source: branches/samba-3.3.x/docs/htmldocs/Samba3-HOWTO/NetworkBrowsing.html

Last change on this file was 411, checked in by Herwig Bauernfeind, 16 years ago

Update Samba 3.3.x to 3.3.11
File size: 109.1 KB
Line 
1<html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Network Browsing</title><link rel="stylesheet" href="../samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.74.0"><link rel="home" href="index.html" title="The Official Samba 3.3.x HOWTO and Reference Guide"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="prev" href="ChangeNotes.html" title="Chapter 9. Important and Critical Change Notes for the Samba 3.x Series"><link rel="next" href="passdb.html" title="Chapter 11. Account Information Databases"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Network Browsing</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="ChangeNotes.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="passdb.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetworkBrowsing"></a>Chapter 10. Network Browsing</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="orgname">Samba Team</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jht@samba.org">jht@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="orgname">The Samba Team</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jelmer@samba.org">jelmer@samba.org</a>&gt;</code></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jonathan</span> <span class="orgname">Sutinen Consulting, Inc.</span> <span class="surname">Johnson</span></h3><div class="affiliation"><span class="orgname">Sutinen Consulting, Inc.<br></span><div class="address"><p><code class="email">&lt;<a class="email" href="mailto:jon@sutinen.com">jon@sutinen.com</a>&gt;</code></p></div></div></div></div><div><p class="pubdate">July 5, 1998</p></div><div><p class="pubdate">Updated: September 20, 2006</p></div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><span class="sect1"><a href="NetworkBrowsing.html#id2579524">Features and Benefits</a></span></dt><dt><span class="sect1"><a href="NetworkBrowsing.html#id2579708">What Is Browsing?</a></span></dt><dt><span class="sect1"><a href="NetworkBrowsing.html#netdiscuss">Discussion</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#id2580148">NetBIOS over TCP/IP</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2580784">TCP/IP without NetBIOS</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#adsdnstech">DNS and Active Directory</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetworkBrowsing.html#id2581343">How Browsing Functions</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#DMB">Configuring Workgroup Browsing</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2582290">Domain Browsing Configuration</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#browse-force-master">Forcing Samba to Be the Master</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2582891">Making Samba the Domain Master</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2583131">Note about Broadcast Addresses</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2583152">Multiple Interfaces</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2583338">Use of the Remote Announce Parameter</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2583478">Use of the Remote Browse Sync Parameter</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetworkBrowsing.html#id2583571">WINS: The Windows Internetworking Name Server</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#id2583843">WINS Server Configuration</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2584164">WINS Replication</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2584217">Static WINS Entries</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetworkBrowsing.html#id2584448">Helpful Hints</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#id2584459">Windows Networking Protocols</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2584601">Name Resolution Order</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetworkBrowsing.html#id2584804">Technical Overview of Browsing</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#id2584891">Browsing Support in Samba</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2585087">Problem Resolution</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2585339">Cross-Subnet Browsing</a></span></dt></dl></dd><dt><span class="sect1"><a href="NetworkBrowsing.html#id2586352">Common Errors</a></span></dt><dd><dl><dt><span class="sect2"><a href="NetworkBrowsing.html#id2586378">Flushing the Samba NetBIOS Name Cache</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2586451">Server Resources Cannot Be Listed</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2586500">I Get an "Unable to browse the network" Error</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2586546">Browsing of Shares and Directories is Very Slow</a></span></dt><dt><span class="sect2"><a href="NetworkBrowsing.html#id2586746">Invalid Cached Share References Affects Network Browsing</a></span></dt></dl></dd></dl></div><p>
2<a class="indexterm" name="id2579435"></a>
3<a class="indexterm" name="id2579442"></a>
4<a class="indexterm" name="id2579449"></a>
5<a class="indexterm" name="id2579456"></a>
6This chapter contains detailed information as well as a fast-track guide to
7implementing browsing across subnets and/or across workgroups (or domains).
8WINS is the best tool for resolution of NetBIOS names to IP addresses; however, WINS is
9not involved in browse list handling except by way of name-to-address resolution.
10</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
11<a class="indexterm" name="id2579472"></a>
12What is WINS?
13</p><p>
14WINS is a facility that provides resolution of a NetBIOS name to its IP address. WINS is like a
15Dynamic-DNS service for NetBIOS networking names.
16</p></div><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
17<a class="indexterm" name="id2579490"></a>
18<a class="indexterm" name="id2579496"></a>
19<a class="indexterm" name="id2579503"></a>
20<a class="indexterm" name="id2579510"></a>
21MS Windows 2000 and later versions can be configured to operate with no NetBIOS
22over TCP/IP. Samba-3 and later versions also support this mode of operation.
23When the use of NetBIOS over TCP/IP has been disabled, the primary
24means for resolution of MS Windows machine names is via DNS and Active Directory.
25The following information assumes that your site is running NetBIOS over TCP/IP.
26</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2579524"></a>Features and Benefits</h2></div></div></div><p>
27Charles Dickens once referred to the past in these words: &#8220;<span class="quote"><span class="emphasis"><em>It was the best of times,
28it was the worst of times.</em></span></span>&#8221; The more we look back, the more we long for what was and
29hope it never returns.
30</p><p>
31<a class="indexterm" name="id2579543"></a>
32<a class="indexterm" name="id2579550"></a>
33<a class="indexterm" name="id2579557"></a>
34For many MS Windows network administrators, that statement sums up their feelings about
35NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle
36nature was just par for the course. For those who never quite managed to tame its
37lusty features, NetBIOS is like Paterson's Curse.
38</p><p>
39For those not familiar with botanical problems in Australia, Paterson's Curse,
40<span class="emphasis"><em>Echium plantagineum</em></span>, was introduced to Australia from Europe during the mid-19th
41century. Since then it has spread rapidly. The high seed production, with densities of
42thousands of seeds per square meter, a seed longevity of more than 7 years, and an
43ability to germinate at any time of year, given the right conditions, are some of the
44features that make it such a persistent weed.
45</p><p>
46<a class="indexterm" name="id2579587"></a>
47<a class="indexterm" name="id2579596"></a>
48<a class="indexterm" name="id2579603"></a>
49<a class="indexterm" name="id2579610"></a>
50<a class="indexterm" name="id2579616"></a>
51In this chapter we explore vital aspects of Server Message Block (SMB) networking with
52a particular focus on SMB as implemented through running NetBIOS (Network Basic
53Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over
54any other protocols, we need to know how to configure our network environment and simply
55remember to use nothing but TCP/IP on all our MS Windows network clients.
56</p><p>
57<a class="indexterm" name="id2579634"></a>
58<a class="indexterm" name="id2579641"></a>
59Samba provides the ability to implement a WINS (Windows Internetworking Name Server)
60and implements extensions to Microsoft's implementation of WINS. These extensions
61help Samba to effect stable WINS operations beyond the normal scope of MS WINS.
62</p><p>
63<a class="indexterm" name="id2579655"></a>
64<a class="indexterm" name="id2579662"></a>
65<a class="indexterm" name="id2579669"></a>
66WINS is exclusively a service that applies only to those systems
67that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with
68support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.
69</p><p>
70<a class="indexterm" name="id2579683"></a>
71<a class="indexterm" name="id2579690"></a>
72<a class="indexterm" name="id2579696"></a>
73For those networks on which NetBIOS has been disabled (i.e., WINS is not required),
74the use of DNS is necessary for hostname resolution.
75</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2579708"></a>What Is Browsing?</h2></div></div></div><p>
76<a class="indexterm" name="id2579716"></a>
77<a class="indexterm" name="id2579722"></a>
78<a class="indexterm" name="id2579730"></a>
79<a class="indexterm" name="id2579736"></a>
80To most people, browsing means they can see the MS Windows and Samba servers
81in the Network Neighborhood, and when the computer icon for a particular server is
82clicked, it opens up and shows the shares and printers available on the target server.
83</p><p>
84What seems so simple is in fact a complex interaction of different technologies.
85The technologies (or methods) employed in making all of this work include:
86</p><div class="itemizedlist"><ul type="disc"><li><p>MS Windows machines register their presence to the network.</p></li><li><p>Machines announce themselves to other machines on the network.</p></li><li><p>One or more machines on the network collate the local announcements.</p></li><li><p>The client machine finds the machine that has the collated list of machines.</p></li><li><p>The client machine is able to resolve the machine names to IP addresses.</p></li><li><p>The client machine is able to connect to a target machine.</p></li></ul></div><p>
87<a class="indexterm" name="id2579793"></a>
88<a class="indexterm" name="id2579800"></a>
89<a class="indexterm" name="id2579807"></a>
90The Samba application that controls browse list management and name resolution is
91called <code class="filename">nmbd</code>. The configuration parameters involved in nmbd's operation are:
92</p><p>
93Browsing options:
94</p><div class="itemizedlist"><ul type="disc"><li><a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a></li><li><a class="link" href="smb.conf.5.html#LMANNOUNCE" target="_top">lm announce</a></li><li><a class="link" href="smb.conf.5.html#LMINTERVAL" target="_top">lm interval</a></li><li><a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a>(*)</li><li><a class="link" href="smb.conf.5.html#LOCALMASTER" target="_top">local master</a>(*)</li><li><a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master</a>(*)</li><li><a class="link" href="smb.conf.5.html#BROWSELIST" target="_top">browse list</a></li><li><a class="link" href="smb.conf.5.html#ENHANCEDBROWSING" target="_top">enhanced browsing</a></li></ul></div><p>
95Name Resolution Method:
96</p><div class="itemizedlist"><ul type="disc"><li><a class="link" href="smb.conf.5.html#NAMERESOLVEORDER" target="_top">name resolve order</a>(*)</li></ul></div><p>
97WINS options:
98</p><div class="itemizedlist"><ul type="disc"><li><a class="link" href="smb.conf.5.html#DNSPROXY" target="_top">dns proxy</a></li><li><a class="link" href="smb.conf.5.html#WINSPROXY" target="_top">wins proxy</a></li><li><a class="link" href="smb.conf.5.html#WINSSERVER" target="_top">wins server</a>(*)</li><li><a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support</a>(*)</li><li><a class="link" href="smb.conf.5.html#WINSHOOK" target="_top">wins hook</a></li></ul></div><p>
99Those marked with an (*) are the only options that commonly may need to be modified. Even if none of these
100parameters is set, <code class="filename">nmbd</code> will still do its job.
101</p><p>
102<a class="indexterm" name="id2580046"></a>
103<a class="indexterm" name="id2580052"></a>
104<a class="indexterm" name="id2580059"></a>
105<a class="indexterm" name="id2580066"></a>
106<a class="indexterm" name="id2580073"></a>
107For Samba, the WINS Server and WINS Support are mutually exclusive options. When <code class="literal">nmbd</code> is
108started it will fail to execute if both options are set in the <code class="filename">smb.conf</code> file. The <code class="literal">nmbd</code>
109understands that when it spawns an instance of itself to run as a WINS server that it has to use its own WINS
110server also.
111</p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="netdiscuss"></a>Discussion</h2></div></div></div><p>
112<a class="indexterm" name="id2580115"></a>
113<a class="indexterm" name="id2580122"></a>
114<a class="indexterm" name="id2580129"></a>
115<a class="indexterm" name="id2580136"></a>
116All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS.
117MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing
118out NetBIOS support.
119</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580148"></a>NetBIOS over TCP/IP</h3></div></div></div><p>
120<a class="indexterm" name="id2580156"></a>
121<a class="indexterm" name="id2580163"></a>
122<a class="indexterm" name="id2580170"></a>
123<a class="indexterm" name="id2580176"></a>
124Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP.
