Some network configuration issues that I do not understand

I have a workgroup with a "production" Windows 2000 server and a new Windows
2003 std. edition server plus 2 new xp workstations (media edition and home
edition). The LAN also contains 3 older xp professional workstations, and
an SMC router/cabler modem and a printer with a NIC card.

I am seeing some strange things that I do not understand and I'm hoping that
somebody can help me.

On the 2000 server, I see event logs such as this one:

Event Type: Error
Event Source: NetBT
Event Category: None
Event ID: 4319
Date: 1/9/2006
Time: 4:28:26 PM
User: N/A
Computer: 2000SERVER
Description:
A duplicate name has been detected on the TCP network. The IP address of
the machine that sent the message is in the data. Use nbtstat -n in a
command window to see which name is in the Conflict state.
Data:
0000: 00 00 04 00 01 00 54 00 ......T.
0008: 00 00 00 00 df 10 00 c0 ....ß..À
0010: 05 01 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 15 04 a8 c0 ..¨À

I decode the ip address of the workstation as 192.168.4.21, which is the
address of the new media center workstation ("workstation3a") -- and which I
know to be a unique name on my network. I also have an event log for
192.168.4.51, whose name is "substation" and is also unquie, but is an older
xp machine. In fact, I'm seeing these messages for all workstations on my
network, which leads me to believe that these messages are bogus or the
result of some kind of error.

Second issue, I see a number of browser errors in the system event logs for
both the 2000 server and the 2003 server.

For example, the 2000 server will put out the following messge:

Event Type: Error
Event Source: MRxSmb
Event Category: None
Event ID: 8003
Date: 1/6/2006
Time: 1:04:38 PM
User: N/A
Computer: 2000SERVER
Description:
The master browser has received a server announcement from the computer
2003SERVER that believes that it is the master browser for the domain on
transport NetBT_Tcpip_{67CF81CD-6368-4F9. The master browser is stopping or
an election is being forced.
Data:
0000: 00 00 00 00 03 00 4e 00 ......N.
0008: 00 00 00 00 43 1f 00 c0 ....C..À
0010: 00 00 00 00 00 00 00 00 ........
0018: 05 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Okay I understand this, a browser election will be made.

But some time later, on the 2003 server I get:

Event Type: Error
Event Source: BROWSER
Event Category: None
Event ID: 8032
Date: 1/9/2006
Time: 2:02:32 PM
User: N/A
Computer: 2003SERVER
Description:
The browser service has failed to retrieve the backup list too many times on
transport \Device\NetBT_Tcpip_{5FDB4B79-DEA4-4B96-AD1D-C92A952AF5AF}. The
backup browser is stopping.
Data:
0000: 7a 00 00 00 z...

And after this point, "net view" fails and only returns the 2003server as
being in the workgroup when invoked on the 2003 server.

I'm 99% confident that this is not a LAN problem (dropped packets or
errors). I see no overt network outages. The MS explanation is for this
error (stripped to it's essentials):

"This computer is currently a backup browser. Backup browsers periodically
retrieve the browse list from the master browser. This computer could not
retrieve the browse list from the master browser five times consecutively.
The Browser 8021 event is usually logged when this event is logged. Possible
causes include:
Network outages,
Name resolution problems,
An overloaded master browser, or
A master browser that is unavailable because, for example, it is shut down
or has lost network connectivity.
This event usually indicates poor network health. If the backup browser
cannot retrieve the browse list from the master browser, its list becomes
stale and therefore unreliable, so it stops being a backup browser. For more
information about browsing, see Appendix I: Windows 2000 Server Browser
Service on the Microsoft Technet Web site."

And yes, there is sometimes an 8021 event that preceeding it. Here is one
example:

Event Type: Warning
Event Source: BROWSER
Event Category: None
Event ID: 8021
Date: 1/9/2006
Time: 10:43:29 PM
User: N/A
Computer: 2003SERVER
Description:
The browser service was unable to retrieve a list of servers from the
browser master \\2000SERVER on the network \Device\NwlnkIpx.

Browser master: \\2000SERVER
Network: \Device\NwlnkIpx

This event may be caused by a temporary loss of network connectivity. If
this message appears again, verify that the server is still connected to the
network. The return code is in the Data text box.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 35 00 00 00 5...

3rd issue:

The 2003 server comes with 2 network adapters. If I manually set static IP
addresses, on either of the NICs, I simply cannot see the other machines on
the LAN at all. Net view only returns the 2003 server -- when it returns
anything at all. In the latter case, I can't see any websites or ping any
internet sites. The ONLY way it seems to work is if I set both NICS to use
DHCP. Clearly, the browser list of names is truncated This is not what I
need as a static IP address is required for port forwarding in the SMC
router.

I'm quite confused as to how to procede.

