| blob | ffe96d24713f23ec4bb009ddfefa9b8813fb434e |
1 <html><head><meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"><title>Chapter 10. Network Browsing</title><link rel="stylesheet" href="samba.css" type="text/css"><meta name="generator" content="DocBook XSL Stylesheets V1.60.1"><link rel="home" href="index.html" title="SAMBA Project Documentation"><link rel="up" href="optional.html" title="Part III. Advanced Configuration"><link rel="previous" href="optional.html" title="Part III. Advanced Configuration"><link rel="next" href="passdb.html" title="Chapter 11. Account Information Databases"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">Chapter 10. Network Browsing</th></tr><tr><td width="20%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><th width="60%" align="center">Part III. Advanced Configuration</th><td width="20%" align="right"> <a accesskey="n" href="passdb.html">Next</a></td></tr></table><hr></div><div class="chapter" lang="en"><div class="titlepage"><div><div><h2 class="title"><a name="NetworkBrowsing"></a>Chapter 10. Network Browsing</h2></div><div><div class="author"><h3 class="author"><span class="firstname">John</span> <span class="othername">H.</span> <span class="surname">Terpstra</span></h3><div class="affiliation"><span class="orgname">Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jht@samba.org">jht@samba.org</a>></tt></p></div></div></div></div><div><div class="author"><h3 class="author"><span class="firstname">Jelmer</span> <span class="othername">R.</span> <span class="surname">Vernooij</span></h3><div class="affiliation"><span class="orgname">The Samba Team<br></span><div class="address"><p><tt class="email"><<a href="mailto:jelmer@samba.org">jelmer@samba.org</a>></tt></p></div></div></div></div><div><p class="pubdate">July 5, 1998</p></div><div><p class="pubdate">Updated: April 21, 2003</p></div></div><div></div></div><div class="toc"><p><b>Table of Contents</b></p><dl><dt><a href="NetworkBrowsing.html#id2897285">Features and Benefits</a></dt><dt><a href="NetworkBrowsing.html#id2887786">What Is Browsing?</a></dt><dt><a href="NetworkBrowsing.html#netdiscuss">Discussion</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2888109">NetBIOS over TCP/IP</a></dt><dt><a href="NetworkBrowsing.html#id2888380">TCP/IP without NetBIOS</a></dt><dt><a href="NetworkBrowsing.html#adsdnstech">DNS and Active Directory</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2888743">How Browsing Functions</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#DMB">Configuring WORKGROUP Browsing</a></dt><dt><a href="NetworkBrowsing.html#id2900135">DOMAIN Browsing Configuration</a></dt><dt><a href="NetworkBrowsing.html#browse-force-master">Forcing Samba to Be the Master</a></dt><dt><a href="NetworkBrowsing.html#id2900550">Making Samba the Domain Master</a></dt><dt><a href="NetworkBrowsing.html#id2900727">Note about Broadcast Addresses</a></dt><dt><a href="NetworkBrowsing.html#id2900745">Multiple Interfaces</a></dt><dt><a href="NetworkBrowsing.html#id2900780">Use of the Remote Announce Parameter</a></dt><dt><a href="NetworkBrowsing.html#id2900939">Use of the Remote Browse Sync Parameter</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2901016">WINS The Windows Internetworking Name Server</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2901208">WINS Server Configuration</a></dt><dt><a href="NetworkBrowsing.html#id2901481">WINS Replication</a></dt><dt><a href="NetworkBrowsing.html#id2901518">Static WINS Entries</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2901602">Helpful Hints</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2901616">Windows Networking Protocols</a></dt><dt><a href="NetworkBrowsing.html#id2901696">Name Resolution Order</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2901872">Technical Overview of Browsing</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2901926">Browsing Support in Samba</a></dt><dt><a href="NetworkBrowsing.html#id2902057">Problem Resolution</a></dt><dt><a href="NetworkBrowsing.html#id2902187">Cross-Subnet Browsing</a></dt></dl></dd><dt><a href="NetworkBrowsing.html#id2902960">Common Errors</a></dt><dd><dl><dt><a href="NetworkBrowsing.html#id2902975">How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?</a></dt><dt><a href="NetworkBrowsing.html#id2903041">Server Resources Can Not Be Listed</a></dt><dt><a href="NetworkBrowsing.html#id2903097">I get an `Unable to browse the network' error</a></dt><dt><a href="NetworkBrowsing.html#id2903157">Browsing of Shares and Directories is Very Slow</a></dt></dl></dd></dl></div><p>
2 This document contains detailed information as well as a fast track guide to
3 implementing browsing across subnets and/or across workgroups (or domains).
4 WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is
5 not involved in browse list handling except by way of name to address resolution.
6 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
7 MS Windows 2000 and later versions can be configured to operate with no NetBIOS
8 over TCP/IP. Samba-3 and later versions also support this mode of operation.
9 When the use of NetBIOS over TCP/IP has been disabled, the primary
10 means for resolution of MS Windows machine names is via DNS and Active Directory.
11 The following information assumes that your site is running NetBIOS over TCP/IP.
12 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2897285"></a>Features and Benefits</h2></div></div><div></div></div><p>
13 Someone once referred to the past in these words “<span class="quote"><span class="emphasis"><em>It was the best of times,
14 it was the worst of times.</em></span></span>” The more we look back, the more we long for what was and
15 hope it never returns.
16 </p><p>
18 For many MS Windows network administrators, that statement sums up their feelings about
19 NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle
20 nature was just par for the course. For those who never quite managed to tame its
21 lusty features, NetBIOS is like Paterson's Curse.
22 </p><p>
23 For those not familiar with botanical problems in Australia, Paterson's Curse,
24 <span class="emphasis"><em>Echium plantagineum</em></span>, was introduced to Australia from Europe during the mid-nineteenth
25 century. Since then it has spread rapidly. The high seed production, with densities of
26 thousands of seeds per square meter, a seed longevity of more than seven years, and an
27 ability to germinate at any time of year, given the right conditions, are some of the
28 features which make it such a persistent weed.
29 </p><p>
30 In this chapter we explore vital aspects of Server Message Block (SMB) networking with
31 a particular focus on SMB as implemented through running NetBIOS (Network Basic
32 Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over
33 any other protocols, we need to know how to configure our network environment and simply
34 remember to use nothing but TCP/IP on all our MS Windows network clients.
35 </p><p>
36 Samba provides the ability to implement a WINS (Windows Internetworking Name Server)
37 and implements extensions to Microsoft's implementation of WINS. These extensions
38 help Samba to effect stable WINS operations beyond the normal scope of MS WINS.
39 </p><p>
40 WINS is exclusively a service that applies only to those systems
41 that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with
42 support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.
43 </p><p>
44 For those networks on which NetBIOS has been disabled (i.e., WINS is not required)
45 the use of DNS is necessary for host name resolution.
46 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2887786"></a>What Is Browsing?</h2></div></div><div></div></div><p>
47 To most people browsing means they can see the MS Windows and Samba servers
48 in the Network Neighborhood, and when the computer icon for a particular server is
49 clicked, it opens up and shows the shares and printers available on the target server.