125NetBIOS-based networking uses broadcast messaging to effect browse list management. When running NetBIOS over
126TCP/IP, this uses UDP-based messaging. UDP messages can be broadcast or unicast.
127</p><p>
128<a class="indexterm" name="id2580191"></a>
129Normally, only unicast UDP messaging can be forwarded by routers. The <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a>
130parameter to smb.conf helps to project browse announcements to remote network segments via unicast UDP.
131Similarly, the <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameter of <code class="filename">smb.conf</code> implements browse list
132collation using unicast UDP.
133</p><p>
134The methods used by MS Windows to perform name lookup requests (name resolution) is determined by a
135configuration parameter called the NetBIOS node-type. There are four basic NetBIOS node types:
136</p><a class="indexterm" name="id2580240"></a><a class="indexterm" name="id2580247"></a><a class="indexterm" name="id2580253"></a><a class="indexterm" name="id2580260"></a><a class="indexterm" name="id2580267"></a><a class="indexterm" name="id2580274"></a><a class="indexterm" name="id2580281"></a><a class="indexterm" name="id2580287"></a><div class="itemizedlist"><ul type="disc"><li><p><span class="emphasis"><em>b-node (type 0x01):</em></span> The Windows client will use only
137 NetBIOS broadcast requests using UDP broadcast.</p></li><li><p><span class="emphasis"><em>p-node (type 0x02):</em></span> The Windows client will use point-to-point
138 (NetBIOS unicast) requests using UDP unicast directed to a WINS server.</p></li><li><p><span class="emphasis"><em>m-node (type 0x04):</em></span> The Windows client will first use
139 NetBIOS broadcast requests using UDP broadcast, then it will use (NetBIOS unicast)
140 requests using UDP unicast directed to a WINS server.</p></li><li><p><span class="emphasis"><em>h-node (type 0x08):</em></span> The Windows client will use
141 (NetBIOS unicast) requests using UDP unicast directed to a WINS server, then it will use
142 NetBIOS broadcast requests using UDP broadcast.</p></li></ul></div><p>
143<a class="indexterm" name="id2580336"></a>
144<a class="indexterm" name="id2580343"></a>
145<a class="indexterm" name="id2580350"></a>
146<a class="indexterm" name="id2580357"></a>
147<a class="indexterm" name="id2580364"></a>
148<a class="indexterm" name="id2580371"></a>
149The default Windows network client (or server) network configuration enables NetBIOS over TCP/IP
150and b-node configuration. The use of WINS makes most sense with h-node (hybrid mode) operation so that
151in the event of a WINS breakdown or non-availability, the client can use broadcast-based name resolution.
152</p><p>
153<a class="indexterm" name="id2580386"></a>
154<a class="indexterm" name="id2580395"></a>
155<a class="indexterm" name="id2580402"></a>
156<a class="indexterm" name="id2580409"></a>
157<a class="indexterm" name="id2580416"></a>
158<a class="indexterm" name="id2580422"></a>
159<a class="indexterm" name="id2580430"></a>
160In those networks where Samba is the only SMB server technology, wherever possible <code class="filename">nmbd</code>
161should be configured on one machine as the WINS server. This makes it easy to manage the browsing environment.
162If each network segment is configured with its own Samba WINS server, then the only way to get cross-segment
163browsing to work is by using the <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> and the <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameters to your <code class="filename">smb.conf</code> file.
164</p><p>
165<a class="indexterm" name="id2580481"></a>
166If only one WINS server is used for an entire multisegment network, then
167the use of the <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> and the
168<a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameters should not be necessary.
169</p><p>
170<a class="indexterm" name="id2580515"></a>
171As of Samba-3, WINS replication is being worked on. The bulk of the code has been committed, but it still
172needs maturation. This is not a supported feature of the Samba-3.0.20 release. Hopefully, this will become a
173supported feature of one of the Samba-3 release series. The delay is caused by the fact that this feature has
174not been of sufficient significance to inspire someone to pay a developer to complete it.
175</p><p>
176<a class="indexterm" name="id2580534"></a>
177<a class="indexterm" name="id2580541"></a>
178<a class="indexterm" name="id2580548"></a>
179<a class="indexterm" name="id2580555"></a>
180<a class="indexterm" name="id2580561"></a>
181<a class="indexterm" name="id2580568"></a>
182<a class="indexterm" name="id2580575"></a>
183<a class="indexterm" name="id2580582"></a>
184Right now Samba WINS does not support MS-WINS replication. This means that when setting up Samba as a WINS
185server, there must only be one <code class="filename">nmbd</code> configured as a WINS server on the network. Some
186sites have used multiple Samba WINS servers for redundancy (one server per subnet) and then used
187<a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> and <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> to effect browse list
188collation across all segments. Note that this means clients will only resolve local names and must be
189configured to use DNS to resolve names on other subnets in order to resolve the IP addresses of the servers
190they can see on other subnets. This setup is not recommended but is mentioned as a practical consideration
191(i.e., an &#8220;<span class="quote">if all else fails</span>&#8221; scenario). NetBIOS over TCP/IP is an ugly and difficult to manage
192protocol. Its replacement, NetBIOSless SMB over TCP/IP is not without its own manageability concerns. NetBIOS
193based networking is a life of compromise and trade-offs. WINS stores information that cannot be stored in
194DNS; consequently, DNS is a poor substitute for WINS given that when NetBIOS over TCP/IP is used, Windows
195clients are designed to use WINS.
196</p><p>
197<a class="indexterm" name="id2580644"></a>
198<a class="indexterm" name="id2580650"></a>
199<a class="indexterm" name="id2580657"></a>
200Lastly, take note that browse lists are a collection of unreliable broadcast
201messages that are repeated at intervals of not more than 15 minutes. This means
202that it will take time to establish a browse list, and it can take up to 45
203minutes to stabilize, particularly across network segments.
204</p><p>
205<a class="indexterm" name="id2580672"></a>
206When an MS Windows 200x/XP system attempts to resolve a host name to an IP address, it follows a defined path:
207</p><div class="orderedlist"><ol type="1"><li><p>
208 Checks the <code class="filename">hosts</code> file. It is located in <code class="filename">%SystemRoot%\System32\Drivers\etc</code>.
209 </p></li><li><p>
210 Does a DNS lookup.
211 </p></li><li><p>
212 Checks the NetBIOS name cache.
213 </p></li><li><p>
214 Queries the WINS server.
215 </p></li><li><p>
216 Does a broadcast name lookup over UDP.
217 </p></li><li><p>
218 Looks up entries in LMHOSTS, located in <code class="filename">%SystemRoot%\System32\Drivers\etc</code>.
219 </p></li></ol></div><p>
220<a class="indexterm" name="id2580740"></a>
221<a class="indexterm" name="id2580746"></a>
222<a class="indexterm" name="id2580753"></a>
223<a class="indexterm" name="id2580760"></a>
224Given the nature of how the NetBIOS over TCP/IP protocol is implemented, only WINS is capable of resolving
225with any reliability name lookups for service-oriented names such as TEMPTATION&lt;1C&gt; a NetBIOS
226name query that seeks to find network logon servers. DNS has no concept of service-oriented names such as
227this. In fact, the Microsoft ADS implementation specifically manages a whole range of extended
228service-oriented DNS entries. This type of facility is not implemented and is not supported for the NetBIOS
229over TCP/IP protocol namespace.
230</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2580784"></a>TCP/IP without NetBIOS</h3></div></div></div><p>
231<a class="indexterm" name="id2580792"></a>
232<a class="indexterm" name="id2580799"></a>
233<a class="indexterm" name="id2580806"></a>
234All TCP/IP-enabled systems use various forms of hostname resolution. The primary
235methods for TCP/IP hostname resolution involve either a static file (<code class="filename">/etc/hosts</code>)
236or the Domain Name System (DNS). DNS is the technology that makes
237the Internet usable. DNS-based hostname resolution is supported by nearly all
238TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS.
239</p><p>
240<a class="indexterm" name="id2580828"></a>
241<a class="indexterm" name="id2580834"></a>
242<a class="indexterm" name="id2580841"></a>
243<a class="indexterm" name="id2580848"></a>
244Windows 200x/XP can register its hostname with a Dynamic DNS server (DDNS). It is possible to force register with a
245dynamic DNS server in Windows 200x/XP using <code class="literal">ipconfig /registerdns</code>.
246</p><p>
247<a class="indexterm" name="id2580869"></a>
248<a class="indexterm" name="id2580875"></a>
249<a class="indexterm" name="id2580882"></a>
250With Active Directory, a correctly functioning DNS server is absolutely essential. In the absence of a working
251DNS server that has been correctly configured, MS Windows clients and servers will be unable to locate each
252other, so network services consequently will be severely impaired.
253</p><p>
254<a class="indexterm" name="id2580897"></a>
255<a class="indexterm" name="id2580904"></a>
256<a class="indexterm" name="id2580911"></a>
257<a class="indexterm" name="id2580918"></a>
258<a class="indexterm" name="id2580925"></a>
259<a class="indexterm" name="id2580931"></a>
260Use of raw SMB over TCP/IP (No NetBIOS layer) can be done only with Active Directory domains. Samba is not an
261Active Directory domain controller: ergo, it is not possible to run Samba as a domain controller and at the same
262time <span class="emphasis"><em>not</em></span> use NetBIOS. Where Samba is used as an Active Directory domain member server
263(DMS) it is possible to configure Samba to not use NetBIOS over TCP/IP. A Samba DMS can integrate fully into
264an Active Directory domain, however, if NetBIOS over TCP/IP is disabled, it is necessary to manually create
265appropriate DNS entries for the Samba DMS because they will not be automatically generated either by Samba, or
266by the ADS environment.
267</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adsdnstech"></a>DNS and Active Directory</h3></div></div></div><p>
268<a class="indexterm" name="id2580966"></a>
269<a class="indexterm" name="id2580975"></a>
270<a class="indexterm" name="id2580982"></a>
271<a class="indexterm" name="id2580988"></a>
272<a class="indexterm" name="id2580995"></a>
273Occasionally we hear from UNIX network administrators who want to use a UNIX-based DDNS server in place
274of the Microsoft DNS server. While this might be desirable to some, the MS Windows 200x DNS server is
275autoconfigured to work with Active Directory. It is possible to use BIND version 8 or 9, but it will almost
276certainly be necessary to create service records (SRV records) so MS Active Directory clients can resolve
277hostnames to locate essential network services. The following are some of the default service records that
278Active Directory requires:
279</p><p>
280<a class="indexterm" name="id2581017"></a>
281<a class="indexterm" name="id2581024"></a>
282<a class="indexterm" name="id2581030"></a>
283The use of DDNS is highly recommended with Active Directory, in which case the use of BIND9 is preferred for
284its ability to adequately support the SRV (service) records that are needed for Active Directory. Of course,
285when running ADS, it makes sense to use Microsoft's own DDNS server because of the natural affinity between ADS
286and MS DNS.
