TechRepublic Tutorial: Decrease Windows browser-related network traffic

Make Windows networks run faster by eliminating unneeded traffic

In a Windows NT environment, if you click on the Network Neighborhood icon, you’ll see a list of all of the computers in the current domain. You might not have given much thought to this seemingly simple function, but being able to look at the other computers in the network is actually a rather complex task from the computer’s standpoint. Furthermore, this seemingly simple task can place an excessive amount of traffic onto your network. In this article, I’ll show you what really goes on when you look at the Network Neighborhood. I’ll then go on to explain the impact that this has on your network resources and how to adjust Windows to make better use of these resources.

Author's Note
All of the techniques that I’m about to show you involve making modifications to the Windows registry. Making incorrect modifications to the registry can destroy Windows and/or your applications. Therefore, I strongly recommend making a full-system backup prior to making any changes to the registry. Also, the techniques that I’m about to show you were designed to be used with Windows NT 4.0, although they will also work on Windows NT 3.51 so long as Service Pack 5 or above is installed. Do not attempt to use these techniques on a Windows 2000 Server. Browsing works quite differently in Windows 2000 than it does in Windows NT.

The Windows NT Browser Service
Contrary to what you might expect, when you open the Network Neighborhood, Windows isn’t compiling a list of computers on the fly, nor is it pulling the list from a WINS server. Instead, the Windows NT Browser Service provides the list of computers displayed in the Network Neighborhood. The Windows NT Browser Service is a service whose only job is to maintain a list of the current network resources.

Most of the time, when you run a service on a Windows NT machine, the service is localized. The service might have dependencies, but those dependencies are typically other services that are also running on the local machine. The browser service does run on the local machine, but it is dependent on browser services running on other machines on your network. There is no difference in the services themselves, but rather in the manner that the services are configured. There is a total of six different roles that the browser service can play, depending on how the service is configured. These roles are:
  • Non-browser: Non-browser servers don’t maintain browse lists, but do announce themselves to master browsers on a periodic basis.
  • Potential browser: A potential browser is essentially a non-browser server that has the potential to become a backup browser server should the need arise.
  • Backup browser: A backup browser contacts a master browser every fifteen minutes to get the latest copy of the browse list for the domain. Once the backup browser has this list, it caches the list and waits for a client to request a copy. All Windows NT domain controllers are automatically configured to be a backup browser. Likewise, every flavor of Windows workstation since Windows for Workgroups can function as a backup browser if there are less than three Windows NT Servers filling the backup browser role.
  • Master browser: The master browser’s job is to actually compile the browse list. The browse list consists of the name of every computer in the domain and every domain on the network. The master browser is able to compile such a list because any time that a server or a workstation comes online, the computer sends a server announcement to the master browser. The server announcement contains the name and operating system version of the machine that just came online. The master browser uses the information provided by the server announcement to add the machine to the browse list.
  • Preferred master browser: A preferred master browser is a master browser that receives preferential treatment. If the master browser is offline for some reason, Windows forces a master browser election. The purpose of an election is to find a new master browser. Preferred master browsers always win a master browser election.
  • Domain master browser: The domain master browser acts as a coordinator to all of the master browsers in a Windows NT domain. If you have a domain that’s so big that it has to span multiple subnets, you probably don’t want all of the browser-related traffic flowing between subnets, especially if those subnets are separated by a slow WAN link or a WAN link in which you get billed based on the amount of traffic that flows across the link. This is where the domain master browser comes in. If subnets are defined by using TCP/IP, then each subnet (within a single domain) acts as a semi-independent browsing environment. Because of the semi-independent nature of the subnets, each subnet has its own master browser and backup browser.

Optimizing browser traffic
As you’ve seen so far, there is a lot of network traffic associated with browsing. Just to summarize the process, clients come online and use a server announcement to make their presence known to the master browser. The master browser updates its list using the server announcement. The master browser must then replicate its list to both the domain master browser and to the backup browsers. Then, when the client is actually ready to browse the network, the client must send a request to the backup browser in order to get a copy of the browse list. That’s a lot of traffic! Fortunately, there are some things that you can do to minimize the amount of traffic generated by the browser service.

Configuring the server announcement time
One way that you can greatly reduce network traffic is by changing the server announcement time. Each computer on the network sends a server announcement to the master browser every twelve minutes. This works out to five server announcements per computer per hour. You can easily cut this down to four announcements per hour by changing the announcement time to fifteen minutes, or you can decrease the announcements to three times per hour by changing them to occur every twenty minutes. Increasing the announcement time decreases network traffic, but there is a price that comes with the traffic decrease.

