1 <?xml version="1.0" encoding="iso-8859-1"?>
2 <!DOCTYPE book PUBLIC "-//OASIS//DTD DocBook XML V4.2//EN"
3 "http://www.oasis-open.org/docbook/xml/4.2/docbookx.dtd" [
4 <!ENTITY % global_entities SYSTEM '../entities/global.entities'>
8 <chapter id="NetworkBrowsing">
12 <pubdate>July 5, 1998</pubdate>
13 <pubdate>Updated: April 21, 2003</pubdate>
16 <title>Network Browsing</title>
19 This document contains detailed information as well as a fast track guide to
20 implementing browsing across subnets and/or across workgroups (or domains).
21 WINS is the best tool for resolution of NetBIOS names to IP addresses. WINS is
22 not involved in browse list handling except by way of name to address resolution.
26 MS Windows 2000 and later versions can be configured to operate with no NetBIOS
27 over TCP/IP. Samba-3 and later versions also support this mode of operation.
28 When the use of NetBIOS over TCP/IP has been disabled, the primary
29 means for resolution of MS Windows machine names is via DNS and Active Directory.
30 The following information assumes that your site is running NetBIOS over TCP/IP.
34 <title>Features and Benefits</title>
37 Someone once referred to the past in these words <quote><emphasis>It was the best of times,
38 it was the worst of times.</emphasis></quote> The more we look back, the more we long for what was and
39 hope it never returns.
44 <indexterm><primary>NetBIOS</primary></indexterm>
45 For many MS Windows network administrators, that statement sums up their feelings about
46 NetBIOS networking precisely. For those who mastered NetBIOS networking, its fickle
47 nature was just par for the course. For those who never quite managed to tame its
48 lusty features, NetBIOS is like Paterson's Curse.
52 For those not familiar with botanical problems in Australia, Paterson's Curse,
53 <emphasis>Echium plantagineum</emphasis>, was introduced to Australia from Europe during the mid-nineteenth
54 century. Since then it has spread rapidly. The high seed production, with densities of
55 thousands of seeds per square meter, a seed longevity of more than seven years, and an
56 ability to germinate at any time of year, given the right conditions, are some of the
57 features which make it such a persistent weed.
61 In this chapter we explore vital aspects of Server Message Block (SMB) networking with
62 a particular focus on SMB as implemented through running NetBIOS (Network Basic
63 Input/Output System) over TCP/IP. Since Samba does not implement SMB or NetBIOS over
64 any other protocols, we need to know how to configure our network environment and simply
65 remember to use nothing but TCP/IP on all our MS Windows network clients.
69 Samba provides the ability to implement a WINS (Windows Inter-networking Name Server)
70 and implements extensions to Microsoft's implementation of WINS. These extensions
71 help Samba to effect stable WINS operations beyond the normal scope of MS WINS.
75 WINS is exclusively a service that applies only to those systems
76 that run NetBIOS over TCP/IP. MS Windows 200x/XP have the capacity to operate with
77 support for NetBIOS disabled, in which case WINS is of no relevance. Samba supports this also.
81 For those networks on which NetBIOS has been disabled (i.e., WINS is not required)
82 the use of DNS is necessary for host name resolution.
88 <title>What Is Browsing?</title>
91 To most people browsing means they can see the MS Windows and Samba servers
92 in the Network Neighborhood, and when the computer icon for a particular server is
93 clicked, it opens up and shows the shares and printers available on the target server.
97 What seems so simple is in fact a complex interaction of different technologies.
98 The technologies (or methods) employed in making all of this work include:
102 <listitem>MS Windows machines register their presence to the network.</listitem>
103 <listitem>Machines announce themselves to other machines on the network.</listitem>
104 <listitem>One or more machine on the network collates the local announcements.</listitem>
105 <listitem>The client machine finds the machine that has the collated list of machines.</listitem>
106 <listitem>The client machine is able to resolve the machine names to IP addresses.</listitem>
107 <listitem>The client machine is able to connect to a target machine.</listitem>
111 The Samba application that controls browse list management and name resolution is
112 called <filename>nmbd</filename>. The configuration parameters involved in nmbd's operation are:
115 <para>Browsing options: <smbconfoption><name>os level</name></smbconfoption>(*),
116 <smbconfoption><name>lm announce</name></smbconfoption>,
117 <smbconfoption><name>lm interval</name></smbconfoption>,
118 <smbconfoption><name>preferred master</name></smbconfoption>(*),
119 <smbconfoption><name>local master</name></smbconfoption>(*),
120 <smbconfoption><name>domain master</name></smbconfoption>(*),
121 <smbconfoption><name>browse list</name></smbconfoption>,
122 <smbconfoption><name>enhanced browsing</name></smbconfoption>.
125 <para>Name Resolution Method:
126 <smbconfoption><name>name resolve order</name></smbconfoption>(*).
130 <smbconfoption><name>dns proxy</name></smbconfoption>,
131 <smbconfoption><name>wins proxy</name></smbconfoption>,
132 <smbconfoption><name>wins server</name></smbconfoption>(*),
133 <smbconfoption><name>wins support</name></smbconfoption>(*),
134 <smbconfoption><name>wins hook</name></smbconfoption>.
138 <indexterm><primary>WINS</primary></indexterm>
139 For Samba, the WINS Server and WINS Support are mutually exclusive options. Those marked with
140 an (*) are the only options that commonly may need to be modified. Even if none of these
141 parameters is set, <filename>nmbd</filename> will still do its job.
146 <sect1 id="netdiscuss">
147 <title>Discussion</title>
150 All MS Windows networking uses SMB-based messaging. SMB messaging may be implemented with or without NetBIOS.
151 MS Windows 200x supports NetBIOS over TCP/IP for backwards compatibility. Microsoft appears intent on phasing
156 <title>NetBIOS over TCP/IP</title>
159 Samba implements NetBIOS, as does MS Windows NT/200x/XP, by encapsulating it over TCP/IP.
160 MS Windows products can do likewise. NetBIOS-based networking uses broadcast messaging to
161 effect browse list management. When running NetBIOS over TCP/IP, this uses UDP-based messaging.
162 UDP messages can be broadcast or uni-cast.
167 <indexterm><primary>UDP</primary></indexterm>
168 Normally, only uni-cast UDP messaging can be forwarded by routers. The
169 <smbconfoption><name>remote announce</name></smbconfoption> parameter to smb.conf helps to project browse announcements
170 to remote network segments via uni-cast UDP. Similarly, the
171 <smbconfoption><name>remote browse sync</name></smbconfoption> parameter of &smb.conf;
172 implements browse list collation using uni-cast UDP.
176 Secondly, in those networks where Samba is the only SMB server technology,
177 wherever possible <filename>nmbd</filename> should be configured on one machine as the WINS
178 server. This makes it easy to manage the browsing environment. If each network
179 segment is configured with its own Samba WINS server, then the only way to
180 get cross-segment browsing to work is by using the
181 <indexterm><primary>LMB</primary><see>Local Master Browser</see></indexterm>
182 <indexterm><primary>Local Master Browser</primary></indexterm>
183 <smbconfoption><name>remote announce</name></smbconfoption> and the <smbconfoption><name>remote browse sync</name></smbconfoption>
184 parameters to your &smb.conf; file.
188 <indexterm><primary>WINS</primary></indexterm>
189 If only one WINS server is used for an entire multi-segment network, then
190 the use of the <smbconfoption><name>remote announce</name></smbconfoption> and the
191 <smbconfoption><name>remote browse sync</name></smbconfoption> parameters should not be necessary.
