responses; however, it increases the CPU load on the server. Increasing this value decrease the load on the server, but also decrease the accuracy of the browse responses.
Each workstation can be configured with up to four OtherDomains. The Domains are LAN Manager–only domains that the workstation is interested in browsing. If any OtherDomains are configured on a domain master browser, the OtherDomains are provided to all members of the domain
HLM\SYSTEM\CurrentControlSet\Services\LanmanServer
\Parameters Hidden – REG_BINARY
Range: 0 or 1
Default: 0
This determines whether the server's computer name and comment can be viewed by other computers in the domain. If the value is configured to 0, the server's name and comment can be viewed by other computers in the domain. If the value is configured to 1, the server's name and comment cannot be viewed by other computers in the domain.
Range: 0 or 1
Default: 0
This option causes the browser to announce itself with a LAN Manager 2.x–compatible server announcement. By default, this option is configured not to send announcements to LAN Manager 2.x servers. Setting this parameter to 1, True, causes the server to announce itself to LAN Manager workstations. Set this parameter to 0, False, to not generate any LAN Manager broadcasts.
Range: 512 - 65536 bytes
Default: 4096
This specifies the size of request buffers that the server uses. Small buffers use less memory; large buffers may improve performance. The exact value that works best in a specific environment depends on the configuration of that environment, but 14596 is a value that has been shown to work well in a fairly standard Ethernet environment. For more information, see the following Knowledge Base article:
Q177266: Remote Directory Lists Are Slower Than Local Directory Listings
HLM\System\CurrentControlSet\Services\RDR\Parameters
Windows NT 3.1 Advanced Server uses the following key:
HLM\System\CurrentControlSet\Services\DGRcvr\Parameters
BrowserServerDeletionThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This parameter is only valid on master browsers. If the browser driver ages out more than BrowserServerDeletionThreshold servers in a single 30-second interval, the browser generates an event indicating a possible network problem. Its value is the number of servers. The default for this parameter is 0xffffffff, indicating that the event should never be generated.
BrowserDomainDeletionThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This is only valid on master browsers. It controls the number of domains permitted for the browser driver to age out in a 30-second interval, before generating an event indicating a possible network problem. Its value is the number of domains. The default for this parameter is 0xffffffff, indicating that the event should never be generated.
FindMasterTimeout – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This specifies the time out for FindMaster requests in seconds. On a slow network, it may be necessary to increase this value.
BrowserMinimumConfiguredBrowsers – REG_DWORD
Default: 1
This parameter indicates the number of configured browsers that are considered the minimum before the browser promotes other browsers to be backup browsers.
GetBrowserListThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This represents the threshold that the browser uses before logging an error indicating that too many of these requests have been missed. If more requests than the value of GetBrowserServerList are missed in an hour, the browser logs an event indicating that this has happened.
MailslotDatagramThreshold – REG_DWORD
Range: 0 to 0xFFFFFFFF
Default: 0xFFFFFFFF
This represents the threshold that the browser uses before logging an error indicating that too many of these requests have been missed. If more mailslots than the value of MailslotDatagramThreshold are missed in an hour, the browser logs an event indicating that this has happened.
Appendix F:
windows NT Browser Error Codes
Severity: Error
SymbolicName: EVENT_BOWSER_OTHER_MASTER_ON_NET
The master browser has received a server announcement from the computer %2 that believes that it is the master browser for the domain on transport %3. The master browser is stopping, or an election is being forced.
Severity: Warning
SymbolicName: EVENT_BOWSER_PROMOTED_WHILE_ALREADY_MASTER
A request has been submitted to promote the computer to backup when it is already a master browser.
Severity: Warning
SymbolicName: EVENT_BOWSER_NON_MASTER_MASTER_ANNOUNCE
The browser has received a server announcement indicating that the computer %2 is a master browser, but this computer is not a master browser.
Severity: Warning
SymbolicName: EVENT_BOWSER_ILLEGAL_DATAGRAM
The browser has received an illegal datagram from the remote computer %2 to name %3 on transport %4. The data is the datagram.
Severity: Error
SymbolicName: EVENT_BROWSER_STATUS_BITS_UPDATE_FAILED
The browser was unable to update the service status bits. The data is the error.