287</p><div class="variablelist"><dl><dt><span class="term">_ldap._tcp.pdc._msdcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
288 This provides the address of the Windows NT PDC for the domain.
289 </p></dd><dt><span class="term">_ldap._tcp.pdc._msdcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
290 Resolves the addresses of global catalog servers in the domain.
291 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>site</em></span>.sites.writable._msdcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
292 Provides list of domain controllers based on sites.
293 </p></dd><dt><span class="term">_ldap._tcp.writable._msdcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
294 Enumerates list of domain controllers that have the writable copies of the Active Directory data store.
295 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>GUID</em></span>.domains._msdcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
296 Entry used by MS Windows clients to locate machines using the global unique identifier.
297 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>Site</em></span>.gc._msdcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
298 Used by Microsoft Windows clients to locate the site configuration-dependent global catalog server.
299 </p></dd></dl></div><p>
300 Specific entries used by Microsoft clients to locate essential services for an example domain
301 called <code class="constant">quenya.org</code> include:
302 </p><div class="itemizedlist"><ul type="disc"><li><p>
303 _kerberos._udp.quenya.org Used to contact the KDC server via UDP.
304 This entry must list port 88 for each KDC.
305 </p></li><li><p>
306 _kpasswd._udp.quenya.org Used to locate the <code class="constant">kpasswd</code> server
307 when a user password change must be processed. This record must list port 464 on the
308 master KDC.
309 </p></li><li><p>
310 _kerberos._tcp.quenya.org Used to locate the KDC server via TCP.
311 This entry must list port 88 for each KDC.
312 </p></li><li><p>
313 _ldap._tcp.quenya.org Used to locate the LDAP service on the PDC.
314 This record must list port 389 for the PDC.
315 </p></li><li><p>
316 _kpasswd._tcp.quenya.org Used to locate the <code class="constant">kpasswd</code> server
317 to permit user password changes to be processed. This must list port 464.
318 </p></li><li><p>
319 _gc._tcp.quenya.org Used to locate the global catalog server for the
320 top of the domain. This must list port 3268.
321 </p></li></ul></div><p>
322 The following records are also used by the Windows domain member client to locate vital
323 services on the Windows ADS domain controllers.
324 </p><div class="itemizedlist"><ul type="disc"><li><p>
325 _ldap._tcp.pdc._msdcs.quenya.org
326 </p></li><li><p>
327 _ldap.gc._msdcs.quenya.org
328 </p></li><li><p>
329 _ldap.default-first-site-name._sites.gc._msdcs.quenya.org
330 </p></li><li><p>
331 _ldap.{SecID}.domains._msdcs.quenya.org
332 </p></li><li><p>
333 _ldap._tcp.dc._msdcs.quenya.org
334 </p></li><li><p>
335 _kerberos._tcp.dc._msdcs.quenya.org
336 </p></li><li><p>
337 _ldap.default-first-site-name._sites.dc._msdcs.quenya.org
338 </p></li><li><p>
339 _kerberos.default-first-site-name._sites.dc._msdcs.queyna.org
340 </p></li><li><p>
341 SecID._msdcs.quenya.org
342 </p></li></ul></div><p>
343 Presence of the correct DNS entries can be validated by executing:
344</p><pre class="screen">
345<code class="prompt">root# </code> dig @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
346
347; &lt;lt;&gt;&gt; DiG 9.2.2 &lt;lt;&gt;&gt; @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
348;; global options: printcmd
349;; Got answer:
350;; -&gt;&gt;HEADER&lt;&lt;- opcode: QUERY, status: NOERROR, id: 3072
351;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2
352
353
354;; QUESTION SECTION:
355;_ldap._tcp.dc._msdcs.quenya.org. IN ANY
356
357
358;; ANSWER SECTION:
359_ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 frodo.quenya.org.
360_ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 noldor.quenya.org.
361
362
363;; ADDITIONAL SECTION:
364frodo.quenya.org. 3600 IN A 10.1.1.16
365noldor.quenya.org. 1200 IN A 10.1.1.17
366
367
368;; Query time: 0 msec
369;; SERVER: frodo#53(10.1.1.16)
370;; WHEN: Wed Oct 7 14:39:31 2004
371;; MSG SIZE rcvd: 171
372</pre><p>
373 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2581343"></a>How Browsing Functions</h2></div></div></div><p>
374<a class="indexterm" name="id2581351"></a>
375<a class="indexterm" name="id2581358"></a>
376<a class="indexterm" name="id2581365"></a>
377<a class="indexterm" name="id2581372"></a>
378<a class="indexterm" name="id2581378"></a>
379MS Windows machines register their NetBIOS names (i.e., the machine name for each service type in operation)
380on startup. The exact method by which this name registration takes place is determined by whether or not the
381MS Windows client/server has been given a WINS server address, whether or not LMHOSTS lookup is enabled,
382whether or not DNS for NetBIOS name resolution is enabled, and so on.
383</p><p>
384<a class="indexterm" name="id2581395"></a>
385<a class="indexterm" name="id2581402"></a>
386<a class="indexterm" name="id2581409"></a>
387In the case where there is no WINS server, all name registrations as well as name lookups are done by UDP
388broadcast. This isolates name resolution to the local subnet, unless LMHOSTS is used to list all names and IP
389addresses. In such situations, Samba provides a means by which the Samba server name may be forcibly injected
390into the browse list of a remote MS Windows network (using the <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a>
391parameter).
392</p><p>
393<a class="indexterm" name="id2581438"></a>
394<a class="indexterm" name="id2581445"></a>
395<a class="indexterm" name="id2581451"></a>
396Where a WINS server is used, the MS Windows client will use UDP unicast to register with the WINS server. Such
397packets can be routed, and thus WINS allows name resolution to function across routed networks.
398</p><p>
399<a class="indexterm" name="id2581465"></a>
400<a class="indexterm" name="id2581471"></a>
401<a class="indexterm" name="id2581480"></a>
402<a class="indexterm" name="id2581487"></a>
403<a class="indexterm" name="id2581494"></a>
404<a class="indexterm" name="id2581501"></a>
405<a class="indexterm" name="id2581507"></a>
406<a class="indexterm" name="id2581514"></a>
407During the startup process, an election takes place to create a local master browser (LMB) if one does not
408already exist. On each NetBIOS network one machine will be elected to function as the domain master browser
409(DMB). This domain browsing has nothing to do with MS security Domain Control. Instead, the DMB serves the
410role of contacting each LMB (found by asking WINS or from LMHOSTS) and exchanging browse list contents. This
411way every master browser will eventually obtain a complete list of all machines that are on the network. Every
41211 to 15 minutes an election is held to determine which machine will be the master browser. By the nature of
413the election criteria used, the machine with the highest uptime, or the most senior protocol version or other
414criteria, will win the election as DMB.
415</p><p>
416<a class="indexterm" name="id2581551"></a>
417<a class="indexterm" name="id2581558"></a>
418<a class="indexterm" name="id2581565"></a>
419<a class="indexterm" name="id2581572"></a>
420<a class="indexterm" name="id2581578"></a>
421<a class="indexterm" name="id2581585"></a>
422<a class="indexterm" name="id2581592"></a>
423<a class="indexterm" name="id2581599"></a>
424Where a WINS server is used, the DMB registers its IP address with the WINS server using the name of the
425domain and the NetBIOS name type 1B (e.g., DOMAIN&lt;1B&gt;). All LMBs register their IP addresses with the WINS
426server, also with the name of the domain and the NetBIOS name type of 1D. The 1B name is unique to one
427server within the domain security context, and only one 1D name is registered for each network segment.
428Machines that have registered the 1D name will be authoritive browse list maintainers for the network segment
429they are on. The DMB is responsible for synchronizing the browse lists it obtains from the LMBs.
430</p><p>
431<a class="indexterm" name="id2581635"></a>
432Clients wishing to browse the network make use of this list but also depend on the availability of correct
433name resolution to the respective IP address or addresses.
434</p><p>
435<a class="indexterm" name="id2581648"></a>
436Any configuration that breaks name resolution and/or browsing intrinsics will annoy users because they will
437have to put up with protracted inability to use the network services.
438</p><p>
439<a class="indexterm" name="id2581661"></a>
440<a class="indexterm" name="id2581668"></a>
441<a class="indexterm" name="id2581675"></a>
442<a class="indexterm" name="id2581682"></a>
443<a class="indexterm" name="id2581689"></a>
444<a class="indexterm" name="id2581696"></a>
445Samba supports a feature that allows forced synchronization of browse lists across routed networks using the
446<a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameter in the <code class="filename">smb.conf</code> file. This causes Samba to contact the
447LMB on a remote network and to request browse list synchronization. This effectively bridges two networks that
448are separated by routers. The two remote networks may use either broadcast-based name resolution or WINS-based
449name resolution, but it should be noted that the <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameter provides
450browse list synchronization and that is distinct from name-to-address resolution. In other words,
451for cross-subnet browsing to function correctly, it is essential that a name-to-address resolution mechanism
452be provided. This mechanism could be via DNS, <code class="filename">/etc/hosts</code>, and so on.
453</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="DMB"></a>Configuring Workgroup Browsing</h3></div></div></div><p>
454<a class="indexterm" name="id2581765"></a>
455<a class="indexterm" name="id2581771"></a>
456<a class="indexterm" name="id2581778"></a>
457<a class="indexterm" name="id2581784"></a>
458<a class="indexterm" name="id2581791"></a>
459<a class="indexterm" name="id2581798"></a>
460To configure cross-subnet browsing on a network containing machines in a workgroup, not an NT domain, you need
461to set up one Samba server to be the DMB (note that this is not the same as a Primary Domain Controller,
462although in an NT domain the same machine plays both roles). The role of a DMB is to collate the browse lists
463from LMB on all the subnets that have a machine participating in the workgroup. Without one machine configured
464as a DMB, each subnet would be an isolated workgroup unable to see any machines on another subnet. It is the
465presence of a DMB that makes cross-subnet browsing possible for a workgroup.
466</p><p>
467<a class="indexterm" name="id2581818"></a>
468In a workgroup environment the DMB must be a Samba server, and there must only be one DMB per workgroup name.
469To set up a Samba server as a DMB, set the following option in the <em class="parameter"><code>[global]</code></em> section
470of the <code class="filename">smb.conf</code> file:
471</p><p>
472</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2581848"></a><em class="parameter"><code>domain master = yes</code></em></td></tr></table><p>
473</p><p>
474<a class="indexterm" name="id2581863"></a>
475<a class="indexterm" name="id2581870"></a>
476The DMB should preferably be the LMB for its own subnet. In order to achieve this, set the following options
477in the <em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> file as shown in <a class="link" href="NetworkBrowsing.html#dmbexample" title="Example 10.1. Domain Master Browser smb.conf">Domain Master Browser smb.conf</a>
478</p><div class="example"><a name="dmbexample"></a><p class="title"><b>Example 10.1. Domain Master Browser smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2581924"></a><em class="parameter"><code>domain master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581936"></a><em class="parameter"><code>local master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581948"></a><em class="parameter"><code>preferred master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2581959"></a><em class="parameter"><code>os level = 65</code></em></td></tr></table></div></div><br class="example-break"><p>
479<a class="indexterm" name="id2581974"></a>
480<a class="indexterm" name="id2581981"></a>
481The DMB may be the same machine as the WINS server, if necessary.
482</p><p>
483<a class="indexterm" name="id2581992"></a>
484<a class="indexterm" name="id2581999"></a>
485<a class="indexterm" name="id2582005"></a>
486Next, you should ensure that each of the subnets contains a machine that can act as an LMB for the workgroup.
487Any MS Windows NT/200x/XP machine should be able to do this, as will Windows 9x/Me machines (although these
488tend to get rebooted more often, so it is not such a good idea to use them). To make a Samba server an LMB,
489set the following options in the <em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> file as shown in
490<a class="link" href="NetworkBrowsing.html#lmbexample" title="Example 10.2. Local master browser smb.conf">Local master browser smb.conf</a>
491</p><div class="example"><a name="lmbexample"></a><p class="title"><b>Example 10.2. Local master browser smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2582063"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2582075"></a><em class="parameter"><code>local master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582086"></a><em class="parameter"><code>preferred master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582098"></a><em class="parameter"><code>os level = 65</code></em></td></tr></table></div></div><br class="example-break"><p>
492<a class="indexterm" name="id2582113"></a>
493Do not do this for more than one Samba server on each subnet, or they will war with
494each other over which is to be the LMB.