50 </p><p>
51 What seems so simple is in fact a complex interaction of different technologies.
52 The technologies (or methods) employed in making all of this work include:
53 </p><div class="itemizedlist"><ul type="disc"><li>MS Windows machines register their presence to the network.</li><li>Machines announce themselves to other machines on the network.</li><li>One or more machine on the network collates the local announcements.</li><li>The client machine finds the machine that has the collated list of machines.</li><li>The client machine is able to resolve the machine names to IP addresses.</li><li>The client machine is able to connect to a target machine.</li></ul></div><p>
54 The Samba application that controls browse list management and name resolution is
55 called <tt class="filename">nmbd</tt>. The configuration parameters involved in nmbd's operation are:
56 </p><p>Browsing options: <a class="indexterm" name="id2887863"></a><i class="parameter"><tt>os level</tt></i>(*),
64 </p><p>Name Resolution Method:
65 <a class="indexterm" name="id2887977"></a><i class="parameter"><tt>name resolve order</tt></i>(*).
66 </p><p>WINS options:
72 </p><p>
74 For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with
75 an (*) are the only options that commonly may need to be modified. Even if none of these
77 </p></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="netdiscuss"></a>Discussion</h2></div></div><div></div></div><p>
78 All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS.
79 MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing
80 out NetBIOS support.
81 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888109"></a>NetBIOS over TCP/IP</h3></div></div><div></div></div><p>
82 Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP.
83 MS Windows products can do likewise. NetBIOS-based networking uses broadcast messaging to
84 effect browse list management. When running NetBIOS over TCP/IP, this uses UDP-based messaging.
85 UDP messages can be broadcast or unicast.
86 </p><p>
88 Normally, only unicast UDP messaging can be forwarded by routers. The
89 <a class="indexterm" name="id2888140"></a><i class="parameter"><tt>remote announce</tt></i> parameter to smb.conf helps to project browse announcements
90 to remote network segments via unicast UDP. Similarly, the
91 <a class="indexterm" name="id2888156"></a><i class="parameter"><tt>remote browse sync</tt></i> parameter of <tt class="filename">smb.conf</tt>
92 implements browse list collation using unicast UDP.
93 </p><p>
94 Secondly, in those networks where Samba is the only SMB server technology,
96 server. This makes it easy to manage the browsing environment. If each network
97 segment is configured with its own Samba WINS server, then the only way to
98 get cross-segment browsing to work is by using the
101 <a class="indexterm" name="id2888215"></a><i class="parameter"><tt>remote announce</tt></i> and the <a class="indexterm" name="id2888229"></a><i class="parameter"><tt>remote browse sync</tt></i>
103 </p><p>
105 If only one WINS server is used for an entire multi-segment network, then
106 the use of the <a class="indexterm" name="id2888264"></a><i class="parameter"><tt>remote announce</tt></i> and the
107 <a class="indexterm" name="id2888278"></a><i class="parameter"><tt>remote browse sync</tt></i> parameters should not be necessary.
108 </p><p>
110 As of Samba-3 WINS replication is being worked on. The bulk of the code has
111 been committed, but it still needs maturation. This is not a supported feature
112 of the Samba-3.0.0 release. Hopefully, this will become a supported feature
113 of one of the Samba-3 release series.
114 </p><p>
115 Right now Samba WINS does not support MS-WINS replication. This means that
117 configured as a WINS server on the network. Some sites have used multiple Samba WINS
118 servers for redundancy (one server per subnet) and then used
119 <a class="indexterm" name="id2888330"></a><i class="parameter"><tt>remote browse sync</tt></i> and <a class="indexterm" name="id2888343"></a><i class="parameter"><tt>remote announce</tt></i>
120 to effect browse list collation across all segments. Note that this means clients
121 will only resolve local names, and must be configured to use DNS to resolve names
122 on other subnets in order to resolve the IP addresses of the servers they can see
123 on other subnets. This setup is not recommended, but is mentioned as a practical
125 </p><p>
126 Lastly, take note that browse lists are a collection of unreliable broadcast
127 messages that are repeated at intervals of not more than 15 minutes. This means
128 that it will take time to establish a browse list and it can take up to 45
129 minutes to stabilize, particularly across network segments.
130 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2888380"></a>TCP/IP without NetBIOS</h3></div></div><div></div></div><p>
134 All TCP/IP-enabled systems use various forms of host name resolution. The primary
135 methods for TCP/IP hostname resolution involve either a static file (<tt class="filename">/etc/hosts</tt>)
136 or the Domain Name System (DNS). DNS is the technology that makes
137 the Internet usable. DNS-based host name resolution is supported by nearly all
138 TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS.
139 </p><p>
140 When an MS Windows 200x/XP system attempts to resolve a host name to an IP address
141 it follows a defined path:
145 </p></li><li><p>
146 Does a DNS lookup.
147 </p></li><li><p>
148 Checks the NetBIOS name cache.
149 </p></li><li><p>
150 Queries the WINS server.
151 </p></li><li><p>
152 Does a broadcast name lookup over UDP.
153 </p></li><li><p>
154 Looks up entries in LMHOSTS. It is located in
156 </p></li></ol></div><p>
158 Windows 200x/XP can register its host name with a Dynamic DNS server. You can
159 force register with a Dynamic DNS server in Windows 200x/XP using:
161 </p><p>
162 With Active Directory (ADS), a correctly functioning DNS server is absolutely
163 essential. In the absence of a working DNS server that has been correctly configured,
164 MS Windows clients and servers will be unable to locate each other, so
165 consequently network services will be severely impaired.
166 </p><p>
167 The use of Dynamic DNS is highly recommended with Active Directory, in which case
168 the use of BIND9 is preferred for its ability to adequately support the SRV (service)
169 records that are needed for Active Directory.
170 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="adsdnstech"></a>DNS and Active Directory</h3></div></div><div></div></div><p>
172 Occasionally we hear from UNIX network administrators who want to use a UNIX-based Dynamic
173 DNS server in place of the Microsoft DNS server. While this might be desirable to some, the
174 MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible
176 so MS Active Directory clients can resolve host names to locate essential network services.
177 The following are some of the default service records that Active Directory requires:
178 </p><div class="variablelist"><dl><dt><span class="term">_ldap._tcp.pdc.ms-dcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
179 This provides the address of the Windows NT PDC for the Domain.
180 </p></dd><dt><span class="term">_ldap._tcp.pdc.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
181 Resolves the addresses of Global Catalog servers in the domain.
182 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>site</em></span>.sites.writable.ms-dcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
183 Provides list of Domain Controllers based on sites.
184 </p></dd><dt><span class="term">_ldap._tcp.writable.ms-dcs.<span class="emphasis"><em>Domain</em></span></span></dt><dd><p>
185 Enumerates list of Domain Controllers that have the writable copies of the Active Directory datastore.
186 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>GUID</em></span>.domains.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
187 Entry used by MS Windows clients to locate machines using the Global Unique Identifier.
188 </p></dd><dt><span class="term">_ldap._tcp.<span class="emphasis"><em>Site</em></span>.gc.ms-dcs.<span class="emphasis"><em>DomainTree</em></span></span></dt><dd><p>
189 Used by MS Windows clients to locate site configuration dependent Global Catalog server.
190 </p></dd></dl></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2888743"></a>How Browsing Functions</h2></div></div><div></div></div><p>
191 MS Windows machines register their NetBIOS names
192 (i.e., the machine name for each service type in operation) on start-up.