195 <indexterm><primary>replication</primary><secondary>WINS</secondary></indexterm>
196 As of Samba-3 WINS replication is being worked on. The bulk of the code has
197 been committed, but it still needs maturation. This is not a supported feature
198 of the Samba-3.0.0 release. Hopefully, this will become a supported feature
199 of one of the Samba-3 release series.
203 Right now Samba WINS does not support MS-WINS replication. This means that
204 when setting up Samba as a WINS server, there must only be one <filename>nmbd</filename>
205 configured as a WINS server on the network. Some sites have used multiple Samba WINS
206 servers for redundancy (one server per subnet) and then used
207 <smbconfoption><name>remote browse sync</name></smbconfoption> and <smbconfoption><name>remote announce</name></smbconfoption>
208 to effect browse list collation across all segments. Note that this means clients
209 will only resolve local names, and must be configured to use DNS to resolve names
210 on other subnets in order to resolve the IP addresses of the servers they can see
211 on other subnets. This setup is not recommended, but is mentioned as a practical
212 consideration (i.e., an <quote>if all else fails</quote> scenario).
216 Lastly, take note that browse lists are a collection of unreliable broadcast
217 messages that are repeated at intervals of not more than 15 minutes. This means
218 that it will take time to establish a browse list and it can take up to 45
219 minutes to stabilize, particularly across network segments.
225 <title>TCP/IP without NetBIOS</title>
228 <indexterm><primary>NetBIOS</primary></indexterm>
229 <indexterm><primary>NetBIOS-less</primary></indexterm>
230 <indexterm><primary>DNS</primary></indexterm>
231 All TCP/IP-enabled systems use various forms of host name resolution. The primary
232 methods for TCP/IP hostname resolution involve either a static file (<filename>/etc/hosts</filename>)
233 or the Domain Name System (DNS). DNS is the technology that makes
234 the Internet usable. DNS-based host name resolution is supported by nearly all
235 TCP/IP-enabled systems. Only a few embedded TCP/IP systems do not support DNS.
239 When an MS Windows 200x/XP system attempts to resolve a host name to an IP address
240 it follows a defined path:
245 Checks the <filename>hosts</filename> file. It is located in
246 <filename>C:\Windows NT\System32\Drivers\etc</filename>.
254 Checks the NetBIOS name cache.
258 Queries the WINS server.
262 Does a broadcast name lookup over UDP.
266 Looks up entries in LMHOSTS, located in
267 <filename>C:\Windows NT\System32\Drivers\etc</filename>.
273 <indexterm><primary>DNS</primary></indexterm>
274 Windows 200x/XP can register its host name with a Dynamic DNS server. You can
275 force register with a Dynamic DNS server in Windows 200x/XP using:
276 <command>ipconfig /registerdns</command>.
280 With Active Directory (ADS), a correctly functioning DNS server is absolutely
281 essential. In the absence of a working DNS server that has been correctly configured,
282 MS Windows clients and servers will be unable to locate each other, so
283 consequently network services will be severely impaired.
287 The use of Dynamic DNS is highly recommended with Active Directory, in which case
288 the use of BIND9 is preferred for its ability to adequately support the SRV (service)
289 records that are needed for Active Directory.
294 <sect2 id="adsdnstech">
295 <title>DNS and Active Directory</title>
299 <indexterm><primary>DNS</primary><secondary>Active Directory</secondary></indexterm>
300 Occasionally we hear from UNIX network administrators who want to use a UNIX-based Dynamic
301 DNS server in place of the Microsoft DNS server. While this might be desirable to some, the
302 MS Windows 200x DNS server is auto-configured to work with Active Directory. It is possible
303 to use BIND version 8 or 9, but it will almost certainly be necessary to create service records
304 (SRV records) so MS Active Directory clients can resolve host names to locate essential network services.
305 The following are some of the default service records that Active Directory requires:
310 <term>_ldap._tcp.pdc._msdcs.<emphasis>Domain</emphasis></term>
313 This provides the address of the Windows NT PDC for the Domain.
318 <term>_ldap._tcp.pdc._msdcs.<emphasis>DomainTree</emphasis></term>
321 Resolves the addresses of Global Catalog servers in the domain.
326 <term>_ldap._tcp.<emphasis>site</emphasis>.sites.writable._msdcs.<emphasis>Domain</emphasis></term>
329 Provides list of Domain Controllers based on sites.
334 <term>_ldap._tcp.writable._msdcs.<emphasis>Domain</emphasis></term>
337 Enumerates list of Domain Controllers that have the writable copies of the Active Directory data-store.
342 <term>_ldap._tcp.<emphasis>GUID</emphasis>.domains._msdcs.<emphasis>DomainTree</emphasis></term>
345 Entry used by MS Windows clients to locate machines using the Global Unique Identifier.
350 <term>_ldap._tcp.<emphasis>Site</emphasis>.gc._msdcs.<emphasis>DomainTree</emphasis></term>
353 Used by MS Windows clients to locate site configuration dependent Global Catalog server.
360 Specific entries used by Microsoft clients to locate essential services for an example domain
361 called <constant>quenya.org</constant> includes:
366 _kerberos._udp.quenya.org &smbmdash; Used to contact the KDC server via UDP.
367 This entry must list port 88 for each KDC.
371 _kpasswd._udp.quenya.org &smbmdash; Used to locate the <constant>kpasswd</constant> server
372 when a user password change must be processed. This record must list port 464 on the
377 _kerberos._tcp.quenya.org &smbmdash; Used to locate the KDC server via TCP.
378 This entry must list port 88 for each KDC.
382 _ldap._tcp.quenya.org &smbmdash; Used to locate the LDAP service on the PDC.
383 This record must list port 389 for the PDC.
387 _kpasswd._tcp.quenya.org &smbmdash; Used to locate the <constant>kpasswd</constant> server
388 to permit user password changes to be processed. This must list port 464.
392 _gc._tcp.quenya.org &smbmdash; Used to locate the Global Catalog server for the
393 top of the domain. This must list port 3268.
398 The following records are also used by the Windows Domain Member client to locate vital
399 services on the Windows ADS domain controllers.
404 _ldap._tcp.pdc._msdcs.quenya.org
408 _ldap.gc._msdcs.quenya.org
412 _ldap.default-first-site-name._sites.gc._msdcs.quenya.org
416 _ldap.{SecID}.domains._msdcs.quenya.org
420 _ldap._tcp.dc._msdcs.quenya.org
424 _kerberos._tcp.dc._msdcs.quenya.org
428 _ldap.default-first-site-name._sites.dc._msdcs.quenya.org
432 _kerberos.default-first-site-name._sites.dc._msdcs.queyna.org
436 SecID._msdcs.quenya.org
441 Presence of the correct DNS entries can be validated by executing:
443 &rootprompt; dig @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
445 ; <lt;>> DiG 9.2.2 <lt;>> @frodo -t any _ldap._tcp.dc._msdcs.quenya.org
446 ;; global options: printcmd
448 ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 3072
449 ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 2, AUTHORITY: 0, ADDITIONAL: 2
453 ;_ldap._tcp.dc._msdcs.quenya.org. IN ANY
457 _ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 frodo.quenya.org.
458 _ldap._tcp.dc._msdcs.quenya.org. 600 IN SRV 0 100 389 noldor.quenya.org.
461 ;; ADDITIONAL SECTION:
462 frodo.quenya.org. 3600 IN A 10.1.1.16
463 noldor.quenya.org. 1200 IN A 10.1.1.17
466 ;; Query time: 0 msec
467 ;; SERVER: frodo#53(10.1.1.16)
468 ;; WHEN: Wed Oct 7 14:39:31 2004
469 ;; MSG SIZE rcvd: 171
478 <title>How Browsing Functions</title>
481 MS Windows machines register their NetBIOS names
482 (i.e., the machine name for each service type in operation) on start-up.
