Windows

General discussion

Gravatar
Locked

Servers Drop Off The Network

By WKCook ·
We have a problem where a server will seem to drop off the network. It will still answer to a ping, but not to a NetBIOS session request. Upon looking closer with a protocol analyzer, we found that the server was sending a NBT Reset_Connection packet, and thus it appeared that it was off the network. The real problem is that some of the servers experiencing this problem are domain controllers, one of which is the Primary. The only work-around (besides rebooting) is to restart the server service and the computer browser service. We tried different network cards, re-applying service packs, re-installing TCP/IP, and finally installing a whole new system. After putting in two new servers, they have now started the same thing all over again.

Any ideas?

This conversation is currently closed to new comments.

8 total posts (Page 1 of 1)  
+ Follow this Discussion ·
| Thread display: Collapse - | Expand +

All Comments

gravatar
Collapse -

Servers Drop Off The Network

by Curious_George In reply to Servers Drop Off The Netw ...

No mention in your description of WINS configuration scheme, but the most likely ause for this is a bad record either in the WINS database, which may be replicated (and therefore bouncing a bad record around) or it may be a bad record in an LMHOSTS file. It is very unlikely that the problem is with machine hardware, TCP/IP configuration, or bad OS files.

I can't tell you more without a thorough understanding of your NetBIOS resolution method, but I'll bet that's where the problem lies.

gravatar
Collapse -

Servers Drop Off The Network

by WKCook In reply to Servers Drop Off The Netw ...

Analysis of traffic shows WINS is correctly resolving names. LMHOSTS are not used. The biggest mystery is...Why does the server send a NBT Reset_Connection packet.

Thnx Anyway...WKCOOK

gravatar
Collapse -

Servers Drop Off The Network

by jcurl In reply to Servers Drop Off The Netw ...

I agree with Curious_George, it certainly sounds like a WINS resolution issue. Make sure the WINS server is running. Check the WINS database to see if there is an error (like a conflicting static mapping). Another possible cause would be if you areusing DHCP to send WINS info to DHCP clients and someone fouled up the WINS/NBNS IP address entry in the DHCP options. Check that as well.

Good luck

gravatar
Collapse -

Servers Drop Off The Network

by WKCook In reply to Servers Drop Off The Netw ...

WINS is running and analysis of traffic shows WINS is correctly resolving names. LMHOSTS are not used. The biggest mystery is...Why does the server send a NBT Reset_Connection packet.

Thnx Anyway...WKCOOK

gravatar
Collapse -

Servers Drop Off The Network

by jvohs In reply to Servers Drop Off The Netw ...

Is the event viewer full of browser elections? How about any 4319 errors? If there are browser elections check with browstat, a resources kit utility, on the various subnets to see who is taking master browser role. A 98 machine can cause troubleif the registry has been hacked to make it a browser, and an NT machine is added to the subnet. Also the domain master browser, the PDC, should not have two NIC's. If it does it will confuse the browse lists but probably isn't causing this. Checkall WINS servers for split registration. This is when a WINS server does NOT point to itself for primary AND secondary WINS. It takes too many words to explain why here, email me for more details. If you do find split registration, rebuild all WINS databases. First stop all replication, hopefully you have a hub and spoke model where all spoke WINS servers push/pull to the hub and only the hub. The hub push/pulls to all. This way you kill the hub then all databases then the hub and start WINS again. "nbtstat -RR" on all servers will reregister them with WINS. Split registration is a cause for this happening sometimes. 4319's??? In event viewer, convert the last 32 bits of hex to decimal and you will have the IP of the conflicting machine. If it is the local machine check WINS for bad records. Good luck! :)

gravatar
Collapse -

Servers Drop Off The Network

by jvohs In reply to Servers Drop Off The Netw ...

NBT Reset_Connection is sent when there is a duplicate name I believe. I will check.

gravatar
Collapse -

Servers Drop Off The Network

by WKCook In reply to Servers Drop Off The Netw ...

I will be closing this question. Someone at Microsoft hinted at something and lead us to the following:

There was a Linux box running Samba on our network that was attempting to make itself the PDC. This was done without our knowledge and has been corrected.

Thanks for all your input...Keith Cook

gravatar
Collapse -

Servers Drop Off The Network

by WKCook In reply to Servers Drop Off The Netw ...

This question was closed by the author

Back to Windows Forum
8 total posts (Page 1 of 1)  

Start or search

Related Forums