Suppose for a moment that a computer crashes. Because the computer wasn’t shut down properly, no announcement ever occurred telling the master browser to remove the computer from the browse list. This means that the system will remain on the browse list for a while, even though it isn’t actually available. Using the default setting of twelve-minute announcement times, the system could remain on the browse list for up to 51 minutes. That breaks down to three consecutive twelve-minute cycles plus a fifteen-minute delay for the backup browser to receive an updated list from the master browser.

If you were to change the announcement cycle from twelve minutes to twenty minutes, the delay would change from 51 minutes to 75 minutes (three twenty-minute cycles plus a fifteen minute update time). As you can see, there is a trade-off involved in increasing announcement times. Personally, I recommend setting your announcement times to fifteen minutes. Doing so will only increase the maximum amount of time that unavailable resources remain on the browse list from 51 minutes to 60 minutes, and will cut out one set of announcements every hour.

To change the announcement frequency, open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\LanmanServer\Parameters. You must then add a REG_DWORD value to the Parameters tree. This value must be named Announce. Take careful note of the case of the value because it is case sensitive. The Announce key must then be assigned an integer value corresponding to the number of seconds to wait between server announcements. For example, a twelve-minute delay would use a value of 720 seconds while a fifteen-minute delay would require a value of 900 seconds.

Configuring master browser updates
Another way that you can reduce network traffic is to change the frequency at which the master browsers contact the domain master browser to exchange browse lists. By default, the master browsers contact the domain master browser, or primary domain controller (PDC), every twelve minutes in an effort to exchange browse lists. However, you can eliminate a considerable amount of traffic from your network by increasing the amount of time that the master browsers wait prior to contacting the domain master browser.

You can control this time delay by modifying the registry on each master browser within the domain. To do so, open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Browser\Parameters. Once you arrive at this location, locate a registry key called MasterPeriodicity. If this key doesn’t exist, then you’ll have to create it. This registry key is a REG_DWORD, which contains an integer value. The value directly corresponds to the number of seconds that the master browser waits before contacting the domain master browser to exchange browse lists. The default value is 720 seconds (twelve minutes) The value that you change this registry key to is up to you, but consider this: There’s a reason why master browsers contact the domain master browser every twelve minutes but only contact the backup browsers every fifteen minutes. I personally recommend leaving this value alone unless you’ve got an extreme situation on your hands and really need to reduce your network traffic. Even in these cases though, I recommend keeping the value below 900 (fifteen minutes).

Adjusting browser roles
Another way that you can optimize your network is by making an effort to control which servers carry the various browser roles. The domain master browser role is always assigned to the PDC, but you’ve got some flexibility with the other roles. Simply changing which servers conduct which roles won’t do anything to reduce your network traffic in most cases, but it can help you in other ways.

For example, if you’ve got a server that’s really bogged down and is low on system resources, then it’s probably safe to say that you don’t want that server to be a backup browser or a master browser. However, Windows doesn’t know that. Windows may have already assigned a demanding browser role to an already overworked server.

There are a couple of registry keys that you can use to control or at least influence your server’s browser role. I recommend beginning by going to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Browser\Parameters and looking at the MaintainServerList key. This registry key has three possible values: Yes, No, and Auto. If the value is set to No, then the computer is designated as a non-browser server. If, on the other hand, the value is set to Yes, then the computer will always be a browser. When the computer boots, the system will force a browser election. Depending on the election’s outcome, the computer will either be designated as a backup browser or as a master browser.

The default value for this registry key is Auto. The Auto setting needs a bit of explaining. Simply specifying the Auto setting designates the computer as a potential browser. However, there are a number of things that can move a system from being a potential browser to being a backup browser or even a master browser. The most obvious of these events is a browser election. A potential browser could also be promoted if there aren’t enough browsers available. Windows NT mandates that there must be at least one master browser and one backup browser for every 32 computers in a domain. If Windows senses that you don’t have enough browsers to facilitate all of the computers on the browse list, then promotions will be awarded.

Another registry key that you can use to influence browser roles is found at:
This key is called IsDomainMaster. This registry key is Boolean in nature and can either be set to true or false. If the key is set to false, then the key is essentially ignored and the MaintainServerList key dictates the server’s browser role. However, if the IsDomainMaster key is set to True, then the server is designated as a preferred master browser.

Gain control over network traffic
Browser traffic is a major factor in a network’s performance. Because the browser service can generate so much traffic, you need to keep an eye on it. Once you know the various browser roles and how they can affect the network, you can make the changes necessary to fine-tune your network.


Editor's Picks

Free Newsletters, In your Inbox