483 The exact method by which this name registration
484 takes place is determined by whether or not the MS Windows client/server
485 has been given a WINS server address, whether or not LMHOSTS lookup
486 is enabled, or if DNS for NetBIOS name resolution is enabled, etc.
490 In the case where there is no WINS server, all name registrations as
491 well as name lookups are done by UDP broadcast. This isolates name
492 resolution to the local subnet, unless LMHOSTS is used to list all
493 names and IP addresses. In such situations, Samba provides a means by
494 which the Samba server name may be forcibly injected into the browse
495 list of a remote MS Windows network (using the
496 <smbconfoption><name>remote announce</name></smbconfoption> parameter).
500 Where a WINS server is used, the MS Windows client will use UDP
501 uni-cast to register with the WINS server. Such packets can be routed
502 and thus WINS allows name resolution to function across routed networks.
506 During the startup process an election will take place to create a
507 Local Master Browser if one does not already exist. On each NetBIOS network
508 one machine will be elected to function as the Domain Master Browser. This
509 domain browsing has nothing to do with MS security Domain Control.
510 Instead, the Domain Master Browser serves the role of contacting each local
511 master browser (found by asking WINS or from LMHOSTS) and exchanging browse
512 list contents. This way every master browser will eventually obtain a complete
513 list of all machines that are on the network. Every 11 to 15 minutes an election
514 is held to determine which machine will be the master browser. By the nature of
515 the election criteria used, the machine with the highest uptime, or the
516 most senior protocol version or other criteria, will win the election
517 as Domain Master Browser.
521 Clients wishing to browse the network make use of this list, but also depend
522 on the availability of correct name resolution to the respective IP
527 Any configuration that breaks name resolution and/or browsing intrinsics
528 will annoy users because they will have to put up with protracted
529 inability to use the network services.
533 Samba supports a feature that allows forced synchronization of browse lists across
534 routed networks using the <smbconfoption><name>remote browse sync</name></smbconfoption>
535 parameter in the &smb.conf; file. This causes Samba to contact the local master
536 browser on a remote network and to request browse list synchronization. This
537 effectively bridges two networks that are separated by routers. The two remote
538 networks may use either broadcast-based name resolution or WINS-based name
539 resolution, but it should be noted that the
540 <smbconfoption><name>remote browse sync</name></smbconfoption> parameter provides
541 browse list synchronization &smbmdash; and that is distinct from name to address
542 resolution. In other words, for cross-subnet browsing to function correctly it is
543 essential that a name-to-address resolution mechanism be provided. This mechanism
544 could be via DNS, <filename>/etc/hosts</filename>, and so on.
548 <title>Configuring WORKGROUP Browsing</title>
551 To configure cross-subnet browsing on a network containing machines
552 in a WORKGROUP, not an NT Domain, you need to set up one
553 Samba server to be the Domain Master Browser (note that this is not
554 the same as a Primary Domain Controller, although in an NT Domain the
555 same machine plays both roles). The role of a Domain Master Browser is
556 to collate the browse lists from Local Master Browsers on all the
557 subnets that have a machine participating in the workgroup. Without
558 one machine configured as a Domain Master Browser, each subnet would
559 be an isolated workgroup unable to see any machines on another
560 subnet. It is the presence of a Domain Master Browser that makes
561 cross-subnet browsing possible for a workgroup.
565 In a WORKGROUP environment the Domain Master Browser must be a
566 Samba server, and there must only be one Domain Master Browser per
567 workgroup name. To set up a Samba server as a Domain Master Browser,
568 set the following option in the <smbconfsection>[global]</smbconfsection> section
569 of the &smb.conf; file:
574 <smbconfoption><name>domain master</name><value>yes</value></smbconfoption>
579 The Domain Master Browser should preferably be the local master
580 browser for its own subnet. In order to achieve this, set the following
581 options in the <smbconfsection>[global]</smbconfsection> section of the &smb.conf;
582 file as shown in <link linkend="dmbexample">the following example</link>:
586 <smbconfexample id="dmbexample">
587 <title>Domain Master Browser smb.conf</title>
588 <smbconfsection>[global]</smbconfsection>
589 <smbconfoption><name>domain master</name><value>yes</value></smbconfoption>
590 <smbconfoption><name>local master</name><value>yes</value></smbconfoption>
591 <smbconfoption><name>preferred master</name><value>yes</value></smbconfoption>
592 <smbconfoption><name>os level</name><value>65</value></smbconfoption>
597 The Domain Master Browser may be the same machine as the WINS server, if necessary.
601 Next, you should ensure that each of the subnets contains a machine that can act as
602 a Local Master Browser for the workgroup. Any MS Windows NT/200x/XP machine should
603 be able to do this, as will Windows 9x/Me machines (although these tend to get
604 rebooted more often, so it is not such a good idea to use these). To make a Samba
605 server a Local Master Browser set the following options in the
606 <smbconfsection>[global]</smbconfsection> section of the &smb.conf; file as
607 shown in <link linkend="lmbexample">following example</link>:
611 <smbconfexample id="lmbexample">
612 <title>Local master browser smb.conf</title>
613 <smbconfsection>[global]</smbconfsection>
614 <smbconfoption><name>domain master</name><value>no</value></smbconfoption>
615 <smbconfoption><name>local master</name><value>yes</value></smbconfoption>
616 <smbconfoption><name>preferred master</name><value>yes</value></smbconfoption>
617 <smbconfoption><name>os level</name><value>65</value></smbconfoption>
622 Do not do this for more than one Samba server on each subnet, or they will war with
623 each other over which is to be the Local Master Browser.
627 The <smbconfoption><name>local master</name></smbconfoption> parameter allows Samba to act as a
628 Local Master Browser. The <smbconfoption><name>preferred master</name></smbconfoption> causes <command>nmbd</command>
629 to force a browser election on startup and the <smbconfoption><name>os level</name></smbconfoption>
630 parameter sets Samba high enough so it should win any browser elections.
634 If you have an NT machine on the subnet that you wish to be the Local Master Browser, you can disable Samba from
635 becoming a Local Master Browser by setting the following options in the <smbconfsection>[global]</smbconfsection> section of the
636 &smb.conf; file as shown in <link linkend="nombexample">following example</link>:
640 <smbconfexample id="nombexample">
641 <title>smb.conf for not being a Master Browser</title>
642 <smbconfsection>[global]</smbconfsection>
643 <smbconfoption><name>domain master</name><value>no</value></smbconfoption>
644 <smbconfoption><name>local master</name><value>no</value></smbconfoption>
645 <smbconfoption><name>preferred master</name><value>no</value></smbconfoption>
646 <smbconfoption><name>os level</name><value>0</value></smbconfoption>
653 <title>DOMAIN Browsing Configuration</title>
656 If you are adding Samba servers to a Windows NT Domain, then you must not set up a Samba server as a Domain Master Browser.
657 By default, a Windows NT Primary Domain Controller for a domain is also the Domain Master Browser for that domain. Network
658 browsing may break if a Samba server registers the domain master browser NetBIOS name (<replaceable>DOMAIN</replaceable><1B>)
659 with WINS instead of the PDC.
663 For subnets other than the one containing the Windows NT PDC, you may set up Samba servers as Local Master Browsers as
664 described. To make a Samba server a Local Master Browser, set the following options in the <smbconfsection>[global]</smbconfsection> section
665 of the &smb.conf; file as shown in <link linkend="remsmb">following example</link>:
669 <smbconfexample id="remsmb">
670 <title>Local Master Browser smb.conf</title>
671 <smbconfsection>[global]</smbconfsection>
672 <smbconfoption><name>domain master</name><value>no</value></smbconfoption>
673 <smbconfoption><name>local master</name><value>yes</value></smbconfoption>
674 <smbconfoption><name>preferred master</name><value>yes</value></smbconfoption>
675 <smbconfoption><name>os level</name><value>65</value></smbconfoption>
680 If you wish to have a Samba server fight the election with machines on the same subnet you
681 may set the <smbconfoption><name>os level</name></smbconfoption> parameter to lower levels.
