Wins Queries

[sventekkrishti]

Dear All,

Can someone help me out here. I have multiple clients setup with a WINS server and the ip address to that server, yet the WINS queries that are reported in Sniffer show up as general broadcasts. I thought that the client(s) would query the WINS server directly rather than throw a broadcast packet out onto the wire, if not then can someone explain why WINS is effectively any better ?



--
Sven

 

[matttheknife]

Hi Sven,
if your clients are properly configured with the IP of the WINS Server, but still broadcast, then the WINS Server is probably not reachable or the WINS service is not up on the server.
A client configured with a WINS address acts as H-Node. It tries to access the WINS server for its own registration and also later for resolution of addresses. It tries it 3 times, then goes to the second WINS Server, then falls back into Broadcast mode and tries everything via WINS-Broadcasts.

I would check the client configuration first, (correct WINS entry), then check the WINS server. If both are set-up correctly then capture a single boot-up of one client and verify, that the clients issue directed WINS packets first.
If you don't see these directed WINS queries, then you should see at least ARP-requests for the WINS-Servers IP.
Also make sure that the routing is OK, if the server is on a different subnet.

Regards
Matthias

 

[sventekkrishti]

Dear MattTheKnife,

Many thanks for your informative answer & reply. If possible could i ask another question ? I will re-post as well in case you don't see this reply.

Do you know anywhere that i can get hold of WINS error codes ? I have a client that does a WINS registration but fails with an Active Error=6 ?



Many thanks once again,


Sven.

 

[matttheknife]

Hi Sven,

Active Arror means, that the station wants to register a name that is already registered with the WINS server by another machine. WINS is a flat database that only allows single usage of a name in the database.

Now it really depends, what type of name the clients tries to register.

If it is the computer name (WINS registration of machinename<00>), then this will cause a problem, so please rename the machine(s).

If the client tries to register the username, e.g. administrator (WINS registration of username<03>), then this is not a problem as multiple persons can use the same account. But only the first user will receive messages sent by &quot;NET SEND&quot;

Best Regards
Matthias

Additional Info under:

http://www.microsoft.com/technet/tr...t/prodtechnol/winntas/reskit/net/sur_wins.asp

 

[AlfSutherland]

Hi All,
I recommend removing this Expert Alarm from your set ups (Tools, Expert Options, Alarms), the reason being: when a node send a WINS request it does it to a default address (in a similar way a broadcast 255.255.255.255), therefore you rarely see the WINS server replying to the node that has sent the broadcast request, due to the location of the &quot;sniffer&quot; in the network.
Basically the WINS server will reply directly, if the Snifer is not in the same segment as the requesting node it will not see the reply.

In Sniffer this is a mis-leading alarm, especially when very few peole now-adays use WINS!!
Alf

 

[matttheknife]

Hi Alf,
I agree on the Sniffer Symptom. Also agreed, that you won't see any responses from WINS Server being on a local segment, when you are sniffing from remote.

Only, a WINS Server will not answer to any Broadcast requests, only to directed requests. He will only be able to pick these Broadcasts up, if either WINS proxy or an IP-Helper are in place.
So either the client has got no WINS server address assigned, then it will always broadcast locally as a B-Node.
And then registration and resolution of names will stay within the subnet, and the WINS server will not know this station.

If the WINS server address is assigned, then it becomes an H-Node and will try to access the WINS server. However, if the WINS server is not present, it will fall back to broadcast and stay local.
Regards
Matthias

 

[sventekkrishti]

Dear All,

Firstly thankyou all very much for your help with this. I've included a little more information this time which might help in the diagnosis.

My client machine is indeed trying to register a <03> username which is a general login used more than once on the network but i don't see that as being a problem ? I've included the below information in case it helps.

The sequence is as follows in sniffer :-

WINS: C ID=40 OP=REGISTER NAME=<username><03>
WINS: R ID=40 OP=WACK STAT=OK
WINS: R ID=40 OP=REGISTER STAT=Active error


The error line is listed as :-

WINS Response Code = Active error (6) ?


Any help with this guys ?


Many thanks once again,


Sven.

 

[matttheknife]

Hi,
what you see is normal operation and thus not a problem at all. This is what you will always see when a general login is used.
Sequence:
WINS: C ID=40 OP=REGISTER NAME=<username><03>
Client is trying to register <username>, <03> is the messenger service under which the user can receive messages

WINS: R ID=40 OP=WACK STAT=OK
WINS server asks for more time to respond to this query (usually 2 seconds)

WINS: R ID=40 OP=REGISTER STAT=Active error
Wins server responds, that <username><03> has already been registered. (Active Error)

So, there is no problem for you on the network.
Only downside is, that the second user login with <username> will not receive any messages sent by
&quot;net send <username>&quot; command, because the registration of this name<03> with WINS failed. You may see a notification in the screen after the second login.
Regards
Matthias

 

[sventekkrishti]

Dear Matthias and everyone else here !



Many thanks for all your help with the above.






--
Sven