193 The exact method by which this name registration
194 takes place is determined by whether or not the MS Windows client/server
195 has been given a WINS server address, whether or not LMHOSTS lookup
196 is enabled, or if DNS for NetBIOS name resolution is enabled, etc.
197 </p><p>
198 In the case where there is no WINS server, all name registrations as
199 well as name lookups are done by UDP broadcast. This isolates name
200 resolution to the local subnet, unless LMHOSTS is used to list all
201 names and IP addresses. In such situations, Samba provides a means by
202 which the Samba server name may be forcibly injected into the browse
203 list of a remote MS Windows network (using the
204 <a class="indexterm" name="id2888773"></a><i class="parameter"><tt>remote announce</tt></i> parameter).
205 </p><p>
206 Where a WINS server is used, the MS Windows client will use UDP
207 unicast to register with the WINS server. Such packets can be routed
208 and thus WINS allows name resolution to function across routed networks.
209 </p><p>
210 During the startup process an election will take place to create a
211 Local Master Browser if one does not already exist. On each NetBIOS network
212 one machine will be elected to function as the Domain Master Browser. This
213 domain browsing has nothing to do with MS security Domain Control.
214 Instead, the Domain Master Browser serves the role of contacting each local
215 master browser (found by asking WINS or from LMHOSTS) and exchanging browse
216 list contents. This way every master browser will eventually obtain a complete
218 is held to determine which machine will be the master browser. By the nature of
219 the election criteria used, the machine with the highest uptime, or the
220 most senior protocol version or other criteria, will win the election
221 as Domain Master Browser.
222 </p><p>
223 Clients wishing to browse the network make use of this list, but also depend
224 on the availability of correct name resolution to the respective IP
225 address/addresses.
226 </p><p>
227 Any configuration that breaks name resolution and/or browsing intrinsics
228 will annoy users because they will have to put up with protracted
229 inability to use the network services.
230 </p><p>
231 Samba supports a feature that allows forced synchronization of browse lists across
232 routed networks using the <a class="indexterm" name="id2888836"></a><i class="parameter"><tt>remote browse sync</tt></i>
233 parameter in the <tt class="filename">smb.conf</tt> file. This causes Samba to contact the local master
234 browser on a remote network and to request browse list synchronization. This
235 effectively bridges two networks that are separated by routers. The two remote
236 networks may use either broadcast-based name resolution or WINS-based name
237 resolution, but it should be noted that the
238 <a class="indexterm" name="id2888863"></a><i class="parameter"><tt>remote browse sync</tt></i> parameter provides
239 browse list synchronization and that is distinct from name to address
240 resolution. In other words, for cross-subnet browsing to function correctly it is
241 essential that a name-to-address resolution mechanism be provided. This mechanism
243 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="DMB"></a>Configuring WORKGROUP Browsing</h3></div></div><div></div></div><p>
244 To configure cross-subnet browsing on a network containing machines
245 in a WORKGROUP, not an NT Domain, you need to set up one
246 Samba server to be the Domain Master Browser (note that this is not
247 the same as a Primary Domain Controller, although in an NT Domain the
248 same machine plays both roles). The role of a Domain Master Browser is
249 to collate the browse lists from Local Master Browsers on all the
250 subnets that have a machine participating in the workgroup. Without
251 one machine configured as a Domain Master Browser, each subnet would
252 be an isolated workgroup unable to see any machines on another
253 subnet. It is the presence of a Domain Master Browser that makes
254 cross-subnet browsing possible for a workgroup.
255 </p><p>
256 In a WORKGROUP environment the Domain Master Browser must be a
257 Samba server, and there must only be one Domain Master Browser per
258 workgroup name. To set up a Samba server as a Domain Master Browser,
261 </p><p>
262 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>domain master = yes</tt></i></td></tr></table><p>
263 </p><p>
264 The Domain Master Browser should preferably be the local master
265 browser for its own subnet. In order to achieve this, set the following
266 options in the <i class="parameter"><tt>[global]</tt></i> section of the <tt class="filename">smb.conf</tt>
268 </p><p>
269 </p><div class="example"><a name="dmbexample"></a><p class="title"><b>Example 10.1. Domain Master Browser smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>domain master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>local master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>preferred master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>os level = 65</tt></i></td></tr></table></div><p>
270 </p><p>
271 The Domain Master Browser may be the same machine as the WINS server, if necessary.
272 </p><p>
273 Next, you should ensure that each of the subnets contains a machine that can act as
274 a Local Master Browser for the workgroup. Any MS Windows NT/200x/XP machine should
275 be able to do this, as will Windows 9x/Me machines (although these tend to get
276 rebooted more often, so it is not such a good idea to use these). To make a Samba
277 server a Local Master Browser set the following options in the
278 <i class="parameter"><tt>[global]</tt></i> section of the <tt class="filename">smb.conf</tt> file as
280 </p><p>
281 </p><div class="example"><a name="lmbexample"></a><p class="title"><b>Example 10.2. Local master browser smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>domain master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>local master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>preferred master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>os level = 65</tt></i></td></tr></table></div><p>
282 </p><p>
283 Do not do this for more than one Samba server on each subnet, or they will war with
284 each other over which is to be the Local Master Browser.
285 </p><p>
286 The <a class="indexterm" name="id2899988"></a><i class="parameter"><tt>local master</tt></i> parameter allows Samba to act as a
287 Local Master Browser. The <a class="indexterm" name="id2900005"></a><i class="parameter"><tt>preferred master</tt></i> causes <b class="command">nmbd</b>
288 to force a browser election on startup and the <a class="indexterm" name="id2900026"></a><i class="parameter"><tt>os level</tt></i>
289 parameter sets Samba high enough so it should win any browser elections.
290 </p><p>
291 If you have an NT machine on the subnet that you wish to be the Local Master Browser, you can disable Samba from
292 becoming a Local Master Browser by setting the following options in the <i class="parameter"><tt>[global]</tt></i> section of the
294 </p><p>
295 </p><div class="example"><a name="nombexample"></a><p class="title"><b>Example 10.3. smb.conf for not being a Master Browser</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>domain master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>local master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>preferred master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>os level = 0</tt></i></td></tr></table></div><p>
296 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900135"></a>DOMAIN Browsing Configuration</h3></div></div><div></div></div><p>
297 If you are adding Samba servers to a Windows NT Domain, then you must not set up a Samba server as a Domain Master Browser.
298 By default, a Windows NT Primary Domain Controller for a domain is also the Domain Master Browser for that domain. Network
299 browsing may break if a Samba server registers the domain master browser NetBIOS name (<i class="replaceable"><tt>DOMAIN</tt></i><1B>)
300 with WINS instead of the PDC.