682 By doing this you can tune the order of machines that will become Local Master Browsers if
683 they are running. For more details on this refer to <link linkend="browse-force-master">Forcing Samba to Be the Master</link> section.
687 If you have Windows NT machines that are members of the domain on all subnets and you are
688 sure they will always be running, you can disable Samba from taking part in browser elections
689 and ever becoming a Local Master Browser by setting the following options in the
690 <smbconfsection>[global]</smbconfsection> section of the &smb.conf; file as shown in <link linkend="xremmb">next example</link>:
694 <smbconfexample id="xremmb">
695 <title>&smb.conf; for not being a master browser</title>
696 <smbconfsection>[global]</smbconfsection>
697 <smbconfoption><name>domain master</name><value>no</value></smbconfoption>
698 <smbconfoption><name>local master</name><value>no</value></smbconfoption>
699 <smbconfoption><name>preferred master</name><value>no</value></smbconfoption>
700 <smbconfoption><name>os level</name><value>0</value></smbconfoption>
706 <sect2 id="browse-force-master">
707 <title>Forcing Samba to Be the Master</title>
710 Who becomes the master browser is determined by an election process using broadcasts. Each election packet contains a number of parameters
711 that determine what precedence (bias) a host should have in the election. By default Samba uses a low precedence and thus loses
712 elections to just about every Windows network server or client.
716 If you want Samba to win elections, set the <smbconfoption><name>os level</name></smbconfoption>
717 global option in &smb.conf; to a higher number. It defaults to 20. Using 34 would make it win
718 all elections every other system (except other samba systems).
722 An <smbconfoption><name>os level</name></smbconfoption> of two would make it beat Windows for Workgroups and Windows 9x/Me, but not MS Windows
723 NT/200x Server. An MS Windows NT/200x Server Domain Controller uses level 32. The maximum os level is 255.
727 If you want Samba to force an election on startup, set the
728 <smbconfoption><name>preferred master</name></smbconfoption> global option in &smb.conf; to <constant>yes</constant>.
729 Samba will then have a slight advantage over other potential master browsers that are not Preferred Master Browsers.
730 Use this parameter with care, as if you have two hosts (whether they are Windows 9x/Me or
731 NT/200x/XP or Samba) on the same local subnet both set with <smbconfoption><name>preferred master</name></smbconfoption>
732 to <constant>yes</constant>, then periodically and continually they will force an election in order
733 to become the Local Master Browser.
737 If you want Samba to be a <emphasis>Domain Master Browser</emphasis>, then it is recommended that
738 you also set <smbconfoption><name>preferred master</name></smbconfoption> to <constant>yes</constant>, because
739 Samba will not become a Domain Master Browser for the whole of your LAN or WAN if it is not also a
740 Local Master Browser on its own broadcast isolated subnet.
744 It is possible to configure two Samba servers to attempt to become the Domain Master Browser for a domain. The first server that comes
745 up will be the Domain Master Browser. All other Samba servers will attempt to become the Domain Master Browser every five minutes. They
746 will find that another Samba server is already the domain master browser and will fail. This provides automatic redundancy, should
747 the current Domain Master Browser fail.
753 <title>Making Samba the Domain Master</title>
756 The domain master is responsible for collating the browse lists of multiple subnets so browsing can occur between subnets. You can
757 make Samba act as the Domain Master by setting <smbconfoption><name>domain master</name><value>yes</value></smbconfoption>
758 in &smb.conf;. By default it will not be a Domain Master.
762 Do not set Samba to be the Domain Master for a workgroup that has the same name as an NT/200x Domain.
763 If Samba is configured to be the Domain Master for a workgroup that is present on the same
764 network as a Windows NT/200x domain that has the same name, network browsing problems will
765 certainly be experienced.
769 When Samba is the Domain Master and the Master Browser, it will listen for master
770 announcements (made roughly every twelve minutes) from Local Master Browsers on
771 other subnets and then contact them to synchronize browse lists.
775 If you want Samba to be the domain master, you should also set the
776 <smbconfoption><name>os level</name></smbconfoption> high enough to make sure it wins elections, and
777 set <smbconfoption><name>preferred master</name></smbconfoption> to <constant>yes</constant>, to
778 get Samba to force an election on startup.
782 All servers (including Samba) and clients should be using a WINS server to resolve NetBIOS names. If your
783 clients are only using broadcasting to resolve NetBIOS names, then two things will occur:
789 Local Master Browsers will be unable to find a Domain Master Browser, as they will be looking only on the local subnet.
795 If a client happens to get hold of a domain-wide browse list and a user attempts to access a
796 host in that list, it will be unable to resolve the NetBIOS name of that host.
802 If, however, both Samba and your clients are using a WINS server, then:
808 Local master browsers will contact the WINS server and, as long as Samba has registered that it is a Domain Master Browser with the WINS
809 server, the Local Master Browser will receive Samba's IP address as its Domain Master Browser.
815 When a client receives a domain-wide browse list and a user attempts to access a host in that list, it will contact the WINS server to
816 resolve the NetBIOS name of that host. As long as that host has registered its NetBIOS name with the same WINS server, the user will
817 be able to see that host.
825 <title>Note about Broadcast Addresses</title>
828 If your network uses a 0 based broadcast address (for example, if it ends in a 0) then you will strike problems. Windows for Workgroups
829 does not seem to support a zeros broadcast and you will probably find that browsing and name lookups will not work.
834 <title>Multiple Interfaces</title>
837 Samba supports machines with multiple network interfaces. If you have multiple interfaces, you will
838 need to use the <smbconfoption><name>interfaces</name></smbconfoption> option in &smb.conf; to configure them.
842 <title>Use of the Remote Announce Parameter</title>
844 The <smbconfoption><name>remote announce</name></smbconfoption> parameter of
845 &smb.conf; can be used to forcibly ensure
846 that all the NetBIOS names on a network get announced to a remote network.
847 The syntax of the <smbconfoption><name>remote announce</name></smbconfoption> parameter is:
849 <smbconfoption><name>remote announce</name><value>a.b.c.d [e.f.g.h] ...</value></smbconfoption>
851 <emphasis>or</emphasis>
853 <smbconfoption><name>remote announce</name><value>a.b.c.d/WORKGROUP [e.f.g.h/WORKGROUP] ...</value></smbconfoption>
858 <varlistentry><term><replaceable>a.b.c.d</replaceable> and <replaceable>e.f.g.h</replaceable></term>
860 <indexterm><primary>LMB</primary><see>Local Master Browser</see></indexterm>
861 <indexterm><primary>Local Master Browser</primary></indexterm>
862 is either the LMB (Local Master Browser) IP address or the broadcast address of the remote network.
863 i.e., the LMB is at 192.168.1.10, or the address could be given as 192.168.1.255 where the netmask
864 is assumed to be 24 bits (255.255.255.0). When the remote announcement is made to the broadcast
865 address of the remote network, every host will receive our announcements. This is noisy and therefore
866 undesirable but may be necessary if we do not know the IP address of the remote LMB.
871 <term><replaceable>WORKGROUP</replaceable></term>
872 <listitem><para>is optional and can be either our own workgroup or that of the remote network. If you use the
873 workgroup name of the remote network, our NetBIOS machine names will end up looking like
874 they belong to that workgroup. This may cause name resolution problems and should be avoided.
