master browser messages in evenlog on firewalled machine

Hi,

I have a hosted server that was set up by the hosting company (uk2) to use
the local security settings as a firewall (in the "local security settings"
console, select "IP security policies on local computer"). This performs
packet filtering on incoming and outgoing IP packets. I have configured it
to allow only the things I need (incoming HTTP and Remote Desktop, outgoing
SMTP and DNS) and it seems to be working OK.

However, I have noticed messages in the event log like this:

"The master browser has received a server announcement from the computer
SERVER_XXXX that believes that it is the master browser for the domain..."

The server names in the event log are those typically assigned by the
hosting provider, so I guess these other servers are in the same hosting
centre (on the same network segment?). However, What I don't understand is
how it is receiving announcements from machines over tcp/ip (this is the
only network protocol installed) when the IP security policy is supposed to
be filtering the traffic.

It seems to me that either the packet filtering is implicitly letting
through some packets regardless of how it is configured, or that the
communication is not taking place over TCP/IP. Can anyone explain this
please?

Andy

Filters are sometimes defined to allow responses to communications
initiated within. The messages that you mention result from either
"hearing" a broadcast stating "I am master browser" or from having
broadcast "I see no master browser, hence I am master now". Either
can result is a short free election, following which the then current
master is identified for all to know and use.
That use then is over defined TCP ports that are apparently for your
system blocked.
In a hosted environment not only is it good that they are blocked, but
it is curious that you have the Browser (and hence Server) and the
Workstation services allowed to run.

--
Roger Abell
Microsoft MVP (Windows Security)
MCSE (W2k3,W2k,Nt4) MCDBA
"Andy Fish" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Hi,
>
> I have a hosted server that was set up by the hosting company (uk2) to use
> the local security settings as a firewall (in the "local security
settings"
> console, select "IP security policies on local computer"). This performs
> packet filtering on incoming and outgoing IP packets. I have configured it
> to allow only the things I need (incoming HTTP and Remote Desktop,
outgoing
> SMTP and DNS) and it seems to be working OK.
>
> However, I have noticed messages in the event log like this:
>
> "The master browser has received a server announcement from the computer
> SERVER_XXXX that believes that it is the master browser for the domain..."
>
> The server names in the event log are those typically assigned by the
> hosting provider, so I guess these other servers are in the same hosting
> centre (on the same network segment?). However, What I don't understand is
> how it is receiving announcements from machines over tcp/ip (this is the
> only network protocol installed) when the IP security policy is supposed
to
> be filtering the traffic.
>
> It seems to me that either the packet filtering is implicitly letting
> through some packets regardless of how it is configured, or that the
> communication is not taking place over TCP/IP. Can anyone explain this
> please?
>
> Andy
>
>