301 </p><p>
302 For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as Local Master Browsers as
303 described. To make a Samba server a Local Master Browser, set the following options in the <i class="parameter"><tt>[global]</tt></i> section
305 </p><p>
306 </p><div class="example"><a name="remsmb"></a><p class="title"><b>Example 10.4. Local Master Browser smb.conf</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>domain master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>local master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>preferred master = yes</tt></i></td></tr><tr><td><i class="parameter"><tt>os level = 65</tt></i></td></tr></table></div><p>
307 </p><p>
308 If you wish to have a Samba server fight the election with machines on the same subnet you
309 may set the <a class="indexterm" name="id2900256"></a><i class="parameter"><tt>os level</tt></i> parameter to lower levels.
310 By doing this you can tune the order of machines that will become Local Master Browsers if
312 </p><p>
313 If you have Windows NT machines that are members of the domain on all subnets and you are
314 sure they will always be running, you can disable Samba from taking part in browser elections
315 and ever becoming a Local Master Browser by setting the following options in the
316 <i class="parameter"><tt>[global]</tt></i> section of the <tt class="filename">smb.conf</tt> file as shown in <link linkend="xremmb">:
317 </p><p>
318 </p><div class="example"><a name="xremmb"></a><p class="title"><b>Example 10.5. smb.conf for not being a master browser</b></p><table class="simplelist" border="0" summary="Simple list"><tr><td> </td></tr><tr><td><i class="parameter"><tt>[global]</tt></i></td></tr><tr><td><i class="parameter"><tt>domain master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>local master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>preferred master = no</tt></i></td></tr><tr><td><i class="parameter"><tt>os level = 0</tt></i></td></tr></table></div><p>
319 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="browse-force-master"></a>Forcing Samba to Be the Master</h3></div></div><div></div></div><p>
320 Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters
321 that determine what precedence (bias) a host should have in the election. By default Samba uses a low precedence and thus loses
322 elections to just about every Windows network server or client.
323 </p><p>
324 If you want Samba to win elections, set the <a class="indexterm" name="id2900406"></a><i class="parameter"><tt>os level</tt></i>
325 global option in <tt class="filename">smb.conf</tt> to a higher number. It defaults to zero. Using 34 would make it win
326 all elections every other system (except other samba systems).
327 </p><p>
328 An <a class="indexterm" name="id2900432"></a><i class="parameter"><tt>os level</tt></i> of two would make it beat Windows for Workgroups and Windows 9x/Me, but not MS Windows
329 NT/200x Server. An MS Windows NT/200x Server Domain Controller uses level 32. The maximum os level is 255.
330 </p><p>
331 If you want Samba to force an election on startup, set the
332 <a class="indexterm" name="id2900455"></a><i class="parameter"><tt>preferred master</tt></i> global option in <tt class="filename">smb.conf</tt> to <tt class="constant">yes</tt>.
333 Samba will then have a slight advantage over other potential master browsers that are not Perferred Master Browsers.
334 Use this parameter with care, as if you have two hosts (whether they are Windows 9x/Me or
335 NT/200x/XP or Samba) on the same local subnet both set with <a class="indexterm" name="id2900485"></a><i class="parameter"><tt>preferred master</tt></i>
336 to <tt class="constant">yes</tt>, then periodically and continually they will force an election in order
337 to become the Local Master Browser.
338 </p><p>
339 If you want Samba to be a <span class="emphasis"><em>Domain Master Browser</em></span>, then it is recommended that
340 you also set <a class="indexterm" name="id2900514"></a><i class="parameter"><tt>preferred master</tt></i> to <tt class="constant">yes</tt>, because
341 Samba will not become a Domain Master Browser for the whole of your LAN or WAN if it is not also a
342 Local Master Browser on its own broadcast isolated subnet.
343 </p><p>
344 It is possible to configure two Samba servers to attempt to become the Domain Master Browser for a domain. The first server that comes
345 up will be the Domain Master Browser. All other Samba servers will attempt to become the Domain Master Browser every five minutes. They
346 will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should
347 the current Domain Master Browser fail.
348 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900550"></a>Making Samba the Domain Master</h3></div></div><div></div></div><p>
349 The domain master is responsible for collating the browse lists of multiple subnets so browsing can occur between subnets. You can
350 make Samba act as the Domain Master by setting <a class="indexterm" name="id2900564"></a><i class="parameter"><tt>domain master</tt></i> = yes
352 </p><p>
353 Do not set Samba to be the Domain Master for a workgroup that has the same name as an NT/200x Domain.
354 If Samba is configured to be the Domain Master for a workgroup that is present on the same
355 network as a Windows NT/200x domain that has the same name, network browsing problems will
356 certainly be experienced.
357 </p><p>
358 When Samba is the Domain Master and the Master Browser, it will listen for master
359 announcements (made roughly every twelve minutes) from Local Master Browsers on
360 other subnets and then contact them to synchronize browse lists.
361 </p><p>
362 If you want Samba to be the domain master, you should also set the
363 <a class="indexterm" name="id2900610"></a><i class="parameter"><tt>os level</tt></i> high enough to make sure it wins elections, and
364 set <a class="indexterm" name="id2900625"></a><i class="parameter"><tt>preferred master</tt></i> to <tt class="constant">yes</tt>, to
365 get Samba to force an election on startup.
366 </p><p>
367 All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your
368 clients are only using broadcasting to resolve NetBIOS names, then two things will occur:
370 Local Master Browsers will be unable to find a Domain Master Browser, as they will be looking only on the local subnet.
371 </p></li><li><p>
372 If a client happens to get hold of a domain-wide browse list and a user attempts to access a
373 host in that list, it will be unable to resolve the NetBIOS name of that host.
374 </p></li></ol></div><p>
375 If, however, both Samba and your clients are using a WINS server, then:
377 Local master browsers will contact the WINS server and, as long as Samba has registered that it is a Domain Master Browser with the WINS
378 server, the Local Master Browser will receive Samba's IP address as its Domain Master Browser.
379 </p></li><li><p>
380 When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will contact the WINS server to
381 resolve the NetBIOS name of that host. As long as that host has registered its NetBIOS name with the same WINS server, the user will
382 be able to see that host.
383 </p></li></ol></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900727"></a>Note about Broadcast Addresses</h3></div></div><div></div></div><p>
384 If your network uses a 0 based broadcast address (for example, if it ends in a 0) then you will strike problems. Windows for Workgroups
385 does not seem to support a zeros broadcast and you will probably find that browsing and name lookups will not work.
386 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900745"></a>Multiple Interfaces</h3></div></div><div></div></div><p>
387 Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will
388 need to use the <a class="indexterm" name="id2900757"></a><i class="parameter"><tt>interfaces</tt></i> option in <tt class="filename">smb.conf</tt> to configure them.
389 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900780"></a>Use of the Remote Announce Parameter</h3></div></div><div></div></div><p>
390 The <a class="indexterm" name="id2900790"></a><i class="parameter"><tt>remote announce</tt></i> parameter of
392 that all the NetBIOS names on a network get announced to a remote network.
393 The syntax of the <a class="indexterm" name="id2900814"></a><i class="parameter"><tt>remote announce</tt></i> parameter is:
394 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>remote announce = a.b.c.d [e.f.g.h] ...</tt></i></td></tr></table><p>
396 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>remote announce = a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...</tt></i></td></tr></table><p>
398 where:
399 </p><div class="variablelist"><dl><dt><span class="term"><i class="replaceable"><tt>a.b.c.d</tt></i> and <i class="replaceable"><tt>e.f.g.h</tt></i></span></dt><dd><p>
402 is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network.