883 <title>Use of the Remote Browse Sync Parameter</title>
886 The <smbconfoption><name>remote browse sync</name></smbconfoption> parameter of
887 &smb.conf; is used to announce to another LMB that it must synchronize its NetBIOS name list with our
888 Samba LMB. This works only if the Samba server that has this option is
889 simultaneously the LMB on its network segment.
893 The syntax of the <smbconfoption><name>remote browse sync</name></smbconfoption> parameter is:
896 <smbconfoption><name>remote browse sync</name><value><replaceable>a.b.c.d</replaceable></value></smbconfoption>
899 where <replaceable>a.b.c.d</replaceable> is either the IP address of the
900 remote LMB or else is the network broadcast address of the remote segment.
908 <title>WINS &smbmdash; The Windows Inter-networking Name Server</title>
911 Use of WINS (either Samba WINS or MS Windows NT Server WINS) is highly
912 recommended. Every NetBIOS machine registers its name together with a
913 name_type value for each of several types of service it has available.
914 It registers its name directly as a unique (the type 0x03) name.
915 It also registers its name if it is running the LanManager compatible
916 server service (used to make shares and printers available to other users)
917 by registering the server (the type 0x20) name.
921 All NetBIOS names are up to 15 characters in length. The name_type variable
922 is added to the end of the name, thus creating a 16 character name. Any
923 name that is shorter than 15 characters is padded with spaces to the 15th
924 character. Thus, all NetBIOS names are 16 characters long (including the
925 name_type information).
929 WINS can store these 16-character names as they get registered. A client
930 that wants to log onto the network can ask the WINS server for a list
931 of all names that have registered the NetLogon service name_type. This saves
932 broadcast traffic and greatly expedites logon processing. Since broadcast
933 name resolution cannot be used across network segments this type of
934 information can only be provided via WINS or via a statically configured
935 <filename>lmhosts</filename> file that must reside on all clients in the
940 WINS also serves the purpose of forcing browse list synchronization by all
941 LMBs. LMBs must synchronize their browse list with the DMB (Domain Master
942 Browser) and WINS helps the LMB to identify its DMB. By definition this
943 will work only within a single workgroup. Note that the Domain Master Browser
944 has nothing to do with what is referred to as an MS Windows NT Domain. The
945 later is a reference to a security environment while the DMB refers to the
946 master controller for browse list information only.
950 WINS will work correctly only if every client TCP/IP protocol stack
951 has been configured to use the WINS servers. Any client that has not been
952 configured to use the WINS server will continue to use only broadcast-based
953 name registration so WINS may never get to know about it. In any case,
954 machines that have not registered with a WINS server will fail name to address
955 lookup attempts by other clients and will therefore cause workstation access
960 To configure Samba as a WINS server just add
961 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> to the &smb.conf;
962 file [global] section.
966 To configure Samba to register with a WINS server just add
967 <smbconfoption><name>wins server</name><value>a.b.c.d</value></smbconfoption>
968 to your &smb.conf; file <smbconfsection>[global]</smbconfsection> section.
972 Never use both <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> together
973 with <smbconfoption><name>wins server</name><value>a.b.c.d</value></smbconfoption>
974 particularly not using its own IP address. Specifying both will cause &nmbd; to refuse to start!
978 <title>WINS Server Configuration</title>
981 Either a Samba Server or a Windows NT Server machine may be set up
982 as a WINS server. To configure a Samba Server to be a WINS server you must
983 add to the &smb.conf; file on the selected Server the following line to
984 the <smbconfsection>[global]</smbconfsection> section:
989 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption>
994 Versions of Samba prior to 1.9.17 had this parameter default to
995 yes. If you have any older versions of Samba on your network it is
996 strongly suggested you upgrade to a recent version, or at the very
997 least set the parameter to <quote>no</quote> on all these machines.
1001 Machines configured with <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> will keep a list of
1002 all NetBIOS names registered with them, acting as a DNS for NetBIOS names.
1006 It is strongly recommended to set up only one WINS server. Do not set the
1007 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> option on more than one Samba
1012 <indexterm><primary>replication</primary><secondary>WINS</secondary></indexterm>
1013 To configure Windows NT/200x Server as a WINS server, install and configure
1014 the WINS service. See the Windows NT/200x documentation for details.
1015 Windows NT/200x WINS servers can replicate to each other, allowing more
1016 than one to be set up in a complex subnet environment. As Microsoft
1017 refuses to document the replication protocols, Samba cannot currently
1018 participate in these replications. It is possible in the future that
1019 a Samba-to-Samba WINS replication protocol may be defined, in which
1020 case more than one Samba machine could be set up as a WINS server.
1021 Currently only one Samba server should have the
1022 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> parameter set.
1026 After the WINS server has been configured, you must ensure that all
1027 machines participating on the network are configured with the address
1028 of this WINS server. If your WINS server is a Samba machine, fill in
1029 the Samba machine IP address in the <guilabel>Primary WINS Server</guilabel> field of
1030 the <guilabel>Control Panel->Network->Protocols->TCP->WINS Server</guilabel> dialogs
1031 in Windows 9x/Me or Windows NT/200x. To tell a Samba server the IP address
1032 of the WINS server, add the following line to the <smbconfsection>[global]</smbconfsection> section of
1033 all &smb.conf; files:
1038 <smbconfoption><name>wins server</name><value><name or IP address></value></smbconfoption>
1043 where <name or IP address> is either the DNS name of the WINS server
1044 machine or its IP address.
1048 This line must not be set in the &smb.conf; file of the Samba
1049 server acting as the WINS server itself. If you set both the
1050 <smbconfoption><name>wins support</name><value>yes</value></smbconfoption> option and the
1051 <smbconfoption><name>wins server</name><value><name></value></smbconfoption> option then
1052 <command>nmbd</command> will fail to start.
1056 There are two possible scenarios for setting up cross-subnet browsing.
1057 The first details setting up cross-subnet browsing on a network containing
1058 Windows 9x/Me, Samba and Windows NT/200x machines that are not configured as
1059 part of a Windows NT Domain. The second details setting up cross-subnet
1060 browsing on networks that contain NT Domains.
1066 <title>WINS Replication</title>
1069 <indexterm><primary>replication</primary><secondary>WINS</secondary></indexterm>
1070 Samba-3 permits WINS replication through the use of the <filename>wrepld</filename> utility.
1071 This tool is not currently capable of being used as it is still in active development.
1072 As soon as this tool becomes moderately functional, we will prepare man pages and enhance this
1073 section of the documentation to provide usage and technical details.
1078 <title>Static WINS Entries</title>
1081 Adding static entries to your Samba WINS server is actually fairly easy.
1082 All you have to do is add a line to <filename>wins.dat</filename>, typically
1083 located in <filename class="directory">/usr/local/samba/var/locks</filename> or
1084 <filename>/var/run/samba</filename>.
1088 Entries in <filename>wins.dat</filename> take the form of:
1091 "NAME#TYPE" TTL ADDRESS+ FLAGS
1094 where NAME is the NetBIOS name, TYPE is the NetBIOS type, TTL is the
1095 time-to-live as an absolute time in seconds, ADDRESS+ is one or more
1096 addresses corresponding to the registration and FLAGS are the NetBIOS
1097 flags for the registration.
1101 A typical dynamic entry looks like this:
1103 "MADMAN#03" 1055298378 192.168.1.2 66R
1106 To make it static, all that has to be done is set the TTL to 0, like this:
1109 "MADMAN#03" 0 192.168.1.2 66R
1114 Though this method works with early Samba-3 versions, there is a
1115 possibility that it may change in future versions if WINS replication
1123 <title>Helpful Hints</title>
1126 The following hints should be carefully considered as they are stumbling points
1127 for many new network administrators.
