Can I display the Computer Browser services cache?

Scenario:
Server1 is master browser for Workgroup1. I have physical access to the
machine (Administrator). I want to display the Computer Browser services
cache and see what's inside. I think that it contains:
1. List of servers on Workgroup1
2. List of master browsers for other workgroups.
I want list number 2. Or may be there is another way to get this
information? I want to query the local cache, because
browstat status Workgroup2
is useless if Workgroup2 has just been left by the last server.

I prefer a command line utility, but a GUI will do the job as well.


Thanks for any help!

browstat /?
Utility from Support Tools.

--
Dmitry Burtsev [(E-Mail Removed)]



"George Valkov" <(E-Mail Removed)> wrote in message
news:uje$(E-Mail Removed)...
> Scenario:
> Server1 is master browser for Workgroup1. I have physical access to the
> machine (Administrator). I want to display the Computer Browser services
> cache and see what's inside. I think that it contains:
> 1. List of servers on Workgroup1
> 2. List of master browsers for other workgroups.
> I want list number 2. Or may be there is another way to get this
> information? I want to query the local cache, because
> browstat status Workgroup2
> is useless if Workgroup2 has just been left by the last server.
>
> I prefer a command line utility, but a GUI will do the job as well.
>
>
> Thanks for any help!
>
>

Thank You!
Can You tell me how to use this command:

#browstat stats
Unable to query browser statistics: 87

* 87 = The parameter is incorrect




"Burtsev Dmitry" <(E-Mail Removed)> wrote in message
news:uH#(E-Mail Removed)...
> browstat /?
> Utility from Support Tools.
>
> --
> Dmitry Burtsev [(E-Mail Removed)]
>
>
>
> "George Valkov" <(E-Mail Removed)> wrote in message
> news:uje$(E-Mail Removed)...
> > Scenario:
> > Server1 is master browser for Workgroup1. I have physical access to the
> > machine (Administrator). I want to display the Computer Browser services
> > cache and see what's inside. I think that it contains:
> > 1. List of servers on Workgroup1
> > 2. List of master browsers for other workgroups.
> > I want list number 2. Or may be there is another way to get this
> > information? I want to query the local cache, because
> > browstat status Workgroup2
> > is useless if Workgroup2 has just been left by the last server.
> >
> > I prefer a command line utility, but a GUI will do the job as well.
> >
> >
> > Thanks for any help!
> >
> >
>
>

Finally one part from what I was looking:

#browstat view 1 Workgroup1 0x80000000
....
WORKGROUP2 NT 03.10 (NT) SERVER2

The second part from what I need is to find out the IP address for SERVER2,
because it appears to be fire-walled. Any ideas? I believe that SERVER2 is
Windows XP pro with Internet Connection Firewall (ICF) / Internet Connection
Sharing (ICS).



"George Valkov" <(E-Mail Removed)> wrote in message
news:uje$(E-Mail Removed)...
> Scenario:
> Server1 is master browser for Workgroup1. I have physical access to the
> machine (Administrator). I want to display the Computer Browser services
> cache and see what's inside. I think that it contains:
> 1. List of servers on Workgroup1
> 2. List of master browsers for other workgroups.
> I want list number 2. Or may be there is another way to get this
> information? I want to query the local cache, because
> browstat status Workgroup2
> is useless if Workgroup2 has just been left by the last server.
>
> I prefer a command line utility, but a GUI will do the job as well.
>
>
> Thanks for any help!
>
>

Try nslookup.
This is utility for querying DNS server.
nslookup - server YOUR DNS - set type=any - SERVER2

--
Dmitry Burtsev [(E-Mail Removed)]



"George Valkov" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Finally one part from what I was looking:
>
> #browstat view 1 Workgroup1 0x80000000
> ...
> WORKGROUP2 NT 03.10 (NT) SERVER2
>
> The second part from what I need is to find out the IP address for
SERVER2,
> because it appears to be fire-walled. Any ideas? I believe that SERVER2 is
> Windows XP pro with Internet Connection Firewall (ICF) / Internet
Connection
> Sharing (ICS).
>
>
>
> "George Valkov" <(E-Mail Removed)> wrote in message
> news:uje$(E-Mail Removed)...
> > Scenario:
> > Server1 is master browser for Workgroup1. I have physical access to the
> > machine (Administrator). I want to display the Computer Browser services
> > cache and see what's inside. I think that it contains:
> > 1. List of servers on Workgroup1
> > 2. List of master browsers for other workgroups.
> > I want list number 2. Or may be there is another way to get this
> > information? I want to query the local cache, because
> > browstat status Workgroup2
> > is useless if Workgroup2 has just been left by the last server.
> >
> > I prefer a command line utility, but a GUI will do the job as well.
> >
> >
> > Thanks for any help!
> >
> >
>
>

The Browse List is Netbios based.
NSLookup is DNS based.
So the two are unrelated.

George,
There is no "cache". The Browse List is just the Browse List. To see what
is in it just open Network Neighborhood (Network Places). It gets its data
from the Browse List, therefore what is in Network Places is what is in the
Browse List.