Severity: Error
SymbolicName: EVENT_BROWSER_ROLE_CHANGE_FAILED
The browser was unable to update its role. The data is the error.
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED
The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is %1.
Severity: Error
SymbolicName: EVENT_BOWSER_NAME_CONVERSION_FAILED
The browser driver was unable to convert a character string to a Unicode string.
Severity: Error
SymbolicName: EVENT_BROWSER_OTHERDOMAIN_ADD_FAILED
The browser was unable to add the configuration parameter %1.
Severity: Success
SymbolicName: EVENT_BOWSER_ELECTION_RECEIVED
The browser driver has received an election packet from computer %2 on network %3. The data is the packet received.
Severity: Informational
SymbolicName: EVENT_BOWSER_ELECTION_SENT_GETBLIST_FAILED
The browser driver has forced an election on network %2 because it was unable to find a master browser to retrieve a backup list on that network.
Severity: Informational
SymbolicName: EVENT_BOWSER_ELECTION_SENT_FIND_MASTER_FAILED
The browser driver has forced an election on network %2 because it was unable to find a master browser for that network.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STARTED
The browser has forced an election on network %1 because a Windows NT Server (or domain master) browser is started.
Severity: Error
SymbolicName: EVENT_BOWSER_ILLEGAL_DATAGRAM_THRESHOLD
The browser driver has received too many illegal datagrams from the remote computer %2 to name %3 on transport %4. The data is the datagram. No more events will be generated until the reset frequency has expired.
Severity: Error
SymbolicName: EVENT_BROWSER_DEPENDANT_SERVICE_FAILED
The browser has failed to start because the dependent service %1 had invalid service status %2.
-
Status
|
Meaning
|
1
|
Service Stopped%n
|
2
|
Start Pending%n
|
3
|
Stop Pending%n
|
4
|
Running%n
|
5
|
Continue Pending%n
|
6
|
Pause Pending%n
|
7
|
Paused%n
|
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED_STOPPING
The browser was unable to promote itself to master browser. The browser will continue to attempt to promote itself to the master browser but will no longer log any events in the event log in Event Viewer.
Severity: Error
SymbolicName: EVENT_BROWSER_MASTER_PROMOTION_FAILED_NO_MASTER
The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is unknown.
Severity: Warning
SymbolicName: EVENT_BROWSER_SERVER_LIST_FAILED
The browser was unable to retrieve a list of servers from the browser master %1 on the network %2. The data is the error code.
Severity: Warning
SymbolicName: EVENT_BROWSER_DOMAIN_LIST_FAILED
The browser was unable to retrieve a list of domains from the browser master %1 on the network %2. The data is the error code.
Severity: Warning
SymbolicName: EVENT_BROWSER_ILLEGAL_CONFIG
The value for the parameter %1 to the browser service was illegal.
Severity: Informational
SymbolicName: EVENT_BOWSER_OLD_BACKUP_FOUND
The backup browser server %2 is out of date. Consider upgrading this computer.
Severity: Success
SymbolicName: EVENT_BROWSER_SERVER_LIST_RETRIEVED
The browser has retrieved a list of servers from remote computer %1 on transport %2.%n There were %3 entries read and %4 total entries.
Severity: Success
SymbolicName: EVENT_BROWSER_DOMAIN_LIST_RETRIEVED
The browser has retrieved a list of domains from remote computer %1 on transport %2.%n There were %3 entries read and %4 total entries.
Severity: Informational
SymbolicName: EVENT_BOWSER_PDC_LOST_ELECTION
The browser running on the domain controller has lost an election. The computer that won the election is %2 on the transport %3.%n The data contains the election version, election criteria, remote computer time up, and the same information for the current computer.
Severity: Informational
SymbolicName: EVENT_BOWSER_NON_PDC_WON_ELECTION
The browser running on this computer has won a browser election on network %2. This computer is a member of a domain, so the domain controller should become the master browser.
SymbolicName: EVENT_BOWSER_CANT_READ_REGISTRY
The browser driver was unable to initialize variables from the registry.
SymbolicName: EVENT_BOWSER_MAILSLOT_DATAGRAM_THRESHOLD_EXCEEDED
The browser driver has discarded too many mailslot messages.