1131 <title>Windows Networking Protocols</title>
1134 A common cause of browsing problems results from installing more than
1135 one protocol on an MS Windows machine.
1139 Do not use more than one protocol on MS Windows clients.
1143 Every NetBIOS machine takes part in a process of electing the LMB (and DMB)
1144 every 15 minutes. A set of election criteria is used to determine the order
1145 of precedence for winning this election process. A machine running Samba or
1146 Windows NT will be biased so the most suitable machine will predictably
1147 win and thus retain its role.
1151 The election process is <quote>fought out</quote> so to speak over every NetBIOS network
1152 interface. In the case of a Windows 9x/Me machine that has both TCP/IP and IPX
1153 installed and has NetBIOS enabled over both protocols, the election will be
1154 decided over both protocols. As often happens, if the Windows 9x/Me machine is
1155 the only one with both protocols then the LMB may be won on the NetBIOS
1156 interface over the IPX protocol. Samba will then lose the LMB role as Windows
1157 9x/Me will insist it knows who the LMB is. Samba will then cease to function
1158 as an LMB and thus browse list operation on all TCP/IP-only machines will
1163 Windows 95, 98, 98se, and Me are referred to generically as Windows 9x/Me.
1164 The Windows NT4, 200x, and XP use common protocols. These are roughly
1165 referred to as the Windows NT family, but it should be recognized that 2000 and
1166 XP/2003 introduce new protocol extensions that cause them to behave
1167 differently from MS Windows NT4. Generally, where a server does not support
1168 the newer or extended protocol, these will fall back to the NT4 protocols.
1172 The safest rule of all to follow is: use only one protocol!
1178 <title>Name Resolution Order</title>
1181 Resolution of NetBIOS names to IP addresses can take place using a number
1182 of methods. The only ones that can provide NetBIOS name_type information
1187 <listitem>WINS &smbmdash; the best tool.</listitem>
1188 <listitem>LMHOSTS &smbmdash; static and hard to maintain.</listitem>
1189 <listitem>Broadcast &smbmdash; uses UDP and cannot resolve names across remote segments.</listitem>
1193 Alternative means of name resolution include:
1196 <listitem>Static <filename>/etc/hosts</filename> &smbmdash; hard to maintain, and lacks name_type info.</listitem>
1197 <listitem>DNS &smbmdash; is a good choice but lacks essential name_type info.</listitem>
1201 Many sites want to restrict DNS lookups and avoid broadcast name
1202 resolution traffic. The <parameter>name resolve order</parameter> parameter is of great help here.
1203 The syntax of the <parameter>name resolve order</parameter> parameter is:
1205 <smbconfoption><name>name resolve order</name><value>wins lmhosts bcast host</value></smbconfoption>
1207 <emphasis>or</emphasis>
1209 <smbconfoption><name>name resolve order</name><value>wins lmhosts (eliminates bcast and host)</value></smbconfoption>
1213 <smbconfoption><name>name resolve order</name><value>host lmhost wins bcast</value></smbconfoption>
1215 where <quote>host</quote> refers to the native methods used by the UNIX system
1216 to implement the gethostbyname() function call. This is normally
1217 controlled by <filename>/etc/host.conf</filename>, <filename>/etc/nsswitch.conf</filename> and <filename>/etc/resolv.conf</filename>.
1223 <title>Technical Overview of Browsing</title>
1226 SMB networking provides a mechanism by which clients can access a list
1227 of machines in a network, a so-called <smbconfoption><name>browse list</name></smbconfoption>. This list
1228 contains machines that are ready to offer file and/or print services
1229 to other machines within the network. Thus it does not include
1230 machines that aren't currently able to do server tasks. The browse
1231 list is heavily used by all SMB clients. Configuration of SMB
1232 browsing has been problematic for some Samba users, hence this
1237 MS Windows 2000 and later versions, as with Samba-3 and later versions, can be
1238 configured to not use NetBIOS over TCP/IP. When configured this way,
1239 it is imperative that name resolution (using DNS/LDAP/ADS) be correctly
1240 configured and operative. Browsing will not work if name resolution
1241 from SMB machine names to IP addresses does not function correctly.
1245 Where NetBIOS over TCP/IP is enabled, use of a WINS server is highly
1246 recommended to aid the resolution of NetBIOS (SMB) names to IP addresses.
1247 WINS allows remote segment clients to obtain NetBIOS name_type information
1248 that cannot be provided by any other means of name resolution.
1252 <title>Browsing Support in Samba</title>
1255 Samba facilitates browsing. The browsing is supported by &nmbd;
1256 and is also controlled by options in the &smb.conf; file.
1257 Samba can act as a local browse master for a workgroup and the ability
1258 to support domain logons and scripts is now available.
1262 Samba can also act as a Domain Master Browser for a workgroup. This
1263 means that it will collate lists from Local Master Browsers into a
1264 wide area network server list. In order for browse clients to
1265 resolve the names they may find in this list, it is recommended that
1266 both Samba and your clients use a WINS server.
1270 Do not set Samba to be the Domain Master for a workgroup that has the same
1271 name as an NT Domain. On each wide area network, you must only ever have one
1272 Domain Master Browser per workgroup, regardless of whether it is NT, Samba
1273 or any other type of domain master that is providing this service.
1277 <command>nmbd</command> can be configured as a WINS server, but it is not
1278 necessary to specifically use Samba as your WINS server. MS Windows
1279 NT4, Server or Advanced Server 200x can be configured as
1280 your WINS server. In a mixed NT/200x server and Samba environment on
1281 a Wide Area Network, it is recommended that you use the Microsoft
1282 WINS server capabilities. In a Samba-only environment, it is
1283 recommended that you use one and only one Samba server as the WINS server.
1287 To get browsing to work you need to run nmbd as usual, but will need
1288 to use the <smbconfoption><name>workgroup</name></smbconfoption> option in &smb.conf;
1289 to control what workgroup Samba becomes a part of.
1293 Samba also has a useful option for a Samba server to offer itself for
1294 browsing on another subnet. It is recommended that this option is only
1295 used for <quote>unusual</quote> purposes: announcements over the Internet, for
1296 example. See <smbconfoption><name>remote announce</name></smbconfoption> in the
1297 &smb.conf; man page.
1302 <title>Problem Resolution</title>
1305 If something does not work, the <filename>log.nmbd</filename> file will help
1306 to track down the problem. Try a <smbconfoption><name>log level</name><value></value></smbconfoption> of 2 or 3 for finding
1307 problems. Also note that the current browse list usually gets stored
1308 in text form in a file called <filename>browse.dat</filename>.
1312 If it does not work, you should still be able to
1313 type the server name as <filename>\\SERVER</filename> in <command>filemanager</command>, then
1314 press enter and <command>filemanager</command> should display the list of available shares.
1318 Some people find browsing fails because they do not have the global
1319 <smbconfoption><name>guest account</name></smbconfoption> set to a valid account. Remember that the
1320 IPC$ connection that lists the shares is done as guest and, thus, you must have a valid guest account.
1324 MS Windows 2000 and later (as with Samba) can be configured to disallow
1325 anonymous (i.e., guest account) access to the IPC$ share. In that case, the
1326 MS Windows 2000/XP/2003 machine acting as an SMB/CIFS client will use the
1327 name of the currently logged-in user to query the IPC$ share. MS Windows
1328 9x/Me clients are not able to do this and thus will not be able to browse
1333 The other big problem people have is that their broadcast address,
1334 netmask or IP address is wrong (specified with the <smbconfoption><name>interfaces</name><value></value></smbconfoption> option
1340 <title>Cross-Subnet Browsing</title>
1343 <indexterm><primary>replication</primary><secondary>browse lists</secondary></indexterm>
1344 Since the release of Samba 1.9.17 (alpha1), Samba has supported the
1345 replication of browse lists across subnet boundaries. This section
1346 describes how to set this feature up in different settings.