Any help would be appreciated.

Thanks,
Jim

Hi Jim,

If you are assigning both NICs an address on the same tcp/ip
subnet that is your issue. If you are trying to use both NICs
for fault tolerance then you'll have to look into a third party
NIC teaming solution. NBT or NetBIOS over tcp/ip will
use the first NIC for session establishment and register all
NetBIOS names with that name and tcp/ip address. The
second triggers a duplicate name error like you are seeing.
Multihoming is commonly used for turning your server into
a router between two subnets. For more details have a look
at the following:
Troubleshooting browser Event ID 8021 and 8032 on master browsers
http://support.microsoft.com/kb/135404/en-us

"Jim" <(E-Mail Removed)> wrote in message news:

> The 2003 server comes with 2 network adapters. If I manually set static
> IP addresses, on either of the NICs, I simply cannot see the other
> machines on the LAN at all. Net view only returns the 2003 server -- when
> it returns anything at all. In the latter case, I can't see any websites
> or ping any internet sites. The ONLY way it seems to work is if I set
> both NICS to use DHCP. Clearly, the browser list of names is truncated
> This is not what I need as a static IP address is required for port
> forwarding in the SMC router.

"Michael Giorgio - MS MVP" <(E-Mail Removed)> wrote in
message news:(E-Mail Removed)...
> Hi Jim,
>
> If you are assigning both NICs an address on the same tcp/ip
> subnet that is your issue. If you are trying to use both NICs
> for fault tolerance then you'll have to look into a third party
> NIC teaming solution. NBT or NetBIOS over tcp/ip will
> use the first NIC for session establishment and register all
> NetBIOS names with that name and tcp/ip address. The
> second triggers a duplicate name error like you are seeing.
> Multihoming is commonly used for turning your server into
> a router between two subnets. For more details have a look
> at the following:
> Troubleshooting browser Event ID 8021 and 8032 on master browsers
> http://support.microsoft.com/kb/135404/en-us

I see that my response didn't make it, so I'll try again.

Thanks for the tip, I'll try to disconnect one NIC and see it it matters.
I'll also check with the 2003 server manufacturer to see is they shipped a
teaming driver (or if they did, how I configure it), as the design goal in
configuring it was to provide for reduncancy of hardware.

The 2000 server is also authenticating VPN incoming connections using RRAS.
I note that a 2nd IP address for the server pops up and appears in the
connection properties "details." That IP address, 192.168.4.112, is
pingable and applications can be accessed via telnet. Since there is only
one NIC in the machine, I'm going to presume that this is NOT a case of
multihoming. Or is it?

Thanks again.

Regards,
Jim

>
> "Jim" <(E-Mail Removed)> wrote in message news:
>
>> The 2003 server comes with 2 network adapters. If I manually set static
>> IP addresses, on either of the NICs, I simply cannot see the other
>> machines on the LAN at all. Net view only returns the 2003 server --
>> when it returns anything at all. In the latter case, I can't see any
>> websites or ping any internet sites. The ONLY way it seems to work is if
>> I set both NICS to use DHCP. Clearly, the browser list of names is
>> truncated This is not what I need as a static IP address is required for
>> port forwarding in the SMC router.
>
>

Yes, an incoming remote connection will certainly make the server
multihomed as far as Netbt is concerned. There are basically two ways around
the problem.

1. Disable Netbt on the "internal" interface in RRAS. This requires a
registry change.

2. Put the remote users in their own IP subnet. This may require some
changes to your routing to ensure that the remotes can access machines on
the LAN.

Method 1 is described in a section near the end of KB 292822. The pros
and cons of using method 2 instead are discussed in KB 830063 (again near
the end).

I have specified the "near the end" bit because the early part of these
articles discusses DNS issues, before getting on to the Netbt issues.