SymbolicName: EVENT_BOWSER_GETBROWSERLIST_THRESHOLD_EXCEEDED
The browser driver has discarded too many GetBrowserServerList requests.
Severity: Error
SymbolicName: EVENT_BROWSER_BACKUP_STOPPED
The browser service has failed to retrieve the backup list too many times on transport %1. The backup browser is stopping.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_LANMAN_NT_STOPPED
The browser has forced an election on network %1 because a master browser was stopped.
Severity: Error
SymbolicName: EVENT_BROWSER_GETBLIST_RECEIVED_NOT_MASTER
The browser has received a GetBrowserServerList request when it is not the master browser.
Severity: Informational
SymbolicName: EVENT_BROWSER_ELECTION_SENT_ROLE_CHANGED
The browser has forced an election on network %1 because the Domain controller (or server) has changed its role
Severity: Error
SymbolicName: EVENT_BROWSER_NOT_STARTED_IPX_CONFIG_MISMATCH
The browser has failed to start because of an error in the DirectHostBinding parameter to the browser.
Appendix G:
Network Layers Involved in Browsing
MAC Layer
Most browser frames are sent as broadcast or multicast at the MAC layer. The advantage of using broadcast is that everyone receives the frame. Additionally, the overhead of a sessions is not needed. However, broadcast traffic must be processed by all systems, including ones not interested in browsing. One potential ramification of using broadcast datagrams is that browsing is limited to a broadcast collision zone. This side effect occurs because most routers and switches are configured to not forward NetBIOS broadcast traffic.
Network Layer
All browser frames are sent to the broadcast network address. For example, if a station has an IP address of 130.20.1.1 and a subnet mask of 255.255.0.0, all browser frames are addressed to 130.20.255.255. Obviously this does not apply for transport protocols that lack a network layer, such as NetBEUI.
NetBIOS Layer
Most Microsoft protocols contain a NetBIOS protocol layer. Examples include NBFP in NetBEUI or NetBT in the TCP/IP stack. The browser uses an elaborate NetBIOS naming scheme to direct traffic. The names are controlled by adding a special code in the sixteenth character of the domain name. Even though a frame is broadcast at the MAC and network layer, only stations that have the special NetBIOS name registered accept the frames. The following is an example of an Windows NT 3.1 NBT [NetBIOS over TCP\IP] browser frame. Notice the destination NetBIOS name.
NBT: DS: Type = 17 (DIRECT GROUP)
NBT: Datagram Packet Type = DIRECT GROUP
NBT: Datagram Flags = 2 (0x2)
NBT: 0000.... = Reserved
NBT: ....00.. = B Node
NBT: ......1. = Not First Packet
NBT: .......0 = More Fragments Follow
NBT: Datagram ID = 164 (0xA4)
NBT: Source IP Address = 130.22.1.99
NBT: Source Port = 138 (0x8A)
NBT: Datagram Length = 189 (0xBD)
NBT: Packet Offset = 0 (0x0)
NBT: Source Name = BATCOMPUTER3<00>
NBT: Destination Name = DOMA<1D>
NBT: DS Data: Number of data bytes remaining = 119 (0x0077)
SMB Layer
All Browser frames ride on top of SMB Transact frames. Because the frame contains an SMB, it must also contain a NetBIOS layer, which contains one of the NetBIOS names discussed previously. The SMB Transact carries the command “Mailslot Write.” Since the browser service is a mailslot receiver, the browser accepts mailslots addressed to \Mailslot\Browse. The mailslot data following the mailslot address is the Browser frame. The first byte is the browser command code. The following is an example of the SMB layer of a browser frame:
SMB: C transact, File = \MAILSLOT\BROWSE
SMB: SMB Status = Error Success
SMB: Error class = No Error
SMB: Error code = No Error
SMB: Header: PID = 0x0000 TID = 0x0000 MID = 0x0000 UID = 0x0000
SMB: Tree ID (TID) = 0 (0x0)
SMB: Process ID (PID) = 0 (0x0)
SMB: User ID (UID) = 0 (0x0)
SMB: Multiplex ID (MID) = 0 (0x0)
SMB: Flags Summary = 0 (0x0)
SMB: .......0 = Lock & Read and Write & Unlock not supported
SMB: ......0. = Send No Ack not supported