1350 To see browse lists that span TCP/IP subnets (i.e., networks separated
1351 by routers that do not pass broadcast traffic), you must set up at least
1352 one WINS server. The WINS server acts as a DNS for NetBIOS names. This will
1353 allow NetBIOS name-to-IP address translation to be completed by a direct
1354 query of the WINS server. This is done via a directed UDP packet on
1355 port 137 to the WINS server machine. The WINS server avoids the necessity
1356 of default NetBIOS name-to-IP address translation, which is done
1357 using UDP broadcasts from the querying machine. This means that machines
1358 on one subnet will not be able to resolve the names of machines on
1359 another subnet without using a WINS server.
1363 Remember, for browsing across subnets to work correctly, all machines,
1364 be they Windows 95, Windows NT or Samba servers, must have the IP address
1365 of a WINS server given to them by a DHCP server, or by manual configuration
1366 (for Windows 9x/Me and Windows NT/200x/XP, this is in the TCP/IP Properties, under Network
1367 settings); for Samba, this is in the &smb.conf; file.
1371 <title>Behavior of Cross-Subnet Browsing</title>
1374 Cross-subnet Browsing is a complicated dance, containing multiple
1375 moving parts. It has taken Microsoft several years to get the code
1376 that achieves this correct, and Samba lags behind in some areas.
1377 Samba is capable of cross-subnet browsing when configured correctly.
1381 Consider a network set up as in <link linkend="browsing1">Cross-Subnet Browsing Example</link>.
1384 <image id="browsing1" scale="40"><imagedescription>Cross-Subnet Browsing Example.</imagedescription><imagefile>browsing1</imagefile></image>
1387 This consists of 3 subnets (1, 2, 3) connected by two routers
1388 (R1, R2) which do not pass broadcasts. Subnet 1 has five machines
1389 on it, subnet 2 has four machines, subnet 3 has four machines. Assume
1390 for the moment that all machines are configured to be in the
1391 same workgroup (for simplicity's sake). Machine N1_C on subnet 1
1392 is configured as Domain Master Browser (i.e., it will collate the
1393 browse lists for the workgroup). Machine N2_D is configured as
1394 WINS server and all the other machines are configured to register
1395 their NetBIOS names with it.
1399 As these machines are booted up, elections for master browsers
1400 will take place on each of the three subnets. Assume that machine
1401 N1_C wins on subnet 1, N2_B wins on subnet 2, and N3_D wins on
1402 subnet 3. These machines are known as Local Master Browsers for
1403 their particular subnet. N1_C has an advantage in winning as the
1404 Local Master Browser on subnet 1 as it is set up as Domain Master
1409 On each of the three networks, machines that are configured to
1410 offer sharing services will broadcast that they are offering
1411 these services. The Local Master Browser on each subnet will
1412 receive these broadcasts and keep a record of the fact that
1413 the machine is offering a service. This list of records is
1414 the basis of the browse list. For this case, assume that
1415 all the machines are configured to offer services, so all machines
1416 will be on the browse list.
1420 For each network, the Local Master Browser on that network is
1421 considered <quote>authoritative</quote> for all the names it receives via
1422 local broadcast. This is because a machine seen by the Local Master
1423 Browser via a local broadcast must be on the same network as the
1424 Local Master Browser and thus is a <quote>trusted</quote>
1425 and <quote>verifiable</quote> resource. Machines on other networks that
1426 the Local Master Browsers learn about when collating their
1427 browse lists have not been directly seen. These records are
1428 called <quote>non-authoritative.</quote>
1432 At this point the browse lists appear as shown in <link linkend="browsubnet">the next example</link> (these are
1433 the machines you would see in your network neighborhood if you looked in it on a particular network right now).
1437 <table frame="all" id="browsubnet">
1438 <title>Browse Subnet Example 1</title>
1439 <tgroup align="left" cols="3">
1441 <row><entry>Subnet</entry><entry>Browse Master</entry><entry>List</entry></row>
1445 <row><entry>Subnet1</entry><entry>N1_C</entry><entry>N1_A, N1_B, N1_C, N1_D, N1_E</entry></row>
1446 <row><entry>Subnet2</entry><entry>N2_B</entry><entry>N2_A, N2_B, N2_C, N2_D</entry></row>
1447 <row><entry>Subnet3</entry><entry>N3_D</entry><entry>N3_A, N3_B, N3_C, N3_D</entry></row>
1454 At this point all the subnets are separate, and no machine is seen across any of the subnets.
1458 Now examine subnet 2. As soon as N2_B has become the Local
1459 Master Browser it looks for a Domain Master Browser with which to synchronize
1460 its browse list. It does this by querying the WINS server
1461 (N2_D) for the IP address associated with the NetBIOS name
1462 WORKGROUP<1B>. This name was registered by the Domain Master
1463 Browser (N1_C) with the WINS server as soon as it was started.
1467 Once N2_B knows the address of the Domain Master Browser, it
1468 tells it that is the Local Master Browser for subnet 2 by
1469 sending a <emphasis>MasterAnnouncement</emphasis> packet as a UDP port 138 packet.
1470 It then synchronizes with it by doing a <emphasis>NetServerEnum2</emphasis> call. This
1471 tells the Domain Master Browser to send it all the server
1472 names it knows about. Once the Domain Master Browser receives
1473 the <emphasis>MasterAnnouncement</emphasis> packet, it schedules a synchronization
1474 request to the sender of that packet. After both synchronizations
1475 are complete the browse lists look as shown in <link linkend="brsbex">following example</link>:
1478 <table frame="all" id="brsbex">
1479 <title>Browse Subnet Example 2</title>
1481 <colspec align="left"/>
1482 <colspec align="left"/>
1483 <colspec align="justify" colwidth="1*"/>
1485 <row><entry>Subnet</entry><entry>Browse Master</entry><entry>List</entry></row>
1489 <row><entry>Subnet1</entry><entry>N1_C</entry><entry>N1_A, N1_B, N1_C, N1_D, N1_E,
1490 N2_A(*), N2_B(*), N2_C(*), N2_D(*)</entry></row>
1491 <row><entry>Subnet2</entry><entry>N2_B</entry><entry>N2_A, N2_B, N2_C, N2_D, N1_A(*),
1492 N1_B(*), N1_C(*), N1_D(*), N1_E(*)</entry></row>
1493 <row><entry>Subnet3</entry><entry>N3_D</entry><entry>N3_A, N3_B, N3_C, N3_D</entry></row>
1499 Servers with an (*) after them are non-authoritative names.
1503 At this point users looking in their network neighborhood on
1504 subnets 1 or 2 will see all the servers on both, users on
1505 subnet 3 will still only see the servers on their own subnet.
1509 The same sequence of events that occurred for N2_B now occurs
1510 for the Local Master Browser on subnet 3 (N3_D). When it
1511 synchronizes browse lists with the Domain Master Browser (N1_A)
1512 it gets both the server entries on subnet 1, and those on
1513 subnet 2. After N3_D has synchronized with N1_C and vica versa,
1514 the browse lists will appear as shown in <link linkend="brsex2">following example</link>.