495</p><p>
496<a class="indexterm" name="id2582125"></a>
497<a class="indexterm" name="id2582132"></a>
498The <a class="link" href="smb.conf.5.html#LOCALMASTER" target="_top">local master</a> parameter allows Samba to act as a
499LMB. The <a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a> causes <code class="literal">nmbd</code>
500to force a browser election on startup and the <a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a>
501parameter sets Samba high enough so it should win any browser elections.
502</p><p>
503<a class="indexterm" name="id2582185"></a>
504If you have an NT machine on the subnet that you wish to be the LMB, you can disable Samba from
505becoming an LMB by setting the following options in the <em class="parameter"><code>[global]</code></em> section of the
506<code class="filename">smb.conf</code> file as shown in <a class="link" href="NetworkBrowsing.html#nombexample" title="Example 10.3. smb.conf for Not Being a Master Browser">smb.conf for Not Being a Master Browser</a>.
507</p><p>
508</p><div class="example"><a name="nombexample"></a><p class="title"><b>Example 10.3. smb.conf for Not Being a Master Browser</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2582240"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2582252"></a><em class="parameter"><code>local master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2582264"></a><em class="parameter"><code>preferred master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2582276"></a><em class="parameter"><code>os level = 0</code></em></td></tr></table></div></div><p><br class="example-break">
509</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582290"></a>Domain Browsing Configuration</h3></div></div></div><p>
510<a class="indexterm" name="id2582298"></a>
511<a class="indexterm" name="id2582305"></a>
512<a class="indexterm" name="id2582312"></a>
513<a class="indexterm" name="id2582318"></a>
514If you are adding Samba servers to a Windows NT domain, then you must not set up a Samba server as a DMB. By
515default, a Windows NT PDC for a domain is also the DMB for that domain. Network browsing may break if a Samba
516server other than the PDC registers the DMB NetBIOS name (<em class="replaceable"><code>DOMAIN</code></em>&lt;1B&gt;) with
517WINS.
518</p><p>
519<a class="indexterm" name="id2582337"></a>
520For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as LMBs as
521described. To make a Samba server a Local Master Browser, set the following options in the <em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> file as shown in <a class="link" href="NetworkBrowsing.html#remsmb" title="Example 10.4. Local Master Browser smb.conf">Local Master Browser
522smb.conf</a>
523</p><div class="example"><a name="remsmb"></a><p class="title"><b>Example 10.4. Local Master Browser smb.conf</b></p><div class="example-contents"><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><em class="parameter"><code>[global]</code></em></td></tr><tr><td><a class="indexterm" name="id2582393"></a><em class="parameter"><code>domain master = no</code></em></td></tr><tr><td><a class="indexterm" name="id2582405"></a><em class="parameter"><code>local master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582417"></a><em class="parameter"><code>preferred master = yes</code></em></td></tr><tr><td><a class="indexterm" name="id2582428"></a><em class="parameter"><code>os level = 65</code></em></td></tr></table></div></div><br class="example-break"><p>
524<a class="indexterm" name="id2582443"></a>
525<a class="indexterm" name="id2582450"></a>
526If you wish to have a Samba server fight the election with machines on the same subnet, you may set the
527<a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a> parameter to lower levels. By doing this you can tune the order of machines
528that will become LMBs if they are running. For more details on this, refer to <a class="link" href="NetworkBrowsing.html#browse-force-master" title="Forcing Samba to Be the Master">Forcing Samba to Be the Master</a>.
529</p><p>
530<a class="indexterm" name="id2582485"></a>
531<a class="indexterm" name="id2582491"></a>
532<a class="indexterm" name="id2582498"></a>
533If you have Windows NT machines that are members of the domain on all subnets and you are sure they will
534always be running, you can disable Samba from taking part in browser elections and ever becoming an LMB by
535setting the following options in the <em class="parameter"><code>[global]</code></em> section of the <code class="filename">smb.conf</code> file as shown
536in <a class="link" href="NetworkBrowsing.html#xremmb" title="Example 10.5. smb.conf for Not Being a master browser"><code class="filename">smb.conf</code> for Not Being a master browser</a>
537</p><p>
538</p><div class="example"><a name="xremmb"></a><p class="title"><b>Example 10.5. <code class="filename">smb.conf</code> for Not Being a master browser</b></p><div class="example-contents"><em class="parameter"><code>[global]</code></em><a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = no</a><a class="link" href="smb.conf.5.html#LOCALMASTER" target="_top">local master = no</a><a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master = no</a><a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level = 0</a></div></div><p><br class="example-break">
539</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="browse-force-master"></a>Forcing Samba to Be the Master</h3></div></div></div><p>
540<a class="indexterm" name="id2582616"></a>
541<a class="indexterm" name="id2582622"></a>
542<a class="indexterm" name="id2582629"></a>
543<a class="indexterm" name="id2582636"></a>
544<a class="indexterm" name="id2582643"></a>
545<a class="indexterm" name="id2582649"></a>
546<a class="indexterm" name="id2582656"></a>
547Who becomes the master browser is determined by an election process using broadcasts. Each election packet
548contains a number of parameters that determine what precedence (bias) a host should have in the election. By
549default Samba uses a low precedence and thus loses elections to just about every Windows network server or
550client.
551</p><p>
552If you want Samba to win elections, set the <a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a> global option in <code class="filename">smb.conf</code> to a
553higher number. It defaults to 20. Using 34 would make it win all elections over every other system (except
554other Samba systems).
555</p><p>
556An <a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a> of two would make it beat Windows for Workgroups and Windows 9x/Me, but
557not MS Windows NT/200x Server. An MS Windows NT/200x Server domain controller uses level 32. The maximum os
558level is 255.
559</p><p>
560<a class="indexterm" name="id2582713"></a>
561<a class="indexterm" name="id2582720"></a>
562<a class="indexterm" name="id2582727"></a>
563<a class="indexterm" name="id2582734"></a>
564If you want Samba to force an election on startup, set the <a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a> global
565option in <code class="filename">smb.conf</code> to <code class="constant">yes</code>. Samba will then have a slight advantage over other
566potential master browsers that are not preferred master browsers. Use this parameter with care, because if
567you have two hosts (whether they are Windows 9x/Me or NT/200x/XP or Samba) on the same local subnet both set
568with <a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a> to <code class="constant">yes</code>, then periodically and continually
569they will force an election in order to become the LMB.
570</p><p>
571<a class="indexterm" name="id2582787"></a>
572<a class="indexterm" name="id2582793"></a>
573<a class="indexterm" name="id2582800"></a>
574<a class="indexterm" name="id2582807"></a>
575<a class="indexterm" name="id2582814"></a>
576If you want Samba to be a <span class="emphasis"><em>DMB</em></span>, then it is recommended that you also set <a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a> to <code class="constant">yes</code>, because Samba will not become a DMB for the whole of
577your LAN or WAN if it is not also a LMB on its own broadcast isolated subnet.
578</p><p>
579<a class="indexterm" name="id2582846"></a>
580<a class="indexterm" name="id2582852"></a>
581<a class="indexterm" name="id2582859"></a>
582<a class="indexterm" name="id2582866"></a>
583<a class="indexterm" name="id2582872"></a>
584It is possible to configure two Samba servers to attempt to become the DMB for a domain. The first server that
585comes up will be the DMB. All other Samba servers will attempt to become the DMB every 5 minutes. They will
586find that another Samba server is already the DMB and will fail. This provides automatic redundancy should the
587current DMB fail. The network bandwidth overhead of browser elections is relatively small, requiring
588approximately four UDP packets per machine per election. The maximum size of a UDP packet is 576 bytes.
589</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2582891"></a>Making Samba the Domain Master</h3></div></div></div><p>
590<a class="indexterm" name="id2582898"></a>
591<a class="indexterm" name="id2582905"></a>
592<a class="indexterm" name="id2582911"></a>
593<a class="indexterm" name="id2582918"></a>
594The domain master browser is responsible for collating the browse lists of multiple subnets so browsing can
595occur between subnets. You can make Samba act as the domain master browser by setting <a class="link" href="smb.conf.5.html#DOMAINMASTER" target="_top">domain master = yes</a> in <code class="filename">smb.conf</code>. By default it will not be a domain master browser.
596</p><p>
597<a class="indexterm" name="id2582951"></a>
598<a class="indexterm" name="id2582958"></a>
599Do not set Samba to be the domain master for a workgroup that has the same name as an NT/200x domain. If
600Samba is configured to be the domain master for a workgroup that is present on the same network as a Windows
601NT/200x domain that has the same name, network browsing problems will certainly be experienced.
602</p><p>
603When Samba is the domain master and the master browser, it will listen for master announcements (made roughly
604every 12 minutes) from LMBs on other subnets and then contact them to synchronize browse lists.
605</p><p>
606<a class="indexterm" name="id2582980"></a>
607<a class="indexterm" name="id2582987"></a>
608If you want Samba to be the domain master, you should also set the <a class="link" href="smb.conf.5.html#OSLEVEL" target="_top">os level</a> high
609enough to make sure it wins elections, and set <a class="link" href="smb.conf.5.html#PREFERREDMASTER" target="_top">preferred master</a> to
610<code class="constant">yes</code>, to get Samba to force an election on startup.
611</p><p>
612<a class="indexterm" name="id2583026"></a>
613<a class="indexterm" name="id2583032"></a>
614All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your
615clients are only using broadcasting to resolve NetBIOS names, then two things will occur:
616</p><div class="orderedlist"><ol type="1"><li><p>
617<a class="indexterm" name="id2583055"></a>
618<a class="indexterm" name="id2583062"></a>
619 LMBs will be unable to find a DMB because they will be looking only on the local subnet.
620 </p></li><li><p>
621<a class="indexterm" name="id2583076"></a>
622 If a client happens to get hold of a domain-wide browse list and a user attempts to access a
623 host in that list, it will be unable to resolve the NetBIOS name of that host.
624 </p></li></ol></div><p>
625<a class="indexterm" name="id2583092"></a>
626If, however, both Samba and your clients are using a WINS server, then:
627</p><div class="orderedlist"><ol type="1"><li><p>
628 LMBs will contact the WINS server and, as long as Samba has registered that it is a DMB with the WINS
629 server, the LMB will receive Samba's IP address as its DMB.
630 </p></li><li><p>
631 When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will
632 contact the WINS server to resolve the NetBIOS name of that host. As long as that host has registered its
633 NetBIOS name with the same WINS server, the user will be able to see that host..
634 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583131"></a>Note about Broadcast Addresses</h3></div></div></div><p>
635<a class="indexterm" name="id2583139"></a>
636If your network uses a zero-based broadcast address (for example, if it ends in a 0), then you will strike
637problems. Windows for Workgroups does not seem to support a zeros broadcast, and you will probably find that
638browsing and name lookups will not work.