403 i.e., the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask
405 address of the remote network, every host will receive our announcements. This is noisy and therefore
406 undesirable but may be necessary if we do not know the IP address of the remote LMB.
407 </p></dd><dt><span class="term"><i class="replaceable"><tt>WORKGROUP</tt></i></span></dt><dd><p>is optional and can be either our own workgroup or that of the remote network. If you use the
408 workgroup name of the remote network, our NetBIOS machine names will end up looking like
409 they belong to that workgroup. This may cause name resolution problems and should be avoided.
410 </p></dd></dl></div><p>
411 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2900939"></a>Use of the Remote Browse Sync Parameter</h3></div></div><div></div></div><p>
412 The <a class="indexterm" name="id2900949"></a><i class="parameter"><tt>remote browse sync</tt></i> parameter of
413 <tt class="filename">smb.conf</tt> is used to announce to another LMB that it must synchronize its NetBIOS name list with our
414 Samba LMB. This works only if the Samba server that has this option is
415 simultaneously the LMB on its network segment.
416 </p><p>
417 The syntax of the <a class="indexterm" name="id2900978"></a><i class="parameter"><tt>remote browse sync</tt></i> parameter is:
419 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>remote browse sync = a.b.c.d</tt></i></td></tr></table><p>
422 remote LMB or else is the network broadcast address of the remote segment.
423 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901016"></a>WINS The Windows Internetworking Name Server</h2></div></div><div></div></div><p>
424 Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly
425 recommended. Every NetBIOS machine registers its name together with a
426 name_type value for each of several types of service it has available.
427 It registers its name directly as a unique (the type 0x03) name.
428 It also registers its name if it is running the LanManager compatible
429 server service (used to make shares and printers available to other users)
430 by registering the server (the type 0x20) name.
431 </p><p>
432 All NetBIOS names are up to 15 characters in length. The name_type variable
433 is added to the end of the name, thus creating a 16 character name. Any
435 character. Thus, all NetBIOS names are 16 characters long (including the
436 name_type information).
437 </p><p>
438 WINS can store these 16-character names as they get registered. A client
439 that wants to log onto the network can ask the WINS server for a list
440 of all names that have registered the NetLogon service name_type. This saves
441 broadcast traffic and greatly expedites logon processing. Since broadcast
442 name resolution cannot be used across network segments this type of
443 information can only be provided via WINS or via a statically configured
445 absence of WINS.
446 </p><p>
447 WINS also serves the purpose of forcing browse list synchronization by all
448 LMBs. LMBs must synchronize their browse list with the DMB (Domain Master
449 Browser) and WINS helps the LMB to identify its DMB. By definition this
450 will work only within a single workgroup. Note that the Domain Master Browser
451 has nothing to do with what is referred to as an MS Windows NT Domain. The
452 later is a reference to a security environment while the DMB refers to the
453 master controller for browse list information only.
454 </p><p>
455 WINS will work correctly only if every client TCP/IP protocol stack
456 has been configured to use the WINS servers. Any client that has not been
457 configured to use the WINS server will continue to use only broadcast-based
458 name registration so WINS may never get to know about it. In any case,
459 machines that have not registered with a WINS server will fail name to address
460 lookup attempts by other clients and will therefore cause workstation access
461 errors.
462 </p><p>
463 To configure Samba as a WINS server just add
464 <a class="indexterm" name="id2901110"></a><i class="parameter"><tt>wins support</tt></i> = yes to the <tt class="filename">smb.conf</tt>
465 file [global] section.
466 </p><p>
467 To configure Samba to register with a WINS server just add
468 <a class="indexterm" name="id2901137"></a><i class="parameter"><tt>wins server</tt></i> = a.b.c.d
469 to your <tt class="filename">smb.conf</tt> file <i class="parameter"><tt>[global]</tt></i> section.
470 </p><div class="important" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Important</h3><p>
471 Never use both <a class="indexterm" name="id2901170"></a><i class="parameter"><tt>wins support</tt></i> = yes together
472 with <a class="indexterm" name="id2901185"></a><i class="parameter"><tt>wins server</tt></i> = a.b.c.d
473 particularly not using its own IP address. Specifying both will cause <span class="application">nmbd</span> to refuse to start!
474 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901208"></a>WINS Server Configuration</h3></div></div><div></div></div><p>
475 Either a Samba Server or a Windows NT Server machine may be set up
476 as a WINS server. To configure a Samba Server to be a WINS server you must
479 </p><p>
480 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>wins support = yes</tt></i></td></tr></table><p>
481 </p><p>
482 Versions of Samba prior to 1.9.17 had this parameter default to
483 yes. If you have any older versions of Samba on your network it is
484 strongly suggested you upgrade to a recent version, or at the very
486 </p><p>
487 Machines configured with <a class="indexterm" name="id2901271"></a><i class="parameter"><tt>wins support</tt></i> = yes will keep a list of
488 all NetBIOS names registered with them, acting as a DNS for NetBIOS names.
489 </p><p>
490 It is strongly recommended to set up only one WINS server. Do not set the
491 <a class="indexterm" name="id2901293"></a><i class="parameter"><tt>wins support</tt></i> = yes option on more than one Samba
492 server.
493 </p><p>
495 To configure Windows NT/200x Server as a WINS server, install and configure
496 the WINS service. See the Windows NT/200x documentation for details.
497 Windows NT/200x WINS servers can replicate to each other, allowing more
498 than one to be set up in a complex subnet environment. As Microsoft
499 refuses to document the replication protocols, Samba cannot currently
500 participate in these replications. It is possible in the future that
501 a Samba-to-Samba WINS replication protocol may be defined, in which
502 case more than one Samba machine could be set up as a WINS server.
503 Currently only one Samba server should have the
504 <a class="indexterm" name="id2901335"></a><i class="parameter"><tt>wins support</tt></i> = yes parameter set.
505 </p><p>
506 After the WINS server has been configured, you must ensure that all
507 machines participating on the network are configured with the address
508 of this WINS server. If your WINS server is a Samba machine, fill in
510 the <span class="guilabel">Control Panel->Network->Protocols->TCP->WINS Server</span> dialogs
512 of the WINS server, add the following line to the <i class="parameter"><tt>[global]</tt></i> section of
514 </p><p>
515 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>wins server = <name or IP address></tt></i></td></tr></table><p>
516 </p><p>
518 machine or its IP address.
519 </p><p>
521 server acting as the WINS server itself. If you set both the
522 <a class="indexterm" name="id2901432"></a><i class="parameter"><tt>wins support</tt></i> = yes option and the
523 <a class="indexterm" name="id2901447"></a><i class="parameter"><tt>wins server</tt></i> = <name> option then
525 </p><p>
526 There are two possible scenarios for setting up cross-subnet browsing.
527 The first details setting up cross-subnet browsing on a network containing
529 part of a Windows NT Domain. The second details setting up cross-subnet
530 browsing on networks that contain NT Domains.