SMB: ....0... = Using case sensitive pathnames
SMB: ...0.... = No canonicalized pathnames
SMB: ..0..... = No Opportunistic lock
SMB: .0...... = No Change Notify
SMB: 0....... = Client command
SMB: flags2 Summary = 0 (0x0)
SMB: ...............0 = Understands only DOS 8.3 filenames
SMB: ..............0. = Does not understand extended
Attributes
SMB: ..0............. = No paging of IO
SMB: .0.............. = Using SMB status codes
SMB: 0............... = Using ASCII strings
SMB: Command = C transact
SMB: Word count = 17
SMB: Word parameters
SMB: Total parm bytes = 0
SMB: Total data bytes = 33
SMB: Max parm bytes = 0
SMB: Max data bytes = 0
SMB: Max setup words = 0
SMB: Transact Flags Summary = 0 (0x0)
SMB: ...............0 = Leave session intact
SMB: ..............0. = Response required
SMB: Transact timeout = 0 (0x0)
SMB: Parameter bytes = 0 (0x0)
SMB: Parameter offset = 0 (0x0)
SMB: Data bytes = 33 (0x21)
SMB: Data offset = 86 (0x56)
SMB: Setup word count = 3
SMB: Setup words
SMB: Mailslot opcode = Write mailslot
SMB: Transaction priority = 1
SMB: Mailslot class = Unreliable (broadcast)
SMB: Byte count = 50
SMB: Byte parameters
SMB: Path name = \MAILSLOT\BROWSE
SMB: Transaction data
SMB: Data: Number of data bytes remaining = 33 (0x0021)
Appendix H:
Windows NT Browser Protocol Frames
The Browser service consists of 10 special peer protocol frames. In addition, the Browser relies heavily on two LAN Manager APIs and RPC in Windows NT. The Browser uses these frames in conjunction with standard NetBIOS frames to operate.
The following are Windows NT browser frames and their command codes:
#define HostAnnouncement 1 0x01
#define AnnouncementRequest 2 0x02
#define Election 8 0x08
#define GetBackupListReq 9 0x09
#define GetBackupListResp 10 0x0a
#define BecomeBackup 11 0x0b
#define WkGroupAnnouncement 12 0x0c
#define MasterAnnouncement 13 0x0d
#define ResetBrowserState 14 0x0e
#define LocalMasterAnnouncement 15 0x0f
Server Type Field
The Server Type field appears in many of the browser frames. This field contains flag bits that indicate the current status of the server.
The following is an enumeration of Server Types:
SV_TYPE_WORKSTATION 0x00000001 All LAN Manager workstation
SV_TYPE_SERVER 0x00000002 All LAN Manager server
SV_TYPE_SQLSERVER 0x00000004 Any server running with SQL
server
SV_TYPE_DOMAIN_CTRL 0x00000008 Primary domain controller
SV_TYPE_DOMAIN_BAKCTRL 0x00000010 Backup domain controller
SV_TYPE_TIMESOURCE 0x00000020 Server running the
Timesource Service
SV_TYPE_AFP 0x00000040 Apple File Protocol servers
SV_TYPE_NOVELL 0x00000080 Novell servers
SV_TYPE_DOMAIN_MEMBER 0x00000100 Domain Member
SV_TYPE_PRINT 0x00000200 Server sharing print queue
SV_TYPE_DIALIN 0x00000400 Server running RAS service
SV_TYPE_XENIX_SERVER 0x00000800 Xenix server
SV_TYPE_NT 0x00001000 NT server
SV_TYPE_WFW 0x00002000 Server running Windows for
Workgroups
SV_TYPE_SERVER_NT 0x00008000 Windows NT Non-DC server
SV_TYPE_POTENTIAL_BROWSER 0x00010000 Server that can run the
browser service
SV_TYPE_BACKUP_BROWSER 0x00020000 Server running a browser
service as backup
SV_TYPE_MASTER_BROWSER 0x00040000 Server running the master
browser service
SV_TYPE_DOMAIN_MASTER 0x00080000 Server running the domain
master browser
SV_TYPE_TERMINALSERVER 0X02000000 Server running Windows NT
Terminal Services
SV_TYPE_APPSERVER 0x10000000 Server running Citrix
Winframe
SV_TYPE_ALTERNATE_XPORT 0X20000000 Return List for Alternate
Transport
SV_TYPE_LOCAL_LIST_ONLY 0x40000000 Return local list only
SV_TYPE_DOMAIN_ENUM 0x80000000 Return domain members
SV_TYPE_ALL 0xffffffff All servers
Host Announcement Frame
The Announce Packet is used to announce servers in the domain. When a Windows NT (or Windows For Workgroups) server announces itself, it sends a directed Announce to the unique master name for that workgroup <1d>. When a Windows NT (or Windows for Workgroups) master browser announces itself, it sends a broadcast to the group election name <1e>.