639</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583152"></a>Multiple Interfaces</h3></div></div></div><p>
640<a class="indexterm" name="id2583160"></a>
641Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will
642need to use the <a class="link" href="smb.conf.5.html#INTERFACES" target="_top">interfaces</a> option in <code class="filename">smb.conf</code> to configure them. For example, the
643machine you are working with has 4 network interfaces; <code class="literal">eth0</code>, <code class="literal">eth1</code>,
644<code class="literal">eth2</code>, <code class="literal">eth3</code> and only interfaces <code class="literal">eth1</code> and
645<code class="literal">eth4</code> should be used by Samba. In this case, the following <code class="filename">smb.conf</code> file entries would
646permit that intent:
647</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2583237"></a><em class="parameter"><code>interfaces = eth1, eth4</code></em></td></tr><tr><td><a class="indexterm" name="id2583248"></a><em class="parameter"><code>bind interfaces only = Yes</code></em></td></tr></table><p>
648<a class="indexterm" name="id2583260"></a>
649<a class="indexterm" name="id2583267"></a>
650<a class="indexterm" name="id2583274"></a>
651<a class="indexterm" name="id2583281"></a>
652<a class="indexterm" name="id2583288"></a>
653<a class="indexterm" name="id2583294"></a>
654<a class="indexterm" name="id2583301"></a>
655The <a class="link" href="smb.conf.5.html#BINDINTERFACESONLY" target="_top">bind interfaces only = Yes</a> is necessary to exclude TCP/IP session
656services (ports 135, 139, and 445) over the interfaces that are not specified. Please be aware that
657<code class="literal">nmbd</code> will listen for incoming UDP port 137 packets on the unlisted interfaces, but it will
658not answer them. It will, however, send its broadcast packets over the unlisted interfaces. Total isolation of
659ethernet interface requires the use of a firewall to block ports 137 and 138 (UDP), and ports 135, 139, and
660445 (TCP) on all network interfaces that must not be able to access the Samba server.
661</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583338"></a>Use of the Remote Announce Parameter</h3></div></div></div><p>
662The <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> parameter of <code class="filename">smb.conf</code> can be used to forcibly ensure that all
663the NetBIOS names on a network get announced to a remote network. The syntax of the <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> parameter is:
664</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2583384"></a><em class="parameter"><code>remote announce = 192.168.12.23 [172.16.21.255] ...</code></em></td></tr></table><p>
665<span class="emphasis"><em>or</em></span>
666</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2583404"></a><em class="parameter"><code>remote announce = 192.168.12.23/MIDEARTH [172.16.21.255/ELVINDORF] ...</code></em></td></tr></table><p>
667
668where:
669</p><div class="variablelist"><dl><dt><span class="term"><em class="replaceable"><code>192.168.12.23</code></em> and <em class="replaceable"><code>172.16.21.255</code></em></span></dt><dd><p>
670<a class="indexterm" name="id2583432"></a>
671<a class="indexterm" name="id2583441"></a>
672 is either the LMB IP address or the broadcast address of the remote network.
673 That is, the LMB is at 192.168.1.23, or the address could be given as 172.16.21.255 where the netmask
674 is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast
675 address of the remote network, every host will receive our announcements. This is noisy and therefore
676 undesirable but may be necessary if we do not know the IP address of the remote LMB.
677 </p></dd><dt><span class="term"><em class="replaceable"><code>WORKGROUP</code></em></span></dt><dd><p>is optional and can be either our own workgroup or that of the remote network. If you use the
678 workgroup name of the remote network, our NetBIOS machine names will end up looking like
679 they belong to that workgroup. This may cause name resolution problems and should be avoided.
680 </p></dd></dl></div><p>
681</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583478"></a>Use of the Remote Browse Sync Parameter</h3></div></div></div><p>
682<a class="indexterm" name="id2583486"></a>
683<a class="indexterm" name="id2583492"></a>
684The <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameter of <code class="filename">smb.conf</code> is used to announce to another LMB that
685it must synchronize its NetBIOS name list with our Samba LMB. This works only if the Samba server that has
686this option is simultaneously the LMB on its network segment.
687</p><p>
688The syntax of the <a class="link" href="smb.conf.5.html#REMOTEBROWSESYNC" target="_top">remote browse sync</a> parameter is:
689
690</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2583542"></a></td></tr></table><p>
691<a class="indexterm" name="id2583549"></a>
692<a class="indexterm" name="id2583555"></a>
693where <em class="replaceable"><code>192.168.10.40</code></em> is either the IP address of the
694remote LMB or the network broadcast address of the remote segment.
695</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2583571"></a>WINS: The Windows Internetworking Name Server</h2></div></div></div><p>
696<a class="indexterm" name="id2583580"></a>
697<a class="indexterm" name="id2583586"></a>
698<a class="indexterm" name="id2583593"></a>
699Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly
700recommended. Every NetBIOS machine registers its name together with a
701name_type value for each of several types of service it has available.
702It registers its name directly as a unique (the type 0x03) name.
703It also registers its name if it is running the LanManager-compatible
704server service (used to make shares and printers available to other users)
705by registering the server (the type 0x20) name.
706</p><p>
707<a class="indexterm" name="id2583612"></a>
708<a class="indexterm" name="id2583618"></a>
709All NetBIOS names are up to 15 characters in length. The name_type variable
710is added to the end of the name, thus creating a 16 character name. Any
711name that is shorter than 15 characters is padded with spaces to the 15th
712character. Thus, all NetBIOS names are 16 characters long (including the
713name_type information).
714</p><p>
715<a class="indexterm" name="id2583634"></a>
716<a class="indexterm" name="id2583641"></a>
717<a class="indexterm" name="id2583648"></a>
718<a class="indexterm" name="id2583654"></a>
719WINS can store these 16-character names as they get registered. A client
720that wants to log onto the network can ask the WINS server for a list
721of all names that have registered the NetLogon service name_type. This saves
722broadcast traffic and greatly expedites logon processing. Since broadcast
723name resolution cannot be used across network segments, this type of
724information can only be provided via WINS or via a statically configured
725<code class="filename">lmhosts</code> file that must reside on all clients in the
726absence of WINS.
727</p><p>
728<a class="indexterm" name="id2583679"></a>
729<a class="indexterm" name="id2583686"></a>
730<a class="indexterm" name="id2583692"></a>
731<a class="indexterm" name="id2583699"></a>
732<a class="indexterm" name="id2583706"></a>
733WINS also forces browse list synchronization by all LMBs. LMBs must synchronize their browse list with the
734DMB, and WINS helps the LMB to identify its DMB. By definition this will work only within a single workgroup.
735Note that the DMB has nothing to do with what is referred to as an MS Windows NT domain. The latter is a
736reference to a security environment, while the DMB refers to the master controller for browse list information
737only.
738</p><p>
739<a class="indexterm" name="id2583723"></a>
740<a class="indexterm" name="id2583730"></a>
741<a class="indexterm" name="id2583737"></a>
742<a class="indexterm" name="id2583744"></a>
743WINS will work correctly only if every client TCP/IP protocol stack
744is configured to use the WINS servers. Any client that is not
745configured to use the WINS server will continue to use only broadcast-based
746name registration, so WINS may never get to know about it. In any case,
747machines that have not registered with a WINS server will fail name-to-address
748lookup attempts by other clients and will therefore cause workstation access
749errors.
750</p><p>
751To configure Samba as a WINS server, just add
752<a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> to the <code class="filename">smb.conf</code>
753file [global] section.
754</p><p>
755To configure Samba to register with a WINS server, just add <a class="link" href="smb.conf.5.html#WINSSERVER" target="_top">wins server = 10.0.0.18</a> to your <code class="filename">smb.conf</code> file <em class="parameter"><code>[global]</code></em> section.
756</p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>
757Never use <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> together with <a class="link" href="smb.conf.5.html#WINSSERVER" target="_top">wins server = 10.0.0.18</a> particularly not using its own IP address. Specifying both will cause <span class="application">nmbd</span>
758to refuse to start!
759</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2583843"></a>WINS Server Configuration</h3></div></div></div><p>
760<a class="indexterm" name="id2583851"></a>
761Either a Samba server or a Windows NT server machine may be set up
762as a WINS server. To configure a Samba server to be a WINS server, you must
763add to the <code class="filename">smb.conf</code> file on the selected Server the following line to
764the <em class="parameter"><code>[global]</code></em> section:
765</p><p>
766</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2583882"></a><em class="parameter"><code>wins support = yes</code></em></td></tr></table><p>
767</p><p>
768<a class="indexterm" name="id2583897"></a>
769Versions of Samba prior to 1.9.17 had this parameter default to
770yes. If you have any older versions of Samba on your network, it is
771strongly suggested you upgrade to a recent version, or at the very
772least set the parameter to &#8220;<span class="quote">no</span>&#8221; on all these machines.
773</p><p>
774Machines configured with <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> will keep a list of
775all NetBIOS names registered with them, acting as a DNS for NetBIOS names.
776</p><p>
777<a class="indexterm" name="id2583931"></a>
778It is strongly recommended to set up only one WINS server. Do not set the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> option on more than one Samba server on a network.
779</p><p>
780<a class="indexterm" name="id2583955"></a>
781<a class="indexterm" name="id2583963"></a>
782<a class="indexterm" name="id2583970"></a>
783<a class="indexterm" name="id2583977"></a>
784<a class="indexterm" name="id2583984"></a>
785To configure Windows NT/200x Server as a WINS server, install and configure the WINS service. See the Windows
786NT/200x documentation for details. Windows NT/200x WINS servers can replicate to each other, allowing more
787than one to be set up in a complex subnet environment. Because Microsoft refuses to document the replication
788protocols, Samba cannot currently participate in these replications. It is possible that a Samba-to-Samba WINS
789replication protocol may be defined in the future, in which case more than one Samba machine could be set up
790as a WINS server. Currently only one Samba server should have the <a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> parameter set.
791</p><p>
792<a class="indexterm" name="id2584016"></a>
793<a class="indexterm" name="id2584023"></a>
794After the WINS server has been configured, you must ensure that all machines participating on the network are
795configured with the address of this WINS server. If your WINS server is a Samba machine, fill in the Samba
796machine IP address in the <span class="guilabel">Primary WINS Server</span> field of the <span class="guilabel">Control
797Panel-&gt;Network-&gt;Protocols-&gt;TCP-&gt;WINS Server</span> dialogs in Windows 9x/Me or Windows NT/200x. To tell a
798Samba server the IP address of the WINS server, add the following line to the <em class="parameter"><code>[global]</code></em> section of all <code class="filename">smb.conf</code> files:
799</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2584067"></a><em class="parameter"><code>wins server = &lt;name or IP address&gt;</code></em></td></tr></table><p>
800where &lt;name or IP address&gt; is either the DNS name of the WINS server
801machine or its IP address.
802</p><p>
803This line must not be set in the <code class="filename">smb.conf</code> file of the Samba
804server acting as the WINS server itself. If you set both the
805<a class="link" href="smb.conf.5.html#WINSSUPPORT" target="_top">wins support = yes</a> option and the
806<a class="link" href="smb.conf.5.html#WINSSERVER" target="_top">wins server = &lt;name&gt;</a> option then
807<code class="literal">nmbd</code> will fail to start.
808</p><p>
809<a class="indexterm" name="id2584128"></a>
810<a class="indexterm" name="id2584135"></a>
811<a class="indexterm" name="id2584142"></a>
812<a class="indexterm" name="id2584149"></a>
813There are two possible scenarios for setting up cross-subnet browsing.
814The first details setting up cross-subnet browsing on a network containing
815Windows 9x/Me, Samba, and Windows NT/200x machines that are not configured as
816part of a Windows NT domain. The second details setting up cross-subnet
817browsing on networks that contain NT domains.
818</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584164"></a>WINS Replication</h3></div></div></div><p>
819<a class="indexterm" name="id2584172"></a>
820<a class="indexterm" name="id2584181"></a>
821Samba-3 does not support native WINS replication. There was an approach to implement it, called
822<code class="filename">wrepld</code>, but it was never ready for action and the development is now discontinued.
