Nbtstat

[Igaduma]

Hi all,

I'm administrating several NT4 workstations on a subnet of a corporate LAN.

I configured each machine with a static IP adress & correct routing information, ...
But, for some reason I get following error in the event viewer from time to time:
The machine still talks to the DNS & Wins server. Only dynamic-static IP has been changed.

This is the message in the event viewer:

...Another machine has sent a name release message to this machine probably because a duplicate name has been detected on the TCP network. The IP address of the node that sent the message is in the data.
Use nbtstat -n in a command window to see which name is in the Conflict state.

And when I check the HEX value of the data, the IP adress turns out to our BDC,WINS & DHCP server.

There are no duplicate IP adress or duplicate hostnames.


Anybody an idea ?

Thanks.
Iga-Duma

 

[ShackDaddy]

Sounds like you may have originally created a reservation in DHCP for one of these statically configured workstations, or a static entry in WINS, and the server is telling the workstation that it is using a name that is already registered to a system with a different IP or MAC address (depending on the service involved). Actually, this more likely has to do with WINS, since DHCP wouldn't care what the name is, unless it is also trying to register the name in DNS. The server isn't running Windows 2000, is it?

Do a NBTSTAT -n from the server and see what it has in its cache that matches your workstation's name. If the problem is intermittent you may not find anything right away and will have to get lucky.

Hope this give you a lead in the right direction,

ShackDaddy

 

[Igaduma]

Hi Shackdaddy,

thanks for the fast reply.

So, you mean that the itname is known to the wins but that it is registerd with another IP adress, aka the dynamic IP adress ?

Could be, but the IT name is (IT0392) is ping-able from outside the subnet so it is not resolved by broadcast but by wins, therefore the correct ip/itname is known by the wins.

Could it be that it is actually asked to release it's IP adress to renew it ?
something similar like ipconfig /release /renew..

I just want to be sure that it's not a setting I can change before I start mailing the wins server admin that I'm having trouble, coming from his server...


Thanks
Iga-Duma

 

[ShackDaddy]

PING resolves using DNS, not WINS, so it's not a good test of how NetBIOS names are being resolved. NET VIEW \\SERVERNAME will be a better test. And check the WINS database manually by listing the mappings.

If it's configured with a static address, it won't be asking for an IP renewal.

I'd bet it has something to do with WINS.

ShackDaddy

 

[JMcAllister]

How often are you receiving this message? Are you having any noticable problems, aside from the message?

MS article Q120752 quotes:

NOTE: This error message is generated in many cases due to normal circumstances,and should not be cause for alarm.

Regarding IP resolution, if WINS is enabled the default resolution for hostnames is:
1) Check to see if the name is the machine itself
2) Check the NB name cache
3) Query WINS
4) Broadcast for NB resolution
5) Check LMHOSTS
6) Check HOSTS
7) Query DNS
The order of these may change depending upon the WINS method you are using (b-node, p-node, m-node or h-node), but this is the default when WINS is enabled (h-node).

HTH,

~ jmcallister

 

[Igaduma]

Hi all,

The message pops up fairly random.
some days it's everywhere and some days it doesn't show.
User-activity is the same on all days.

We are on a subnet, and had some trouble with SMS.
Also, there is a ip async. routing but IT doesn't really understand what I mean.

If I traceroute from my subnet to the rest, I have 2 hops, our router is connected to the rest.
But, when tracerouting from outside our subnet there are 3 hops.
It goes to the default gateway, and from there to the router for my subnet.
But both routers are on the same layer.
So, packet goes from my subnet to my router, and reaches target directly.
To our subnet it FIRST goes to the default gateway, from there to another gateway (our router) and then hits the target on my subnet.
If I (with my laptop) add a static routing table that my packet doesn't go to the default gateway, but directly to the subnet router the hop count is reduced to 2, which is identical in both directions.

Generally this causes bad network throughput but IT here doesn't really care, or knows how overcome it without adding the static route everywhere.

I'm going to contact the admin of the BDC/WINS server.
They think I have duplicate IP/itnames on my subnet, although I checked, and rechecked, and rechecked but nothing is duplicated.

argh..


Iga-

 

[tls9923]

I am having a problem like this too. When I reboot I am getting this message also. I can reboot the server without the network conections, wait and then connect the network connections and all works fine. I have ran the nbtstat -n but am not sure how to convert the HEX information into an IP address can someone help.

Thanks

Terrel

 

[JMcAllister]

Terrel,

Take a look at article Q120752...

http://support.microsoft.com/default.aspx?scid=KB;EN-US;Q120752&

for info on converting the hex to an IP address.

~ jmcallister

 

[tls9923]

I see how to convert from Hex to decimal but what I do not understand is the offset to HEX. I am showing the following with a conflict

administrator <03> unique Conflict.

Thanks

 

[Igaduma]

Hi all,

yeah, I noticed something like this also.
The biosname & domain are all unique, but it's the username that is in conflict mode.

Anyway, I contacted our &quot;IT Helpdesk&quot; and explained the problem.
Now, I gave them the computername, explained the problems and informed them with the possible causes, they have admin access to all machines everywhere, but they requested..<insert drumroll>..
a printscreen of the event viewer & it's mac adress.
Most likely to just add a few days to the support-process & finally hope it just goes away.
They are going to put &quot;a trace&quot; on it...

héhé, I bet they have trouble connecting to these machines cause the throughput thanks to the 2 routers on the same subnet is low & bursty.

What do you mean &quot;the offset to hex&quot; ?


Iga-Duma

 

[JMcAllister]

The hex number in concern above is not an offset, it is the 16th byte of the NetBios name. This byte is used to differentiate between services using NetBIOS on a single machine. The <03>, which was mentioned, happens to be the Messenger Service (used for NET SEND). Since it was for the ADMINISTRATOR user account and it was in conflict, merely means that another user was logged in to another computer on the domain as ADMINISTRATOR, thus if a net send were to be sent to administrator, the network is unsure of which machine to send the message to to reach him(or her).

For more info on NetBIOS name suffixes, look at Q163409, on MS website.

As stated above (post #5), this is one of those normal circumstances which generate this error, and should not be cause for alarm.

Nevertheless, its good to see you loooking into it to the extent you are.

Regards,

~ jmcallister

 

[Igaduma]

Hi jmcallister,

hehe &quot;..To the extend..&quot;

Lets close this one...

Thanks for all the help everyone!

Iga-Duma