531 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901481"></a>WINS Replication</h3></div></div><div></div></div><p>
533 Samba-3 permits WINS replication through the use of the <tt class="filename">wrepld</tt> utility.
534 This tool is not currently capable of being used as it is still in active development.
535 As soon as this tool becomes moderately functional, we will prepare man pages and enhance this
536 section of the documentation to provide usage and technical details.
537 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901518"></a>Static WINS Entries</h3></div></div><div></div></div><p>
538 Adding static entries to your Samba WINS server is actually fairly easy.
541 </p><p>
545 "NAME#TYPE" TTL ADDRESS+ FLAGS
546 </pre><p>
548 where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the
549 time-to-live as an absolute time in seconds, ADDRESS+ is one or more
550 addresses corresponding to the registration and FLAGS are the NetBIOS
551 flags for the registration.
552 </p><p>
553 A typical dynamic entry looks like this:
556 </pre><p>
558 To make it static, all that has to be done is set the TTL to 0, like this:
562 </pre><p>
563 </p><p>
564 Though this method works with early Samba-3 versions, there is a
565 possibility that it may change in future versions if WINS replication
566 is added.
567 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901602"></a>Helpful Hints</h2></div></div><div></div></div><p>
568 The following hints should be carefully considered as they are stumbling points
569 for many new network administrators.
570 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901616"></a>Windows Networking Protocols</h3></div></div><div></div></div><div class="warning" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Warning</h3><p>
571 Do not use more than one protocol on MS Windows machines.
572 </p></div><p>
573 A common cause of browsing problems results from installing more than
574 one protocol on an MS Windows machine.
575 </p><p>
576 Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
577 every 15 minutes. A set of election criteria is used to determine the order
578 of precedence for winning this election process. A machine running Samba or
579 Windows NT will be biased so the most suitable machine will predictably
580 win and thus retain its role.
581 </p><p>
582 The election process is “<span class="quote">fought out</span>” so to speak over every NetBIOS network
583 interface. In the case of a Windows 9x/Me machine that has both TCP/IP and IPX
584 installed and has NetBIOS enabled over both protocols, the election will be
585 decided over both protocols. As often happens, if the Windows 9x/Me machine is
586 the only one with both protocols then the LMB may be won on the NetBIOS
587 interface over the IPX protocol. Samba will then lose the LMB role as Windows
588 9x/Me will insist it knows who the LMB is. Samba will then cease to function
589 as an LMB and thus browse list operation on all TCP/IP-only machines will
590 fail.
591 </p><p>
593 The Windows NT4, 200x, and XP use common protocols. These are roughly
594 referred to as the Windows NT family, but it should be recognized that 2000 and
595 XP/2003 introduce new protocol extensions that cause them to behave
596 differently from MS Windows NT4. Generally, where a server does not support
597 the newer or extended protocol, these will fall back to the NT4 protocols.
598 </p><p>
599 The safest rule of all to follow is: use only one protocol!
600 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901696"></a>Name Resolution Order</h3></div></div><div></div></div><p>
601 Resolution of NetBIOS names to IP addresses can take place using a number
602 of methods. The only ones that can provide NetBIOS name_type information
603 are:
604 </p><div class="itemizedlist"><ul type="disc"><li>WINS the best tool.</li><li>LMHOSTS static and hard to maintain.</li><li>Broadcast uses UDP and cannot resolve names across remote segments.</li></ul></div><p>
605 Alternative means of name resolution include:
606 </p><div class="itemizedlist"><ul type="disc"><li>Static <tt class="filename">/etc/hosts</tt> hard to maintain, and lacks name_type info.</li><li>DNS is a good choice but lacks essential name_type info.</li></ul></div><p>
607 Many sites want to restrict DNS lookups and avoid broadcast name
608 resolution traffic. The <i class="parameter"><tt>name resolve order</tt></i> parameter is of great help here.
610 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>name resolve order = wins lmhosts bcast host</tt></i></td></tr></table><p>
612 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>name resolve order = wins lmhosts (eliminates bcast and host)</tt></i></td></tr></table><p>
613 The default is:
614 </p><table class="simplelist" border="0" summary="Simple list"><tr><td><i class="parameter"><tt>name resolve order = host lmhost wins bcast</tt></i></td></tr></table><p>
615 where “<span class="quote">host</span>” refers to the native methods used by the UNIX system
616 to implement the gethostbyname() function call. This is normally
617 controlled by <tt class="filename">/etc/host.conf</tt>, <tt class="filename">/etc/nsswitch.conf</tt> and <tt class="filename">/etc/resolv.conf</tt>.
618 </p></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2901872"></a>Technical Overview of Browsing</h2></div></div><div></div></div><p>
619 SMB networking provides a mechanism by which clients can access a list
620 of machines in a network, a so-called <a class="indexterm" name="id2901884"></a><i class="parameter"><tt>browse list</tt></i>. This list
621 contains machines that are ready to offer file and/or print services
622 to other machines within the network. Thus it does not include
623 machines that aren't currently able to do server tasks. The browse
624 list is heavily used by all SMB clients. Configuration of SMB
625 browsing has been problematic for some Samba users, hence this
626 document.
627 </p><p>
629 configured to not use NetBIOS over TCP/IP. When configured this way,
630 it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
631 configured and operative. Browsing will not work if name resolution
632 from SMB machine names to IP addresses does not function correctly.
633 </p><p>
634 Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly
635 recommended to aid the resolution of NetBIOS (SMB) names to IP addresses.
636 WINS allows remote segment clients to obtain NetBIOS name_type information
637 that cannot be provided by any other means of name resolution.
638 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2901926"></a>Browsing Support in Samba</h3></div></div><div></div></div><p>
641 Samba can act as a local browse master for a workgroup and the ability
642 to support domain logons and scripts is now available.
643 </p><p>
644 Samba can also act as a Domain Master Browser for a workgroup. This
645 means that it will collate lists from Local Master Browsers into a
646 wide area network server list. In order for browse clients to
647 resolve the names they may find in this list, it is recommended that
648 both Samba and your clients use a WINS server.
649 </p><p>
650 Do not set Samba to be the Domain Master for a workgroup that has the same
651 name as an NT Domain. On each wide area network, you must only ever have one
652 Domain Master Browser per workgroup, regardless of whether it is NT, Samba
653 or any other type of domain master that is providing this service.
654 </p><div class="note" style="margin-left: 0.5in; margin-right: 0.5in;"><h3 class="title">Note</h3><p>
656 necessary to specifically use Samba as your WINS server. MS Windows
657 NT4, Server or Advanced Server 200x can be configured as
658 your WINS server. In a mixed NT/200x server and Samba environment on
659 a Wide Area Network, it is recommended that you use the Microsoft
660 WINS server capabilities. In a Samba-only environment, it is
661 recommended that you use one and only one Samba server as the WINS server.
662 </p></div><p>
663 To get browsing to work you need to run nmbd as usual, but will need
664 to use the <a class="indexterm" name="id2902000"></a><i class="parameter"><tt>workgroup</tt></i> option in <tt class="filename">smb.conf</tt>
665 to control what workgroup Samba becomes a part of.