823</p><p>
824Meanwhile, there is a project named <code class="filename">samba4WINS</code>, which makes it possible to
825run the Samba-4 WINS server parallel to Samba-3 since version 3.0.21. More information about
826<code class="filename">samba4WINS</code> are available at http://ftp.sernet.de/pub/samba4WINS.
827
828</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584217"></a>Static WINS Entries</h3></div></div></div><p>
829<a class="indexterm" name="id2584225"></a>
830<a class="indexterm" name="id2584232"></a>
831<a class="indexterm" name="id2584238"></a>
832<a class="indexterm" name="id2584245"></a>
833Adding static entries to your Samba WINS server is actually fairly easy. All you have to do is add a line to
834<code class="filename">wins.dat</code>, typically located in <code class="filename">/usr/local/samba/var/locks</code> or <code class="filename">/var/run/samba</code>.
835</p><p>
836Entries in <code class="filename">wins.dat</code> take the form of:
837</p><pre class="programlisting">
838"NAME#TYPE" TTL ADDRESS+ FLAGS
839</pre><p>
840<a class="indexterm" name="id2584291"></a>
841<a class="indexterm" name="id2584298"></a>
842where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the time-to-live as an absolute time in
843seconds, ADDRESS+ is one or more addresses corresponding to the registration, and FLAGS are the NetBIOS flags
844for the registration.
845</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
846A change that has been made to the <code class="filename">wins.dat</code> will not take effect until <span class="application">nmbd</span> has been
847restarted. It should be noted that since the <code class="filename">wins.dat</code> file changes dynamically, <span class="application">nmbd</span>
848should be stopped before editting this file. Do not forget to restart <span class="application">nmbd</span> when this file has been editted.
849</p></div><p>
850A typical dynamic entry looks like this:
851</p><pre class="programlisting">
852"MADMAN#03" 1155298378 192.168.1.2 66R
853</pre><p>
854To make a NetBIOS name static (permanent), simply set the TTL to 0, like this:
855</p><pre class="programlisting">
856"MADMAN#03" 0 192.168.1.2 66R
857</pre><p>
858</p><p>
859<a class="indexterm" name="id2584370"></a>
860<a class="indexterm" name="id2584377"></a>
861<a class="indexterm" name="id2584384"></a>
862<a class="indexterm" name="id2584391"></a>
863<a class="indexterm" name="id2584398"></a>
864<a class="indexterm" name="id2584405"></a>
865<a class="indexterm" name="id2584412"></a>
866The NetBIOS flags may be interpreted as additive hexadecimal values: 00 - Broadcast node registration, 20 -
867Peer node registration, 40 - Meta node registration, 60 - Hybrid node registration, 02 - Permanent name, 04 -
868Active name, 80 - Group name. The 'R' indicates this is a registration record. Thus 66R means: Hybrid node
869active and permanent NetBIOS name. These values may be found in the <code class="filename">nameserv.h</code> header
870file from the Samba source code repository. These are the values for the NB flags.
871</p><p>
872<a class="indexterm" name="id2584436"></a>
873Though this method works with early Samba-3 versions, there is a possibility that it may change in future
874versions if WINS replication is added.
875</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2584448"></a>Helpful Hints</h2></div></div></div><p>
876The following hints should be carefully considered because they are stumbling points
877for many new network administrators.
878</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584459"></a>Windows Networking Protocols</h3></div></div></div><p>
879<a class="indexterm" name="id2584468"></a>
880<a class="indexterm" name="id2584474"></a>
881A common cause of browsing problems results from the installation of more than one protocol on an MS Windows
882machine.
883</p><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
884Do not use more than one protocol on MS Windows clients.
885</p></div><p>
886<a class="indexterm" name="id2584492"></a>
887<a class="indexterm" name="id2584499"></a>
888Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
889every 15 minutes. A set of election criteria is used to determine the order
890of precedence for winning this election process. A machine running Samba or
891Windows NT will be biased, so the most suitable machine will predictably
892win and thus retain its role.
893</p><p>
894<a class="indexterm" name="id2584514"></a>
895<a class="indexterm" name="id2584521"></a>
896<a class="indexterm" name="id2584528"></a>
897<a class="indexterm" name="id2584535"></a>
898<a class="indexterm" name="id2584542"></a>
899<a class="indexterm" name="id2584548"></a>
900The election process is <span class="emphasis"><em>fought out, so to speak</em></span> over every NetBIOS network interface. In
901the case of a Windows 9x/Me machine that has both TCP/IP and IPX installed and has NetBIOS enabled over both
902protocols, the election will be decided over both protocols. As often happens, if the Windows 9x/Me machine is
903the only one with both protocols, then the LMB may be won on the NetBIOS interface over the IPX protocol.
904Samba will then lose the LMB role because Windows 9x/Me will insist it knows who the LMB is. Samba will then
905cease to function as an LMB, and browse list operation on all TCP/IP-only machines will therefore fail.
906</p><p>
907<a class="indexterm" name="id2584573"></a>
908<a class="indexterm" name="id2584580"></a>
909Windows 95, 98, 98se, and Me are referred to generically as Windows 9x/Me. The Windows NT4, 200x, and XP use
910common protocols. These are roughly referred to as the Windows NT family, but it should be recognized that
9112000 and XP/2003 introduce new protocol extensions that cause them to behave differently from MS Windows NT4.
912Generally, where a server does not support the newer or extended protocol, these will fall back to the NT4
913protocols.
914</p><p>
915The safest rule of all to follow is: Use only one protocol!
916</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584601"></a>Name Resolution Order</h3></div></div></div><p>
917<a class="indexterm" name="id2584609"></a>
918<a class="indexterm" name="id2584616"></a>
919Resolution of NetBIOS names to IP addresses can take place using a number
920of methods. The only ones that can provide NetBIOS name_type information
921are:
922</p><div class="itemizedlist"><ul type="disc"><li><p>WINS the best tool.</p></li><li><p>LMHOSTS static and hard to maintain.</p></li><li><p>Broadcast uses UDP and cannot resolve names across remote segments.</p></li></ul></div><p>
923Alternative means of name resolution include:
924</p><div class="itemizedlist"><ul type="disc"><li><p>Static <code class="filename">/etc/hosts</code> hard to maintain and lacks name_type info.</p></li><li><p>DNS is a good choice but lacks essential NetBIOS name_type information.</p></li></ul></div><p>
925<a class="indexterm" name="id2584684"></a>
926<a class="indexterm" name="id2584691"></a>
927Many sites want to restrict DNS lookups and avoid broadcast name
928resolution traffic. The <em class="parameter"><code>name resolve order</code></em> parameter is of great help here.
929The syntax of the <em class="parameter"><code>name resolve order</code></em> parameter is:
930</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2584718"></a><em class="parameter"><code>name resolve order = wins lmhosts bcast host</code></em></td></tr></table><p>
931<span class="emphasis"><em>or</em></span>
932</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2584739"></a><em class="parameter"><code>name resolve order = wins lmhosts (eliminates bcast and host)</code></em></td></tr></table><p>
933The default is:
934</p><table class="simplelist" border="0" summary="Simple list"><tr><td><a class="indexterm" name="id2584757"></a><em class="parameter"><code>name resolve order = host lmhost wins bcast</code></em></td></tr></table><p>
935<a class="indexterm" name="id2584769"></a>
936where &#8220;<span class="quote">host</span>&#8221; refers to the native methods used by the UNIX system to implement the
937gethostbyname() function call. This is normally controlled by <code class="filename">/etc/host.conf</code>,
938<code class="filename">/etc/nsswitch.conf</code> and <code class="filename">/etc/resolv.conf</code>.
939</p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2584804"></a>Technical Overview of Browsing</h2></div></div></div><p>
940<a class="indexterm" name="id2584812"></a>
941SMB networking provides a mechanism by which clients can access a list
942of machines in a network called <a class="link" href="smb.conf.5.html#BROWSELIST" target="_top">browse list</a>. This list
943contains machines that are ready to offer file and/or print services
944to other machines within the network. It therefore does not include
945machines that aren't currently able to do server tasks. The browse
946list is heavily used by all SMB clients. Configuration of SMB
947browsing has been problematic for some Samba users, hence this
948document.
949</p><p>
950<a class="indexterm" name="id2584841"></a>
951<a class="indexterm" name="id2584848"></a>
952<a class="indexterm" name="id2584855"></a>
953MS Windows 2000 and later versions, as with Samba-3 and later versions, can be
954configured to not use NetBIOS over TCP/IP. When configured this way,
955it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
956configured and operative. Browsing will not work if name resolution
957from SMB machine names to IP addresses does not function correctly.
958</p><p>
959<a class="indexterm" name="id2584871"></a>
960<a class="indexterm" name="id2584878"></a>
961Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly
962recommended to aid the resolution of NetBIOS (SMB) names to IP addresses.
963WINS allows remote segment clients to obtain NetBIOS name_type information
964that cannot be provided by any other means of name resolution.
965</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2584891"></a>Browsing Support in Samba</h3></div></div></div><p>
966<a class="indexterm" name="id2584899"></a>
967<a class="indexterm" name="id2584905"></a>
968<a class="indexterm" name="id2584912"></a>
969<a class="indexterm" name="id2584919"></a>
970Samba facilitates browsing. The browsing is supported by <span class="application">nmbd</span>
971and is also controlled by options in the <code class="filename">smb.conf</code> file.
972Samba can act as an LMB for a workgroup, and the ability
973to support domain logons and scripts is now available.
974</p><p>
975<a class="indexterm" name="id2584944"></a>
976<a class="indexterm" name="id2584950"></a>
977<a class="indexterm" name="id2584957"></a>
978Samba can also act as a DMB for a workgroup. This
979means that it will collate lists from LMBs into a
980wide-area network server list. In order for browse clients to
981resolve the names they may find in this list, it is recommended that
982both Samba and your clients use a WINS server.
983</p><p>
984<a class="indexterm" name="id2584972"></a>
985Do not set Samba to be the domain master for a workgroup that has the same
986name as an NT Domain. On each wide-area network, you must only ever have one
987DMB per workgroup, regardless of whether it is NT, Samba,
988or any other type of domain master that is providing this service.
989</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
990<a class="indexterm" name="id2584988"></a>
991<a class="indexterm" name="id2584995"></a>
992<code class="literal">nmbd</code> can be configured as a WINS server, but it is not
993necessary to specifically use Samba as your WINS server. MS Windows
994NT4, Server or Advanced Server 200x can be configured as
995your WINS server. In a mixed NT/200x server and Samba environment on
996a WAN, it is recommended that you use the Microsoft
997WINS server capabilities. In a Samba-only environment, it is
998recommended that you use one and only one Samba server as the WINS server.
999</p></div><p>
1000<a class="indexterm" name="id2585018"></a>
1001To get browsing to work, you need to run <code class="literal">nmbd</code> as usual, but must
1002use the <a class="link" href="smb.conf.5.html#WORKGROUP" target="_top">workgroup</a> option in <code class="filename">smb.conf</code>
1003to control what workgroup Samba becomes a part of.
1004</p><p>
1005<a class="indexterm" name="id2585053"></a>
1006Samba also has a useful option for a Samba server to offer itself for browsing on another subnet. It is
1007recommended that this option is used only for &#8220;<span class="quote">unusual</span>&#8221; purposes: announcements over the
1008Internet, for example. See <a class="link" href="smb.conf.5.html#REMOTEANNOUNCE" target="_top">remote announce</a> in the <code class="filename">smb.conf</code> man page.