Jim wrote:
> "Michael Giorgio - MS MVP" <(E-Mail Removed)>
> wrote in message news:(E-Mail Removed)...
>> Hi Jim,
>>
>> If you are assigning both NICs an address on the same tcp/ip
>> subnet that is your issue. If you are trying to use both NICs
>> for fault tolerance then you'll have to look into a third party
>> NIC teaming solution. NBT or NetBIOS over tcp/ip will
>> use the first NIC for session establishment and register all
>> NetBIOS names with that name and tcp/ip address. The
>> second triggers a duplicate name error like you are seeing.
>> Multihoming is commonly used for turning your server into
>> a router between two subnets. For more details have a look
>> at the following:
>> Troubleshooting browser Event ID 8021 and 8032 on master browsers
>> http://support.microsoft.com/kb/135404/en-us
>
> I see that my response didn't make it, so I'll try again.
>
> Thanks for the tip, I'll try to disconnect one NIC and see it it
> matters. I'll also check with the 2003 server manufacturer to see is
> they shipped a teaming driver (or if they did, how I configure it),
> as the design goal in configuring it was to provide for reduncancy of
> hardware.
> The 2000 server is also authenticating VPN incoming connections using
> RRAS. I note that a 2nd IP address for the server pops up and appears
> in the connection properties "details." That IP address,
> 192.168.4.112, is pingable and applications can be accessed via
> telnet. Since there is only one NIC in the machine, I'm going to
> presume that this is NOT a case of multihoming. Or is it?
>
> Thanks again.
>
> Regards,
> Jim
>
>>
>> "Jim" <(E-Mail Removed)> wrote in message news:
>>
>>> The 2003 server comes with 2 network adapters. If I manually set
>>> static IP addresses, on either of the NICs, I simply cannot see the
>>> other machines on the LAN at all. Net view only returns the 2003
>>> server -- when it returns anything at all. In the latter case, I
>>> can't see any websites or ping any internet sites. The ONLY way it
>>> seems to work is if I set both NICS to use DHCP. Clearly, the
>>> browser list of names is truncated This is not what I need as a
>>> static IP address is required for port forwarding in the SMC router.

"Bill Grant" <not.available@online> wrote in message
news:(E-Mail Removed)...
> Yes, an incoming remote connection will certainly make the server
> multihomed as far as Netbt is concerned. There are basically two ways
> around the problem.
>
> 1. Disable Netbt on the "internal" interface in RRAS. This requires a
> registry change.
>
> 2. Put the remote users in their own IP subnet. This may require some
> changes to your routing to ensure that the remotes can access machines on
> the LAN.
>
> Method 1 is described in a section near the end of KB 292822. The pros
> and cons of using method 2 instead are discussed in KB 830063 (again near
> the end).
>
> I have specified the "near the end" bit because the early part of these
> articles discusses DNS issues, before getting on to the Netbt issues.

Bill,

I have been checking, but none of my other VPN servers are showing any
symptoms like this 2000 server is. None of my other servers (and all of
them except this one are 2003 std. edition servers) are showing problems
with a master or backup browser or bogus duplicate IP addresses.

BTW, I've disconnected the 2nd NIC in the new server and disabled it, so the
multi-homing issue does not apply in the new server. I'm convinced that
some configuration error in the old 2000 server is the issue as the browser
elections are being generated from this one. As it is going to be shut down
and taken out of the picture shortly, this may only be a transitory problem.

Thanks for you help.

Jim

>
> Jim wrote:
>> "Michael Giorgio - MS MVP" <(E-Mail Removed)>
>> wrote in message news:(E-Mail Removed)...
>>> Hi Jim,
>>>
>>> If you are assigning both NICs an address on the same tcp/ip
>>> subnet that is your issue. If you are trying to use both NICs
>>> for fault tolerance then you'll have to look into a third party
>>> NIC teaming solution. NBT or NetBIOS over tcp/ip will
>>> use the first NIC for session establishment and register all
>>> NetBIOS names with that name and tcp/ip address. The
>>> second triggers a duplicate name error like you are seeing.
>>> Multihoming is commonly used for turning your server into
>>> a router between two subnets. For more details have a look
>>> at the following:
>>> Troubleshooting browser Event ID 8021 and 8032 on master browsers
>>> http://support.microsoft.com/kb/135404/en-us
>>
>> I see that my response didn't make it, so I'll try again.
>>
>> Thanks for the tip, I'll try to disconnect one NIC and see it it
>> matters. I'll also check with the 2003 server manufacturer to see is
>> they shipped a teaming driver (or if they did, how I configure it),
>> as the design goal in configuring it was to provide for reduncancy of
>> hardware.
>> The 2000 server is also authenticating VPN incoming connections using
>> RRAS. I note that a 2nd IP address for the server pops up and appears
>> in the connection properties "details." That IP address,
>> 192.168.4.112, is pingable and applications can be accessed via
>> telnet. Since there is only one NIC in the machine, I'm going to
>> presume that this is NOT a case of multihoming. Or is it?
>>
>> Thanks again.
>>
>> Regards,
>> Jim
>>
>>>
>>> "Jim" <(E-Mail Removed)> wrote in message news:
>>>
>>>> The 2003 server comes with 2 network adapters. If I manually set
>>>> static IP addresses, on either of the NICs, I simply cannot see the
>>>> other machines on the LAN at all. Net view only returns the 2003
>>>> server -- when it returns anything at all. In the latter case, I
>>>> can't see any websites or ping any internet sites. The ONLY way it
>>>> seems to work is if I set both NICS to use DHCP. Clearly, the
>>>> browser list of names is truncated This is not what I need as a
>>>> static IP address is required for port forwarding in the SMC router.
>
>