666 </p><p>
667 Samba also has a useful option for a Samba server to offer itself for
668 browsing on another subnet. It is recommended that this option is only
669 used for “<span class="quote">unusual</span>” purposes: announcements over the Internet, for
670 example. See <a class="indexterm" name="id2902033"></a><i class="parameter"><tt>remote announce</tt></i> in the
672 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2902057"></a>Problem Resolution</h3></div></div><div></div></div><p>
674 to track down the problem. Try a <a class="indexterm" name="id2902075"></a><i class="parameter"><tt>log level</tt></i> of 2 or 3 for finding
675 problems. Also note that the current browse list usually gets stored
677 </p><p>
678 If it does not work, you should still be able to
679 type the server name as <tt class="filename">\\SERVER</tt> in <b class="command">filemanager</b>, then
681 </p><p>
682 Some people find browsing fails because they do not have the global
683 <a class="indexterm" name="id2902130"></a><i class="parameter"><tt>guest account</tt></i> set to a valid account. Remember that the
684 IPC$ connection that lists the shares is done as guest and, thus, you must have a valid guest account.
685 </p><p>
686 MS Windows 2000 and later (as with Samba) can be configured to disallow
687 anonymous (i.e., guest account) access to the IPC$ share. In that case, the
689 name of the currently logged-in user to query the IPC$ share. MS Windows
690 9x/Me clients are not able to do this and thus will not be able to browse
691 server resources.
692 </p><p>
693 The other big problem people have is that their broadcast address,
694 netmask or IP address is wrong (specified with the <a class="indexterm" name="id2902164"></a><i class="parameter"><tt>interfaces</tt></i> option
696 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2902187"></a>Cross-Subnet Browsing</h3></div></div><div></div></div><p>
698 Since the release of Samba 1.9.17 (alpha1), Samba has supported the
699 replication of browse lists across subnet boundaries. This section
700 describes how to set this feature up in different settings.
701 </p><p>
702 To see browse lists that span TCP/IP subnets (i.e., networks separated
703 by routers that do not pass broadcast traffic), you must set up at least
704 one WINS server. The WINS server acts as a DNS for NetBIOS names. This will
705 allow NetBIOS name-to-IP address translation to be completed by a direct
706 query of the WINS server. This is done via a directed UDP packet on
707 port 137 to the WINS server machine. The WINS server avoids the necessity
708 of default NetBIOS name-to-IP address translation, which is done
709 using UDP broadcasts from the querying machine. This means that machines
710 on one subnet will not be able to resolve the names of machines on
711 another subnet without using a WINS server.
712 </p><p>
713 Remember, for browsing across subnets to work correctly, all machines,
714 be they Windows 95, Windows NT or Samba servers, must have the IP address
715 of a WINS server given to them by a DHCP server, or by manual configuration
718 </p><div class="sect3" lang="en"><div class="titlepage"><div><div><h4 class="title"><a name="id2902248"></a>Behavior of Cross-Subnet Browsing</h4></div></div><div></div></div><p>
719 Cross-subnet Browsing is a complicated dance, containing multiple
720 moving parts. It has taken Microsoft several years to get the code
721 that achieves this correct, and Samba lags behind in some areas.
722 Samba is capable of cross-subnet browsing when configured correctly.
723 </p><p>
725 </p><div class="figure"><a name="browsing1"></a><p class="title"><b>Figure 10.1. Cross-Subnet Browsing Example.</b></p><div class="mediaobject"><img src="projdoc/imagefiles/browsing1.png" width="270" alt="Cross-Subnet Browsing Example."></div></div><p>
727 (R1, R2) which do not pass broadcasts. Subnet 1 has five machines
729 for the moment that all machines are configured to be in the
730 same workgroup (for simplicity's sake). Machine N1_C on subnet 1
731 is configured as Domain Master Browser (i.e., it will collate the
732 browse lists for the workgroup). Machine N2_D is configured as
733 WINS server and all the other machines are configured to register
734 their NetBIOS names with it.
735 </p><p>
736 As these machines are booted up, elections for master browsers
737 will take place on each of the three subnets. Assume that machine
739 subnet 3. These machines are known as Local Master Browsers for
740 their particular subnet. N1_C has an advantage in winning as the
741 Local Master Browser on subnet 1 as it is set up as Domain Master
742 Browser.
743 </p><p>
744 On each of the three networks, machines that are configured to
745 offer sharing services will broadcast that they are offering
746 these services. The Local Master Browser on each subnet will
747 receive these broadcasts and keep a record of the fact that
748 the machine is offering a service. This list of records is
749 the basis of the browse list. For this case, assume that
750 all the machines are configured to offer services, so all machines
751 will be on the browse list.
752 </p><p>
753 For each network, the Local Master Browser on that network is
754 considered “<span class="quote">authoritative</span>” for all the names it receives via
755 local broadcast. This is because a machine seen by the Local Master
756 Browser via a local broadcast must be on the same network as the
758 and “<span class="quote">verifiable</span>” resource. Machines on other networks that
759 the Local Master Browsers learn about when collating their
760 browse lists have not been directly seen. These records are
762 </p><p>
764 the machines you would see in your network neighborhood if you looked in it on a particular network right now).
765 </p><p>
766 </p><div class="table"><a name="browsubnet"></a><p class="title"><b>Table 10.1. Browse Subnet Example 1</b></p><table summary="Browse Subnet Example 1" border="1"><colgroup><col><col><col></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="left">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="left">N1_A, N1_B, N1_C, N1_D, N1_E</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="left">N2_A, N2_B, N2_C, N2_D</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="left">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div><p>
767 </p><p>
768 At this point all the subnets are separate, and no machine is seen across any of the subnets.
769 </p><p>
770 Now examine subnet 2. As soon as N2_B has become the Local
771 Master Browser it looks for a Domain Master Browser with which to synchronize
772 its browse list. It does this by querying the WINS server
773 (N2_D) for the IP address associated with the NetBIOS name
775 Browser (N1_C) with the WINS server as soon as it was started.
776 </p><p>
777 Once N2_B knows the address of the Domain Master Browser, it
778 tells it that is the Local Master Browser for subnet 2 by
779 sending a <span class="emphasis"><em>MasterAnnouncement</em></span> packet as a UDP port 138 packet.
780 It then synchronizes with it by doing a <span class="emphasis"><em>NetServerEnum2</em></span> call. This
781 tells the Domain Master Browser to send it all the server
782 names it knows about. Once the Domain Master Browser receives
783 the <span class="emphasis"><em>MasterAnnouncement</em></span> packet, it schedules a synchronization
784 request to the sender of that packet. After both synchronizations
786 </p><div class="table"><a name="brsbex"></a><p class="title"><b>Table 10.2. Browse Subnet Example 2</b></p><table summary="Browse Subnet Example 2" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
787 N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
788 N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D</td></tr></tbody></table></div><p>
789 Servers with an (*) after them are non-authoritative names.
790 </p><p>
791 At this point users looking in their network neighborhood on
793 subnet 3 will still only see the servers on their own subnet.
