Name resolution nightmare

[humbletech99]

I've just this weekend had a massive clear out of the machine room, removed everything and plugged everything back in. Now everybody is complaining that access to servers is really slow (which it is).

I have been pulling my hair out as all the servers show 1000Mbs (gigabit) connected speeds and I have no problems from my workstation, but most other people do.

I've narrowed it down to a fault in name resolution. It seems that when I do from cmd

dir \\hostname\sharename

it hangs for a very long time, but if I do

dir \\x.x.x.x\sharename

I get an instant directory listing. Therefore WINS name resolution must be broken. But it works fine from my windows xp workstation, and from some others it hangs for ages...

I don't understand, the wins server is running and answering requests, I have used nblookup to query my wins server directly, it returns the right ip instantly. I have unplugged and replugged the servers into different sockets to spread the switching load, giving more direct paths, I have flushed the dns and netbios caches, I have restarted my wins server and restarted a workstation to test this and it still doesn't work from those broken workstations. I JUST DON'T GET IT!

Why can some workstations not resolve the name and others have no problem? One workstation which has this problem looks like a broadcast node accoring to ipconfig, the other is a hybrid so it should be using the wins server. In any case, I've also queried by broadcast the wins address and it's fast. I've also been testing my dns and it also gives an instant response.

So why are these broken workstations failing to resolve the names of the servers properly? Are they broadcasting and not getting a reply, are they querying the wins server and not getting a reply or are they just themselves broken and if so how and why?

I've seen something like this before but this is driving me nuts. When clearing the netbios cache the computer also hangs, so it looks like the problem is squarely the local netbios on the workstations.

Any ideas or suicide pills welcome!

 

[WhoKilledKenny]

Do you have multiple WINS servers and what does the Push Pull topology look like. Are the WINS server pointing to themselves as Primary WINS?

Are you using Active Directory and MS DNS?

Did any IP Addresses change in your environment?

 

[humbletech99]

no ip address changes, I have only 1 Wins server and it's a Samba wins server, not MS. But the fact that it's samba doesn't matter, it has always worked fine until this weekend, the machines is accessible at high speed, and from both my windows and unix workstations it works fine, I've even queried it directly several times and get immediate response, same for broadcast requests.

 

[WhoKilledKenny]

No DNS?

Windows resolution order:
I hope I get this right, it's been awhile...
1. NetBIOS name cache
2. WINS
3. Broadcasts
4. LMSHosts File
5. Host File
6. DNS

I would start with number 1.
To verify cache Server names and their IP.
c:\nbtstat -c

You can also clear the cache
c:\nbtstat -R (Capital 'R')

Since the second thing it attemps to use for name resolution is the WINS server, I would suspect that it is having issues communicating.

I have never used SAMBA WINS but I have used SAMBA shares, which always seemed to have issues (Between MS and UNIX) during a network outage. Usually the UNIX admin would restart some deamon that would resolve the issue.

To Test if WINS is the issue, do a packet capture or set up an LMHosts file on one of the clients that is having the issue. Remove the WINS address from the TCP/IP stack so that it skips step 2 and goes to step 3. then step 4. LMShosts. Step 3. should fail quickly if the Server and workstation are not on the same subnet.

 

[WhoKilledKenny]

LMHosts not LMSHosts... Like I said, long time ago...
Make sure the Use LMHosts is checked under the WINS tab of the TCP/IP properties.

 

[humbletech99]

done all of that before.

 

[WhoKilledKenny]

OK...
Asking again, are you running DNS? Acitive Directory?

I would do a packet sniff on the client to see what is actually going on. You can use MS NetMon or try Ethereal(which I use).

http://www.ethereal.com/

Start a packet capture and do a UNC to a servername. Analyze the traiffic, verify which protocol is being used for name resolution.

 

[humbletech99]

it's subsided for now, if it recurrs then I will do the ethereal (now wireshark isn't it) trace.

yes I have AD and Bind DNS.

 

[WhoKilledKenny]

Wireshark? not sure if the name was changed. Didn't look like it from the link provided. I'll check it out thought.
glad to hear you network is behaving....

 

[humbletech99]

well, at least one person is still having a problem, directly querying WINS and DNS from that workstation gets instant responses, but when doing something like net view \\hostname it hangs for 30 seconds.

I don't get why the OS isn't using these immediate responses to immediately connect, perhaps the responses aren't being sent at all?