This announcement packet serves the following purposes:
It indicates to backup browsers that the master has changed. Backup browsers notice this packet and update their saved version of the master browser name.
The master browser places its information in its local browse list.
If a master browser receives an announcement packet from another computer that believes that it is the master browser, the master shuts down, discards its local browser list, and forces an election. This allows the correct master to be determined.
UpdateCount: The UpdateCount field is used to indicate that information has been updated in the servers' announcement list. If contents of the master browser’s server or domain list has modified, it increments UpdateCount and announces. This allows backup browsers to pick up these updates.
Periodicity: Below this is referred to as the Update Interval, and it is converted to minutes. The announcement frequency of the server. The server is removed from the browse list if it has not been heard from in three times its announcement frequency.
ServerName: Null-terminated OEM ASCII server name.
VersionMajor: The major version of the server.
VersionMinor: The minor version of the server.
Server Type: See above.
Example:
BROWSER: Host Announcement [0x01]
BROWSER: Command = Host Announcement [0x01]
BROWSER: Update Count = 7 (0x7)
BROWSER: Annoucement Interval [minutes] = 5
BROWSER: Name = BATCOMPUTER3
BROWSER: Major Version = 1 (0x1)
BROWSER: Minor Version = 51 (0x33)
BROWSER: Server Type Summary = 204803 (0x32003)
BROWSER: ...............................1 = Workstation
BROWSER: ..............................1. = Server
BROWSER: .............................0.. = Not SQL Server
BROWSER: ............................0... = Not Domain Controller
BROWSER: ...........................0.... = Not Backup Controller
BROWSER: ..........................0..... = Not Time Source
BROWSER: .........................0...... = Not Apple Server
BROWSER: ........................0....... = Not Novell
BROWSER: .......................0........ = Not Domain Member
Server
BROWSER: ......................0......... = Not Print Queue
Server
BROWSER: .....................0.......... = Not Dialin Server
BROWSER: ....................0........... = Not Xenix Server
BROWSER: ...................0............ = Not NT System
BROWSER: ..................1............. = Windows for
Workgroups
BROWSER: ...............1................ = Potential Browser
Server
BROWSER: ..............1................. = Backup Browser Server
BROWSER: .............0.................. = Not Master Browser
BROWSER: ............0................... = Not Domain Master
Browser
BROWSER: ...........0.................... = Not OSF
BROWSER: ..........0..................... = Not VMS
BROWSER: .0.............................. = Not Local List Only
BROWSER: 0............................... = Not Domain Enum
BROWSER: Browser Election Version = 779 (0x30B)
BROWSER: Browser Constant = 43605 (0xAA55)
Local Master Announcement Frame
This frame is basically the same as the Host Annoucement frame. It is used by the master browser to announce itself. These frames are usually sent to the special NetBIOS name <1e>, which is used by all browsers.