1009</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2585087"></a>Problem Resolution</h3></div></div></div><p>
1010<a class="indexterm" name="id2585095"></a>
1011<a class="indexterm" name="id2585102"></a>
1012If something does not work, the <code class="filename">log.nmbd</code> file will help
1013to track down the problem. Try a <a class="link" href="smb.conf.5.html#LOGLEVEL" target="_top">log level</a> of 2 or 3 for finding
1014problems. Also note that the current browse list usually gets stored
1015in text form in a file called <code class="filename">browse.dat</code>.
1016</p><p>
1017<a class="indexterm" name="id2585138"></a>
1018<a class="indexterm" name="id2585145"></a>
1019If it does not work, you should still be able to
1020type the server name as <code class="filename">\\SERVER</code> in <code class="literal">filemanager</code>, then
1021press enter, and <code class="literal">filemanager</code> should display the list of available shares.
1022</p><p>
1023<a class="indexterm" name="id2585175"></a>
1024<a class="indexterm" name="id2585182"></a>
1025Some people find browsing fails because they do not have the global
1026<a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account</a> set to a valid account. Remember that the
1027IPC$ connection that lists the shares is done as guest and so you must have a valid guest account.
1028</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
1029<a class="indexterm" name="id2585209"></a>
1030<a class="indexterm" name="id2585215"></a>
1031<a class="indexterm" name="id2585222"></a>
1032<a class="indexterm" name="id2585229"></a>
1033<a class="indexterm" name="id2585236"></a>
1034The <code class="literal">IPC$</code> share is used by all SMB/CIFS clients to obtain the list of resources that is
1035available on the server. This is the source of the list of shares and printers when browsing an SMB/CIFS
1036server (also Windows machines) using the Windows Explorer to browse resources through the Windows Network
1037Neighborhood (also called My Network Places) through to a Windows server. At this point, the client has opened
1038a connection to the <code class="literal">\\server\IPC4</code> resource. Clicking on a share will then open up a
1039connection to the <code class="literal">\\server\share</code>.
1040</p></div><p>
1041<a class="indexterm" name="id2585273"></a>
1042<a class="indexterm" name="id2585280"></a>
1043<a class="indexterm" name="id2585287"></a>
1044<a class="indexterm" name="id2585293"></a>
1045MS Windows 2000 and later (as with Samba) can be configured to disallow
1046anonymous (i.e., guest account) access to the IPC$ share. In that case, the
1047MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the
1048name of the currently logged-in user to query the IPC$ share. MS Windows
10499x/Me clients are not able to do this and thus will not be able to browse
1050server resources.
1051</p><p>
1052<a class="indexterm" name="id2585310"></a>
1053The other big problem people have is that their broadcast address,
1054netmask, or IP address is wrong (specified with the <a class="link" href="smb.conf.5.html#INTERFACES" target="_top">interfaces</a> option
1055in <code class="filename">smb.conf</code>)
1056</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2585339"></a>Cross-Subnet Browsing</h3></div></div></div><p>
1057<a class="indexterm" name="id2585347"></a>
1058<a class="indexterm" name="id2585356"></a>
1059Since the release of Samba 1.9.17 (alpha1), Samba has supported the replication of browse lists across subnet
1060boundaries. This section describes how to set this feature up in different settings.
1061</p><p>
1062<a class="indexterm" name="id2585370"></a>
1063<a class="indexterm" name="id2585377"></a>
1064<a class="indexterm" name="id2585384"></a>
1065<a class="indexterm" name="id2585390"></a>
1066<a class="indexterm" name="id2585397"></a>
1067<a class="indexterm" name="id2585404"></a>
1068To see browse lists that span TCP/IP subnets (i.e., networks separated by routers that do not pass broadcast
1069traffic), you must set up at least one WINS server. The WINS server acts as a DNS for NetBIOS names. This will
1070allow NetBIOS name-to-IP address translation to be completed by a direct query of the WINS server. This is
1071done via a directed UDP packet on port 137 to the WINS server machine. The WINS server avoids the necessity of
1072default NetBIOS name-to-IP address translation, which is done using UDP broadcasts from the querying machine.
1073This means that machines on one subnet will not be able to resolve the names of machines on another subnet
1074without using a WINS server. The Samba hacks, <em class="parameter"><code>remote browse sync</code></em>, and <em class="parameter"><code>remote
1075announce</code></em> are designed to get around the natural limitations that prevent UDP broadcast
1076propagation. The hacks are not a universal solution and they should not be used in place of WINS, they are
1077considered last resort methods.
1078</p><p>
1079<a class="indexterm" name="id2585441"></a>
1080<a class="indexterm" name="id2585448"></a>
1081<a class="indexterm" name="id2585455"></a>
1082<a class="indexterm" name="id2585462"></a>
1083Remember, for browsing across subnets to work correctly, all machines, be they Windows 95, Windows NT, or
1084Samba servers, must have the IP address of a WINS server given to them by a DHCP server or by manual
1085configuration: for Windows 9x/Me and Windows NT/200x/XP, this is in the TCP/IP Properties, under Network
1086settings; for Samba, this is in the <code class="filename">smb.conf</code> file.
1087</p><p>
1088<a class="indexterm" name="id2585484"></a>
1089<a class="indexterm" name="id2585491"></a>
1090<a class="indexterm" name="id2585497"></a>
1091It is possible to operate Samba-3 without NetBIOS over TCP/IP. If you do this, be warned that if used outside
1092of MS ADS, this will forgo network browsing support. ADS permits network browsing support through DNS,
1093providing appropriate DNS records are inserted for all Samba servers.
1094</p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2585510"></a>Behavior of Cross-Subnet Browsing</h4></div></div></div><p>
1095<a class="indexterm" name="id2585518"></a>
1096<a class="indexterm" name="id2585525"></a>
1097Cross-subnet browsing is a complicated dance, containing multiple moving parts. It has taken Microsoft several
1098years to get the code that correctly achieves this, and Samba lags behind in some areas. Samba is capable of
1099cross-subnet browsing when configured correctly.
1100</p><p>
1101Consider a network set up as in <a class="link" href="NetworkBrowsing.html#browsing1" title="Figure 10.1. Cross-Subnet Browsing Example.">Cross-Subnet Browsing Example</a>.
1102</p><div class="figure"><a name="browsing1"></a><p class="title"><b>Figure 10.1. Cross-Subnet Browsing Example.</b></p><div class="figure-contents"><div class="mediaobject"><img src="images/browsing1.png" width="216" alt="Cross-Subnet Browsing Example."></div></div></div><br class="figure-break"><p>
1103<a class="indexterm" name="id2585592"></a>
1104<a class="indexterm" name="id2585599"></a>
1105<a class="indexterm" name="id2585606"></a>
1106This consists of three subnets (1, 2, 3) connected by two routers (R1, R2), which do not pass broadcasts.
1107Subnet 1 has five machines on it, subnet 2 has four machines, and subnet 3 has four machines. Assume for the
1108moment that all machines are configured to be in the same workgroup (for simplicity's sake). Machine N1_C on
1109subnet 1 is configured as the DMB (i.e., it will collate the browse lists for the workgroup). Machine N2_D is
1110configured as a WINS server, and all the other machines are configured to register their NetBIOS names with
1111it.
1112</p><p>
1113<a class="indexterm" name="id2585625"></a>
1114<a class="indexterm" name="id2585632"></a>
1115<a class="indexterm" name="id2585638"></a>
1116As these machines are booted up, elections for master browsers
1117take place on each of the three subnets. Assume that machine
1118N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on
1119subnet 3. These machines are known as LMBs for
1120their particular subnet. N1_C has an advantage in winning as the
1121LMB on subnet 1 because it is set up as DMB.
1122</p><p>
1123<a class="indexterm" name="id2585654"></a>
1124<a class="indexterm" name="id2585660"></a>
1125On each of the three networks, machines that are configured to offer sharing services will broadcast that they
1126are offering these services. The LMB on each subnet will receive these broadcasts and keep a record of the
1127fact that the machine is offering a service. This list of records is the basis of the browse list. For this
1128case, assume that all the machines are configured to offer services, so all machines will be on the browse
1129list.
1130</p><p>
1131<a class="indexterm" name="id2585678"></a>
1132<a class="indexterm" name="id2585684"></a>
1133<a class="indexterm" name="id2585691"></a>
1134<a class="indexterm" name="id2585698"></a>
1135<a class="indexterm" name="id2585705"></a>
1136For each network, the LMB on that network is
1137considered <span class="emphasis"><em>authoritative</em></span> for all the names it receives via
1138local broadcast. This is because a machine seen by the LMB
1139via a local broadcast must be on the same network as the
1140Local Master Browser and thus is a <span class="emphasis"><em>trusted</em></span>
1141and <span class="emphasis"><em>verifiable</em></span> resource. Machines on other networks that
1142the LMBs learn about when collating their
1143browse lists have not been directly seen. These records are
1144called <span class="emphasis"><em>non-authoritative.</em></span>
1145</p><p>
1146<a class="indexterm" name="id2585736"></a>
1147At this point the browse lists appear as shown in <a class="link" href="NetworkBrowsing.html#browsubnet" title="Table 10.1. Browse Subnet Example 1">Browse Subnet Example 1</a>
1148(these are the machines you would see in your network neighborhood if you looked in it on a particular network
1149right now).
1150</p><p>
1151</p><div class="table"><a name="browsubnet"></a><p class="title"><b>Table 10.1. Browse Subnet Example 1</b></p><div class="table-contents"><table summary="Browse Subnet Example 1" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div></div><p><br class="table-break">
1152</p><p>
1153At this point all the subnets are separate, and no machine is seen across any of the subnets.
1154</p><p>
1155<a class="indexterm" name="id2585831"></a>
1156<a class="indexterm" name="id2585837"></a>
1157<a class="indexterm" name="id2585844"></a>
1158<a class="indexterm" name="id2585851"></a>
1159Now examine subnet 2 in <a class="link" href="NetworkBrowsing.html#brsbex" title="Table 10.2. Browse Subnet Example 2">Browse Subnet Example 2</a>. As soon as N2_B has become the
1160LMB, it looks for a DMB with which to synchronize its browse list. It does this by querying the WINS server
1161(N2_D) for the IP address associated with the NetBIOS name WORKGROUP&lt;1B&gt;. This name was registered by
1162the DMB (N1_C) with the WINS server as soon as it was started.
1163</p><p>
1164<a class="indexterm" name="id2585876"></a>
1165<a class="indexterm" name="id2585883"></a>
1166<a class="indexterm" name="id2585890"></a>
1167<a class="indexterm" name="id2585897"></a>
1168Once N2_B knows the address of the DMB, it tells the DMB that it is the LMB
1169for subnet 2 by sending the DMB a
1170<span class="emphasis"><em>MasterAnnouncement</em></span> packet to UDP port 138. It then
1171synchronizes with the DMB by
1172doing a <span class="emphasis"><em>NetServerEnum2</em></span> call. This tells the DMB to
1173send the sender all the server names it knows
1174about. Once the DMB receives the <span class="emphasis"><em>MasterAnnouncement</em></span> packet, it schedules a
1175synchronization request to the sender of that packet. After both synchronizations are complete, the browse
1176lists look like those in <a class="link" href="NetworkBrowsing.html#brsbex" title="Table 10.2. Browse Subnet Example 2">Browse Subnet Example 2</a>
1177</p><div class="table"><a name="brsbex"></a><p class="title"><b>Table 10.2. Browse Subnet Example 2</b></p><div class="table-contents"><table summary="Browse Subnet Example 2" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
1178N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
1179N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div></div><br class="table-break"><p>
1180<a class="indexterm" name="id2586011"></a>
1181Servers with an (*) after them are non-authoritative names.