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com


"Burtsev Dmitry" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Try nslookup.
> This is utility for querying DNS server.
> nslookup - server YOUR DNS - set type=any - SERVER2
>
> --
> Dmitry Burtsev [(E-Mail Removed)]
>
>
>
> "George Valkov" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Finally one part from what I was looking:
> >
> > #browstat view 1 Workgroup1 0x80000000
> > ...
> > WORKGROUP2 NT 03.10 (NT) SERVER2
> >
> > The second part from what I need is to find out the IP address for
> SERVER2,
> > because it appears to be fire-walled. Any ideas? I believe that SERVER2
is
> > Windows XP pro with Internet Connection Firewall (ICF) / Internet
> Connection
> > Sharing (ICS).
> >
> >
> >
> > "George Valkov" <(E-Mail Removed)> wrote in message
> > news:uje$(E-Mail Removed)...
> > > Scenario:
> > > Server1 is master browser for Workgroup1. I have physical access to
the
> > > machine (Administrator). I want to display the Computer Browser
services
> > > cache and see what's inside. I think that it contains:
> > > 1. List of servers on Workgroup1
> > > 2. List of master browsers for other workgroups.
> > > I want list number 2. Or may be there is another way to get this
> > > information? I want to query the local cache, because
> > > browstat status Workgroup2
> > > is useless if Workgroup2 has just been left by the last server.
> > >
> > > I prefer a command line utility, but a GUI will do the job as well.
> > >
> > >
> > > Thanks for any help!
> > >
> > >
> >
> >
>
>

Thank You Phillip!
This command line
browstat view 1 Workgroup1 0x80000000
showed me the Master Browsers' NetBIOS names for each workgroup.

As You said, probably I cannot use the browse-list to obtain IP addresses.
That's why finding the IP address for the fire-walled Master Browser was a
very hard task. I spend some hours examining the network and sniffing around
and finally I caught a broadcast message from those server attempting to
register his workgroup. Now I know the IP and I can block this messages.

How I solved part 2:
First I had to suspect a short list of IP addresses and then to sniff their
broadcast messages. Choosing one dozen from 2048 IPs took me about an hour.

Can You tell me how can I configure the filter of Network Monitor (comes as
part from Win2003) to detect a message from specific NetBIOS name?




"Phillip Windell" <@.> wrote in message
news:(E-Mail Removed)...
> The Browse List is Netbios based.
> NSLookup is DNS based.
> So the two are unrelated.
>
> George,
> There is no "cache". The Browse List is just the Browse List. To see what
> is in it just open Network Neighborhood (Network Places). It gets its data
> from the Browse List, therefore what is in Network Places is what is in
the
> Browse List.
>
> --
>
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
>
> "Burtsev Dmitry" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Try nslookup.
> > This is utility for querying DNS server.
> > nslookup - server YOUR DNS - set type=any - SERVER2
> >
> > --
> > Dmitry Burtsev [(E-Mail Removed)]
> >
> >
> >
> > "George Valkov" <(E-Mail Removed)> wrote in message
> > news:(E-Mail Removed)...
> > > Finally one part from what I was looking:
> > >
> > > #browstat view 1 Workgroup1 0x80000000
> > > ...
> > > WORKGROUP2 NT 03.10 (NT) SERVER2
> > >
> > > The second part from what I need is to find out the IP address for
> > SERVER2,
> > > because it appears to be fire-walled. Any ideas? I believe that
SERVER2
> is
> > > Windows XP pro with Internet Connection Firewall (ICF) / Internet
> > Connection
> > > Sharing (ICS).
> > >
> > >
> > >
> > > "George Valkov" <(E-Mail Removed)> wrote in message
> > > news:uje$(E-Mail Removed)...
> > > > Scenario:
> > > > Server1 is master browser for Workgroup1. I have physical access to
> the
> > > > machine (Administrator). I want to display the Computer Browser
> services
> > > > cache and see what's inside. I think that it contains:
> > > > 1. List of servers on Workgroup1
> > > > 2. List of master browsers for other workgroups.
> > > > I want list number 2. Or may be there is another way to get this
> > > > information? I want to query the local cache, because
> > > > browstat status Workgroup2
> > > > is useless if Workgroup2 has just been left by the last server.
> > > >
> > > > I prefer a command line utility, but a GUI will do the job as well.
> > > >
> > > >
> > > > Thanks for any help!
> > > >
> > > >
> > >
> > >
> >
> >
>
>

"George Valkov" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> Can You tell me how can I configure the filter of Network Monitor (comes
as
> part from Win2003) to detect a message from specific NetBIOS name?

You must find the MAC address used by the machine with that name,...then
filter by MAC address in Network Monitor. I believe you can also filter by
IP# the same way. There may be other things you can do as well, but I don't
use NetMon that often and don't know all of its "gory details".

--

Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com

The server won't receive Your message, because it's fire-walled. It's IP/MAC
are not added to the ARP cache.

#nbtstat -a Server2
Host not found.

That's why I wanted to filter by NetBIOS name.



"Phillip Windell" <@.> wrote in message
news:u#(E-Mail Removed)...
> "George Valkov" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
> > Can You tell me how can I configure the filter of Network Monitor (comes
> as
> > part from Win2003) to detect a message from specific NetBIOS name?
>
> You must find the MAC address used by the machine with that name,...then
> filter by MAC address in Network Monitor. I believe you can also filter
by
> IP# the same way. There may be other things you can do as well, but I
don't
> use NetMon that often and don't know all of its "gory details".
>
> --
>
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
>
>