Example:
BROWSER: Local Master Announcement [0x0f]
BROWSER: Command = Local Master Announcement [0x0f]
BROWSER: Update Count = 0 (0x0)
BROWSER: Annoucement Interval [minutes] = 12
BROWSER: Name = COOLBLADE
BROWSER: Major Version = 3 (0x3)
BROWSER: Minor Version = 50 (0x32)
BROWSER: Server Type Summary = 266251 (0x4100B)
BROWSER: ...............................1 = Workstation
BROWSER: ..............................1. = Server
BROWSER: .............................0.. = Not SQL Server
BROWSER: ............................1... = Domain Controller
BROWSER: ...........................0.... = Not Backup Controller
BROWSER: ..........................0..... = Not Time Source
BROWSER: .........................0...... = Not Apple Server
BROWSER: ........................0....... = Not Novell
BROWSER: .......................0........ = Not Domain Member
Server
BROWSER: ......................0......... = Not Print Queue
Server
BROWSER: .....................0.......... = Not Dialin Server
BROWSER: ....................0........... = Not Xenix Server
BROWSER: ...................1............ = Windows NT System
BROWSER: ..................0............. = Not WFW System
BROWSER: ...............0................ = Not Potential Browser
BROWSER: ..............0................. = Not Backup Browser
BROWSER: .............1.................. = Master Browser Server
BROWSER: ............0................... = Not Domain Master
Browser
BROWSER: ...........0.................... = Not OSF
BROWSER: ..........0..................... = Not VMS
BROWSER: .0.............................. = Not Local List Only
BROWSER: 0............................... = Not Domain Enum
BROWSER: Browser Election Version = 271 (0x10F)
BROWSER: Browser Constant = 43605 (0xAA55)
Domain / Work Group Announcement Frame
This frame is sent by the master browser to announce the existence of the domain. Other master browsers in different domains store these announcements along with the server’s name. This is one way that they build their domain list. These frames are sent to the special NetBIOS name <01><02>MSBROWSE<02><01>.
Name: For this frame, Name is set to the Domain name, not the server name.
Comment Pointer: Unused value.
Server Name: The master browser that is announcing the domain. This name is stored by master browsers in other domains. This is used to double hop.
Example:
BROWSER: Workgroup Announcement [0x0c]
BROWSER: Command = Workgroup Announcement [0x0c]
BROWSER: Update Count = 0 (0x0)
BROWSER: Annoucement Interval [minutes] = 15
BROWSER: Name = DOMA
BROWSER: Major Version = 3 (0x3)
BROWSER: Minor Version = 10 (0xA)
BROWSER: Server Type Summary = 2147487744 (0x80001000)
BROWSER: ...............................0 = Not Workstation
BROWSER: ..............................0. = Not Server
BROWSER: .............................0.. = Not SQL Server
BROWSER: ............................0... = Not Domain Controller
BROWSER: ...........................0.... = Not Backup Controller
BROWSER: ..........................0..... = Not Time Source
BROWSER: .........................0...... = Not Apple Server
BROWSER: ........................0....... = Not Novell
BROWSER: .......................0........ = Not Domain Member Server
BROWSER: ......................0......... = Not Print Queue Server
BROWSER: .....................0.......... = Not Dialin Server
BROWSER: ....................0........... = Not Xenix Server
BROWSER: ...................1............ = Windows NT System
BROWSER: ..................0............. = Not WFW System
BROWSER: ...............0................ = Not Potential Browser
BROWSER: ..............0................. = Not Backup Browser
BROWSER: .............0.................. = Not Master Browser
BROWSER: ............0................... = Not Domain Master Browser
BROWSER: ...........0.................... = Not OSF
BROWSER: ..........0..................... = Not VMS
BROWSER: .0.............................. = Not Local List Only
BROWSER: 1............................... = Domain Enum
BROWSER: Comment Pointer = 28311416 (0x1AFFF78)
BROWSER: Server Name = ATT-SERVER
Announcement Request Frame
This frame causes all local browsers to announce themselves. This frame is sent at browser client startup to find the master browser for the domain. The frame is usually broadcast to the special NetBIOS name <1d>, which is only registered by a master browser. Sometimes it is sent directly to the master browser.
Example:
BROWSER: Announcement Request [0x02]
BROWSER: Command = Announcement Request [0x02]
BROWSER: Unused Flags = 0 (0x0)
BROWSER: Reply System Name = A-CLIENT
Election Frame
This frame is sent when a master browser election is required. This usually occurs when the master browser goes down or when the network is starting up.
Version: Specifies the version of this election packet.
Criteria: Specifies the election criteria of the client. This contains two subfields.
Operating System: Specifies the operating system type and version which is one of the election criteria.
Election Revision: Part of the browser software version.
Election Desire: Contains items that help determine the election criteria. Some items deal with current browser state, such as Current Backup Browser.
TimeUp: The amount of time that the server has been up, which is one of the election criteria.
ServerName: Null-terminated ASCII server name.