1182</p><p>
1183<a class="indexterm" name="id2586023"></a>
1184At this point users looking in their Network Neighborhood on subnets 1 or 2 will see all the servers on both;
1185users on subnet 3 will still see only the servers on their own subnet.
1186</p><p>
1187<a class="indexterm" name="id2586036"></a>
1188The same sequence of events that occurred for N2_B now occurs for the LMB on subnet 3 (N3_D). When it
1189synchronizes browse lists with the DMB (N1_A) it gets both the server entries on subnet 1 and those on subnet
11902. After N3_D has synchronized with N1_C and vica versa, the browse lists will appear as shown in <a class="link" href="NetworkBrowsing.html#brsex2" title="Table 10.3. Browse Subnet Example 3">Browse Subnet Example 3</a>
1191</p><div class="table"><a name="brsex2"></a><p class="title"><b>Table 10.3. Browse Subnet Example 3</b></p><div class="table-contents"><table summary="Browse Subnet Example 3" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
1192N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
1193N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D, N1_A(*),
1194N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr></tbody></table></div></div><br class="table-break"><p>
1195Servers with an (*) after them are non-authoritative names.
1196</p><p>
1197At this point, users looking in their Network Neighborhood on
1198subnets 1 or 3 will see all the servers on all subnets, while users on
1199subnet 2 will still see only the servers on subnets 1 and 2, but not 3.
1200</p><p>
1201<a class="indexterm" name="id2586153"></a>
1202<a class="indexterm" name="id2586160"></a>
1203<a class="indexterm" name="id2586166"></a>
1204Finally, the LMB for subnet 2 (N2_B) will sync again
1205with the DMB (N1_C) and will receive the missing
1206server entries. Finally, as when a steady state (if no machines
1207are removed or shut off) has been achieved, the browse lists will appear
1208as shown in <a class="link" href="NetworkBrowsing.html#brsex3" title="Table 10.4. Browse Subnet Example 4">Browse Subnet Example 4</a>.
1209</p><div class="table"><a name="brsex3"></a><p class="title"><b>Table 10.4. Browse Subnet Example 4</b></p><div class="table-contents"><table summary="Browse Subnet Example 4" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
1210N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*),
1211N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
1212N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*),
1213N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D, N1_A(*),
1214N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*),
1215N2_C(*), N2_D(*)</td></tr></tbody></table></div></div><br class="table-break"><p>
1216Servers with an (*) after them are non-authoritative names.
1217</p><p>
1218Synchronizations between the DMB and LMBs
1219will continue to occur, but this should remain a
1220steady-state operation.
1221</p><p>
1222If either router R1 or R2 fails, the following will occur:
1223</p><div class="orderedlist"><ol type="1"><li><p>
1224<a class="indexterm" name="id2586296"></a>
1225 Names of computers on each side of the inaccessible network fragments
1226 will be maintained for as long as 36 minutes in the Network Neighborhood
1227 lists.
1228 </p></li><li><p>
1229 Attempts to connect to these inaccessible computers will fail, but the
1230 names will not be removed from the Network Neighborhood lists.
1231 </p></li><li><p>
1232<a class="indexterm" name="id2586321"></a>
1233<a class="indexterm" name="id2586328"></a>
1234<a class="indexterm" name="id2586335"></a>
1235 If one of the fragments is cut off from the WINS server, it will only
1236 be able to access servers on its local subnet using subnet-isolated
1237 broadcast NetBIOS name resolution. The effect is similar to that of
1238 losing access to a DNS server.
1239 </p></li></ol></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2586352"></a>Common Errors</h2></div></div></div><p>
1240<a class="indexterm" name="id2586360"></a>
1241<a class="indexterm" name="id2586367"></a>
1242Many questions are asked on the mailing lists regarding browsing. The majority of browsing
1243problems originate from incorrect configuration of NetBIOS name resolution. Some are of
1244particular note.
1245</p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586378"></a>Flushing the Samba NetBIOS Name Cache</h3></div></div></div><p>
1246How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?
1247</p><p>
1248<a class="indexterm" name="id2586391"></a>
1249<a class="indexterm" name="id2586398"></a>
1250<a class="indexterm" name="id2586405"></a>
1251<a class="indexterm" name="id2586412"></a>
1252Samba's <code class="literal">nmbd</code> process controls all browse list handling. Under normal circumstances it is
1253safe to restart <code class="literal">nmbd</code>. This will effectively flush the Samba NetBIOS name cache and cause it
1254to be rebuilt. This does not make certain that a rogue machine name will not reappear
1255in the browse list. When <code class="literal">nmbd</code> is taken out of service, another machine on the network will
1256become the browse master. This new list may still have the rogue entry in it. If you really
1257want to clear a rogue machine from the list, every machine on the network must be
1258shut down and restarted after all machines are down. Failing a complete restart, the only
1259other thing you can do is wait until the entry times out and is then flushed from the list.
1260This may take a long time on some networks (perhaps months).
1261</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586451"></a>Server Resources Cannot Be Listed</h3></div></div></div><p>&#8220;<span class="quote">My Client Reports "&#8216;<span class="quote">This server is not configured to list shared resources."</span>&#8217;</span>&#8221;</p><p>
1262Your guest account is probably invalid for some reason. Samba uses the
1263guest account for browsing in <code class="literal">smbd</code>. Check that your guest account is
1264valid.
1265</p><p>Also see <a class="link" href="smb.conf.5.html#GUESTACCOUNT" target="_top">guest account</a> in the <code class="filename">smb.conf</code> man page.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586500"></a>I Get an "<span class="errorname">Unable to browse the network</span>" Error</h3></div></div></div><p>This error can have multiple causes:
1266<a class="indexterm" name="id2586511"></a>
1267 </p><div class="itemizedlist"><ul type="disc"><li><p>There is no LMB. Configure <span class="application">nmbd</span>
1268 or any other machine to serve as LMB.</p></li><li><p>You cannot log onto the machine that is the LMB.
1269 Can you log on to it as a guest user? </p></li><li><p>There is no IP connectivity to the LMB.
1270 Can you reach it by broadcast?</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586546"></a>Browsing of Shares and Directories is Very Slow</h3></div></div></div><p>&#8220;<span class="quote">
1271<a class="indexterm" name="id2586556"></a>
1272There are only two machines on a test network. One is a Samba server, the other a Windows XP machine.
1273Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the
1274Windows XP client becomes unresponsive. Sometimes it does not respond for some minutes. Eventually,
1275Windows Explorer will respond and displays files and directories without problem.
1276</span>&#8221;
1277</p><p>&#8220;<span class="quote">
1278<a class="indexterm" name="id2586575"></a>
1279But, the share is immediately available from a command shell (<code class="literal">cmd</code>, followed by
1280exploration with DOS command. Is this a Samba problem, or is it a Windows problem? How can I solve this?
1281</span>&#8221;</p><p>
1282Here are a few possibilities:
1283</p><div class="variablelist"><dl><dt><span class="term">Bad Networking Hardware</span></dt><dd><p>
1284<a class="indexterm" name="id2586606"></a>
1285<a class="indexterm" name="id2586613"></a>
1286<a class="indexterm" name="id2586620"></a>
1287<a class="indexterm" name="id2586627"></a>
1288<a class="indexterm" name="id2586634"></a>
1289 Most common defective hardware problems center around low cost or defective hubs, routers,
1290 network interface controllers (NICs), and bad wiring. If one piece of hardware is defective,
1291 the whole network may suffer. Bad networking hardware can cause data corruption. Most bad
1292 networking hardware problems are accompanied by an increase in apparent network traffic,
1293 but not all.
1294 </p></dd><dt><span class="term">The Windows XP WebClient</span></dt><dd><p>
1295<a class="indexterm" name="id2586659"></a>
1296 A number of sites have reported similar slow network browsing problems and found that when
1297 the WebClient service is turned off, the problem disappears. This is certainly something
1298 that should be explored because it is a simple solution if it works.
1299 </p></dd><dt><span class="term">Inconsistent WINS Configuration</span></dt><dd><p>
1300<a class="indexterm" name="id2586684"></a>
1301<a class="indexterm" name="id2586691"></a>
1302 This type of problem is common when one client is configured to use a WINS server (that is
1303 a TCP/IP configuration setting) and there is no WINS server on the network. Alternatively,
1304 this will happen if there is a WINS server and Samba is not configured to use it. The use of
1305 WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use
1306 of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS
1307 server, nor should it be configured to use one.
1308 </p></dd><dt><span class="term">Incorrect DNS Configuration</span></dt><dd><p>
1309<a class="indexterm" name="id2586718"></a>
1310<a class="indexterm" name="id2586725"></a>
1311 If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server
1312 has been incorrectly configured. For further information refer to
1313 <a class="link" href="NetworkBrowsing.html#adsdnstech" title="DNS and Active Directory">DNS and Active Directory</a>.
1314 </p></dd></dl></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2586746"></a>Invalid Cached Share References Affects Network Browsing</h3></div></div></div><p>
1315<a class="indexterm" name="id2586755"></a>
1316<a class="indexterm" name="id2586762"></a>
1317Cached references on your MS Windows client (workstation or server) to shares or servers that no longer exist
1318can cause MS Windows Explorer to appear unresponsive as it tries to connect to these shares. After a delay
1319(can take a long time) it times out and browsing will appear to be mostly normal again.
1320</p><p>
1321To eliminate the problem the stale cached references should be removed. This does not happen automatically and
1322requires manual intervention. This is a design feature of MS Windows and not anything that Samba can change.
1323To remove the stale shortcuts found in <span class="emphasis"><em>My Network Places</em></span> which refer to what are now
1324invalid shares or servers it is necessary to edit the Windows Registry under
1325<code class="literal">HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\</code>. Edit the entry
1326<code class="literal">MountPoints2</code> (on Windows XP and later, or <code class="literal">MountPoints</code> on Windows 2000
1327and earlier). Remove all keys named <code class="literal">\\server\share</code> (where 'server' and 'share' refer to a
1328non-existent server or share).
1329</p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
1330Removal of stale network links needs to be done on a per-user basis. Alternately, you can delete the
1331shortcuts from the MS Windows Explorer in <code class="literal">My Network Places</code> just by right-clicking them and
1332selecting <span class="emphasis"><em>Delete.</em></span>
1333</p></div><p>
1334<a class="indexterm" name="id2586835"></a>
1335Samba users have reported that these stale references negatively affect network browsing with Windows, Samba,
1336and Novell servers. It is suspected to be a universal problem not directly related to the Samba
1337server. Samba users may experience this more often due to Samba being somewhat viewed as an experimenter's
1338toolkit. This results from the fact that a user might go through several reconfigurations and incarnations of
1339their Samba server, by different names, with different shares, increasing the chances for having stale
1340(invalid) cached share references. Windows clients do not expire these references thus necessitating manual
1341removal.
1342</p><p>
1343It is common for <span class="emphasis"><em>Open</em></span> dialog boxes (for example; in Word and Excel) to respond very
1344slowly, as they attempt to locate all of the cached references, even if they are not in the current directory
1345being accessed.
1346</p></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="ChangeNotes.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="passdb.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Chapter 9. Important and Critical Change Notes for the Samba 3.x Series </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Account Information Databases</td></tr></table></div></body></html>
Note: See TracBrowser for help on using the repository browser.