794 </p><p>
795 The same sequence of events that occurred for N2_B now occurs
796 for the Local Master Browser on subnet 3 (N3_D). When it
797 synchronizes browse lists with the Domain Master Browser (N1_A)
798 it gets both the server entries on subnet 1, and those on
799 subnet 2. After N3_D has synchronized with N1_C and vica versa,
801 </p><div class="table"><a name="brsex2"></a><p class="title"><b>Table 10.3. Browse Subnet Example 3</b></p><table summary="Browse Subnet Example 3" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
802 N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
803 N1_B(*), N1_C(*), N1_D(*), N1_E(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D, N1_A(*),
804 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)</td></tr></tbody></table></div><p>
805 Servers with an (*) after them are non-authoritative names.
806 </p><p>
807 At this point, users looking in their network neighborhood on
810 </p><p>
811 Finally, the Local Master Browser for subnet 2 (N2_B) will sync again
812 with the Domain Master Browser (N1_C) and will receive the missing
813 server entries. Finally, as when a steady state (if no machines
814 are removed or shut off) has been achieved, the browse lists will appear
816 </p><div class="table"><a name="brsex3"></a><p class="title"><b>Table 10.4. Browse Subnet Example 4</b></p><table summary="Browse Subnet Example 4" border="1"><colgroup><col align="left"><col align="left"><col align="justify"></colgroup><thead><tr><th align="left">Subnet</th><th align="left">Browse Master</th><th align="justify">List</th></tr></thead><tbody><tr><td align="left">Subnet1</td><td align="left">N1_C</td><td align="justify">N1_A, N1_B, N1_C, N1_D, N1_E,
817 N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*),
818 N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet2</td><td align="left">N2_B</td><td align="justify">N2_A, N2_B, N2_C, N2_D, N1_A(*),
819 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*),
820 N3_C(*), N3_D(*)</td></tr><tr><td align="left">Subnet3</td><td align="left">N3_D</td><td align="justify">N3_A, N3_B, N3_C, N3_D, N1_A(*),
821 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*),
822 N2_C(*), N2_D(*)</td></tr></tbody></table></div><p>
823 Servers with an (*) after them are non-authoritative names.
824 </p><p>
825 Synchronizations between the Domain Master Browser and Local
826 Master Browsers will continue to occur, but this should remain a
827 steady state operation.
828 </p><p>
829 If either router R1 or R2 fails, the following will occur:
831 Names of computers on each side of the inaccessible network fragments
832 will be maintained for as long as 36 minutes in the network neighborhood
833 lists.
834 </p></li><li><p>
835 Attempts to connect to these inaccessible computers will fail, but the
836 names will not be removed from the network neighborhood lists.
837 </p></li><li><p>
838 If one of the fragments is cut off from the WINS server, it will only
839 be able to access servers on its local subnet using subnet-isolated
840 broadcast NetBIOS name resolution. The effects are similar to that of
841 losing access to a DNS server.
842 </p></li></ol></div></div></div></div><div class="sect1" lang="en"><div class="titlepage"><div><div><h2 class="title" style="clear: both"><a name="id2902960"></a>Common Errors</h2></div></div><div></div></div><p>
843 Many questions are asked on the mailing lists regarding browsing. The majority of browsing
844 problems originate from incorrect configuration of NetBIOS name resolution. Some are of
845 particular note.
846 </p><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2902975"></a>How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?</h3></div></div><div></div></div><p>
848 Samba's <b class="command">nmbd</b> process controls all browse list handling. Under normal circumstances it is
849 safe to restart <b class="command">nmbd</b>. This will effectively flush the Samba NetBIOS name cache and cause it
850 to be rebuilt. This does not make certain that a rogue machine name will not re-appear
851 in the browse list. When <b class="command">nmbd</b> is taken out of service, another machine on the network will
852 become the Browse Master. This new list may still have the rogue entry in it. If you really
853 want to clear a rogue machine from the list, every machine on the network will need to be
854 shut down and restarted after all machines are down. Failing a complete restart, the only
855 other thing you can do is wait until the entry times out and is then flushed from the list.
856 This may take a long time on some networks (perhaps months).
857 </p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2903041"></a>Server Resources Can Not Be Listed</h3></div></div><div></div></div><p>“<span class="quote">My Client Reports ‘<span class="quote">This server is not configured to list shared resources</span>’</span>”</p><p>
858 Your guest account is probably invalid for some reason. Samba uses the
860 valid.
861 </p><p>Also see <a class="indexterm" name="id2903074"></a><i class="parameter"><tt>guest account</tt></i> in the <tt class="filename">smb.conf</tt> man page.</p></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2903097"></a>I get an <span class="errorname">`Unable to browse the network'</span> error</h3></div></div><div></div></div><p>This error can have multiple causes:
863 </p><div class="itemizedlist"><ul type="disc"><li><p>There is no Local Master Browser. Configure <span class="application">nmbd</span>
864 or any other machine to serve as Local Master Browser.</p></li><li><p>You cannot log onto the machine that is the local master
865 browser. Can you logon to it as a guest user? </p></li><li><p>There is no IP connectivity to the Local Master Browser.
866 Can you reach it by broadcast?</p></li></ul></div></div><div class="sect2" lang="en"><div class="titlepage"><div><div><h3 class="title"><a name="id2903157"></a>Browsing of Shares and Directories is Very Slow</h3></div></div><div></div></div><p>“<span class="quote">
868 There are only two machines on a test network. One a Samba server, the other a Windows XP machine.
869 Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the
870 Windows XP client becomes unrespsonsive. Sometimes it does not respond for some minutes. Eventually,
871 Windows Explorer will respond and displays files and directories without problem.
874 But, the share is immediately available from a command shell (<b class="command">cmd</b>, followed by
875 exploration with dos command. Is this a Samba problem or is it a Windows problem? How can I solve this?
877 Here are a few possibilities:
878 </p><div class="variablelist"><dl><dt><span class="term">Bad Networking Hardware</span></dt><dd><p>
881 Most common defective hardware problems center around low cost or defective HUBs, routers,
882 Network Interface Controllers (NICs) and bad wiring. If one piece of hardware is defective
883 the whole network may suffer. Bad networking hardware can cause data corruption. Most bad
884 networking hardware problems are accompanied by an increase in apparent network traffic,
885 but not all.
887 A number of sites have reported similar slow network browsing problems and found that when
888 the WebClient service is turned off, the problem dissapears. This is certainly something
889 that should be explored as it is a simple solution if it works.
891 This type of problem is common when one client is configured to use a WINS server (that is
892 a TCP/IP configuration setting) and there is no WINS server on the network. Alternately,
893 this will happen is there is a WINS server and Samba is not configured to use it. The use of
894 WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use
895 of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS
896 server neither should it be configured to use one.
898 If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server
900 </p></dd></dl></div></div></div></div><div class="navfooter"><hr><table width="100%" summary="Navigation footer"><tr><td width="40%" align="left"><a accesskey="p" href="optional.html">Prev</a> </td><td width="20%" align="center"><a accesskey="u" href="optional.html">Up</a></td><td width="40%" align="right"> <a accesskey="n" href="passdb.html">Next</a></td></tr><tr><td width="40%" align="left" valign="top">Part III. Advanced Configuration </td><td width="20%" align="center"><a accesskey="h" href="index.html">Home</a></td><td width="40%" align="right" valign="top"> Chapter 11. Account Information Databases</td></tr></table></div></body></html>