1517 <table frame="all" id="brsex2">
1518 <title>Browse Subnet Example 3</title>
1519 <tgroup cols="3" align="left">
1520 <colspec align="left"/>
1521 <colspec align="left"/>
1522 <colspec align="justify" colwidth="1*"/>
1525 <row><entry>Subnet</entry><entry>Browse Master</entry><entry>List</entry></row>
1529 <row><entry>Subnet1</entry><entry>N1_C</entry><entry>N1_A, N1_B, N1_C, N1_D, N1_E,
1530 N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*), N3_C(*), N3_D(*)</entry></row>
1531 <row><entry>Subnet2</entry><entry>N2_B</entry><entry>N2_A, N2_B, N2_C, N2_D, N1_A(*),
1532 N1_B(*), N1_C(*), N1_D(*), N1_E(*)</entry></row>
1533 <row><entry>Subnet3</entry><entry>N3_D</entry><entry>N3_A, N3_B, N3_C, N3_D, N1_A(*),
1534 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*), N2_C(*), N2_D(*)</entry></row>
1540 Servers with an (*) after them are non-authoritative names.
1544 At this point, users looking in their network neighborhood on
1545 subnets 1 or 3 will see all the servers on all subnets, while users on
1546 subnet 2 will still only see the servers on subnets 1 and 2, but not 3.
1550 Finally, the Local Master Browser for subnet 2 (N2_B) will sync again
1551 with the Domain Master Browser (N1_C) and will receive the missing
1552 server entries. Finally, as when a steady state (if no machines
1553 are removed or shut off) has been achieved, the browse lists will appear
1554 as shown in <link linkend="brsex3">example below</link>.
1557 <table frame="all" id="brsex3">
1558 <title>Browse Subnet Example 4</title>
1559 <tgroup cols="3" align="left">
1560 <colspec align="left"/>
1561 <colspec align="left"/>
1562 <colspec align="justify" width="1*"/>
1565 <row><entry>Subnet</entry><entry>Browse Master</entry><entry>List</entry></row>
1569 <row><entry>Subnet1</entry><entry>N1_C</entry><entry>N1_A, N1_B, N1_C, N1_D, N1_E,
1570 N2_A(*), N2_B(*), N2_C(*), N2_D(*), N3_A(*), N3_B(*),
1571 N3_C(*), N3_D(*)</entry></row>
1572 <row><entry>Subnet2</entry><entry>N2_B</entry><entry>N2_A, N2_B, N2_C, N2_D, N1_A(*),
1573 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N3_A(*), N3_B(*),
1574 N3_C(*), N3_D(*)</entry></row>
1575 <row><entry>Subnet3</entry><entry>N3_D</entry><entry>N3_A, N3_B, N3_C, N3_D, N1_A(*),
1576 N1_B(*), N1_C(*), N1_D(*), N1_E(*), N2_A(*), N2_B(*),
1577 N2_C(*), N2_D(*)</entry></row>
1583 Servers with an (*) after them are non-authoritative names.
1587 Synchronizations between the Domain Master Browser and Local
1588 Master Browsers will continue to occur, but this should remain a
1589 steady state operation.
1593 If either router R1 or R2 fails, the following will occur:
1599 Names of computers on each side of the inaccessible network fragments
1600 will be maintained for as long as 36 minutes in the network neighborhood
1607 Attempts to connect to these inaccessible computers will fail, but the
1608 names will not be removed from the network neighborhood lists.
1614 If one of the fragments is cut off from the WINS server, it will only
1615 be able to access servers on its local subnet using subnet-isolated
1616 broadcast NetBIOS name resolution. The effects are similar to that of
1617 losing access to a DNS server.
1626 <title>Common Errors</title>
1629 Many questions are asked on the mailing lists regarding browsing. The majority of browsing
1630 problems originate from incorrect configuration of NetBIOS name resolution. Some are of
1635 <title>How Can One Flush the Samba NetBIOS Name Cache without Restarting Samba?</title>
1638 <indexterm><primary>flush name cache</primary></indexterm>
1639 Samba's <command>nmbd</command> process controls all browse list handling. Under normal circumstances it is
1640 safe to restart <command>nmbd</command>. This will effectively flush the Samba NetBIOS name cache and cause it
1641 to be rebuilt. This does not make certain that a rogue machine name will not re-appear
1642 in the browse list. When <command>nmbd</command> is taken out of service, another machine on the network will
1643 become the Browse Master. This new list may still have the rogue entry in it. If you really
1644 want to clear a rogue machine from the list, every machine on the network will need to be
1645 shut down and restarted after all machines are down. Failing a complete restart, the only
1646 other thing you can do is wait until the entry times out and is then flushed from the list.
1647 This may take a long time on some networks (perhaps months).
1653 <title>Server Resources Can Not Be Listed</title>
1655 <para><quote>My Client Reports <quote>This server is not configured to list shared resources</quote></quote></para>
1659 Your guest account is probably invalid for some reason. Samba uses the
1660 guest account for browsing in <command>smbd</command>. Check that your guest account is
1664 <para>Also see <smbconfoption><name>guest account</name></smbconfoption> in the &smb.conf; man page.</para>
1669 <title>I get an <errorname>`Unable to browse the network'</errorname> error</title>
1671 <para>This error can have multiple causes:
1672 <indexterm><primary>browsing problems</primary></indexterm>
1676 <listitem><para>There is no Local Master Browser. Configure &nmbd;
1677 or any other machine to serve as Local Master Browser.</para></listitem>
1678 <listitem><para>You cannot log onto the machine that is the local master
1679 browser. Can you logon to it as a guest user? </para></listitem>
1680 <listitem><para>There is no IP connectivity to the Local Master Browser.
1681 Can you reach it by broadcast?</para></listitem>
1686 <title>Browsing of Shares and Directories is Very Slow</title>
1689 <indexterm><primary>slow browsing</primary></indexterm>
1690 There are only two machines on a test network. One a Samba server, the other a Windows XP machine.
1691 Authentication and logons work perfectly, but when I try to explore shares on the Samba server, the
1692 Windows XP client becomes unresponsive. Sometimes it does not respond for some minutes. Eventually,
1693 Windows Explorer will respond and displays files and directories without problem.
1694 display file and directory.</quote>
1698 But, the share is immediately available from a command shell (<command>cmd</command>, followed by
1699 exploration with dos command. Is this a Samba problem or is it a Windows problem? How can I solve this?
1703 Here are a few possibilities:
1708 <term>Bad Networking Hardware</term>
1710 <indexterm><primary>bad hardware</primary></indexterm>
1711 <indexterm><primary>WebClient</primary></indexterm>
1712 Most common defective hardware problems center around low cost or defective HUBs, routers,
1713 Network Interface Controllers (NICs) and bad wiring. If one piece of hardware is defective
1714 the whole network may suffer. Bad networking hardware can cause data corruption. Most bad
1715 networking hardware problems are accompanied by an increase in apparent network traffic,
1721 <term>The Windows XP WebClient</term>
1723 A number of sites have reported similar slow network browsing problems and found that when
1724 the WebClient service is turned off, the problem disappears. This is certainly something
1725 that should be explored as it is a simple solution &smbmdash; if it works.
1730 <term>Inconsistent WINS Configuration</term>
1732 This type of problem is common when one client is configured to use a WINS server (that is
1733 a TCP/IP configuration setting) and there is no WINS server on the network. Alternately,
1734 this will happen is there is a WINS server and Samba is not configured to use it. The use of
1735 WINS is highly recommended if the network is using NetBIOS over TCP/IP protocols. If use
1736 of NetBIOS over TCP/IP is disabled on all clients, Samba should not be configured as a WINS
1737 server neither should it be configured to use one.
1742 <term>Incorrect DNS Configuration</term>
1744 If use of NetBIOS over TCP/IP is disabled, Active Directory is in use and the DNS server
1745 has been incorrectly configured. Refer <link linkend="adsdnstech">DNS and Active Directory</link> for more information.