Example:
BROWSER: Election [0x08]
BROWSER: Command = Election [0x08]
BROWSER: Election Version = 1 (0x1)
BROWSER: Election Criteria = 536940294 (0x20010F06)
BROWSER: Election OS Summary = 32 (0x20)
BROWSER: .......0 = Not WFW
BROWSER: ......0. = Not used
BROWSER: .....0.. = Not used
BROWSER: ....0... = Not used
BROWSER: ...0.... = Not Windows NT Workstation
BROWSER: ..1..... = Advanced Server Windows NT
BROWSER: .0...... = Not used
BROWSER: 0....... = Not used
BROWSER: Election Revision = 271 (0x10F)
BROWSER: Election Desire Summary = 6 (0x6)
BROWSER: .......0 = Not Backup Browse Server
BROWSER: ......1. = Standby Browser Server
BROWSER: .....1.. = Currently Master Browser Server
BROWSER: ....0... = Not Domain Master Browser
BROWSER: ...0.... = Not used
BROWSER: ..0..... = Not WINS Client
BROWSER: .0...... = Not used
BROWSER: 0....... = Not Advanced Server
BROWSER: Server Up Time [DD:hh:mm:ss] 0:0:31:31
BROWSER: Election Server Name = ATT-SERVER
Become Backup Frame
This frame is used by the master browser to tell a potential browser to become a backup. To see how the master browser determines this refer to the backup ration chart in the Master Browser section. Even though this message is only intended for one particular system, the master browser still broadcasts this frame.
Example:
BROWSER: Become Backup [0x0b]
BROWSER: Command = Become Backup [0x0b]
BROWSER: Name = BATCOMPUTER3
Get Backup List Request Frame
This frame is broadcast to get a list of backup browsers from a particular domain. The domain is specified by the special NetBIOS name in the NetBIOS frame section. It is sent with the name <1d>. The workstation stores a maximum of three of the names returned. The GetBackupListRequest is also unicast to the domain master browser, which handles the case in which the queried domain has no members on the subnet. From this list it picks one at random to which to send NetServerEnum2.
Fields:
Requested Count: Indicates the maximum number for browser server names to return. It may return fewer.
Token: Used by the sender to correlate a request with a response. The client might send multiple requests on multiple transports for different domain names.
Example:
BROWSER: Get Backup List Request [0x09]
BROWSER: Command = Get Backup List Request [0x09]
BROWSER: Get Backup List Requested Count = 4 (0x4)
BROWSER: Backup Request Token = 1 (0x1)
Get Backup List Response Frame
This is the response to a Get Backup List Request.
Example:
BROWSER: Get Backup List Response [0x0a]
BROWSER: Command = Get Backup List Response [0x0a]
BROWSER: Backup Server Count = 2 (0x2)
BROWSER: Backup Response Token = 1 (0x1)
BROWSER: Backup Servers = LCSCOTTSU1
BROWSER: Backup Servers = RTHOM1
Master Announcement Frame
This frame is sent by the master browser on a subnet to the PDC (DomainMaster). It announces the presence of the master on the domain to allow the PDC to retrieve the local subnets domain list. This is one of the few browser frames that is sent directly to the master browser; it is a directed datagram.
Example:
BROWSER: Master Announcement [0x0d]
BROWSER: Command = Master Announcement [0x0d]
BROWSER: Master Name = LCSCOTTSU5
Reset Browser State Frame
This frame is a diagnostic packet that can be used to force a master browser to stop functioning as a master browser.
Options:
RESET_STATE_STOP_MASTER (0x01)
This indicates that the master browser should stop functioning as a master. This means that it should remove the master name and the domain announcement name and fall back as a backup browser.
RESET_STATE_CLEAR_ALL (0x02)
This indicates that a browser should clear its browser state. This means that the browser should discard its server list and effectively restart.
This indicates that the browser should stop functioning at all. For security reasons, the NT browser does not support this packet.
Example:
BROWSER: Reset Browser [0x0e]
BROWSER: Command = Reset Browser [0x0e]
BROWSER: Options Summary = 2 (0x2)
BROWSER: .......0 = Zero
BROWSER: ......1. = Reset Entire Browser State
BROWSER: .....0.. = Zero