XP NetBIOS Name Discovery Problems (WAS: Stuck Firewall Setting)



Dave Morschhauser
07-10-2005, 02:00 AM
I am re-posting/summarizing this traffic here, as it does not appear to be a
firewall problem, and possibly should have been posted in this group first.
The original message is listed first annotated with additional information I
have provided since, as well as a response I received on
....windows.networking.firewall regarding the setting for Windows Firewall.

"Dave Morschhauser" <someone@microsoft.com> wrote in message news:...
I am having a problem with NetBIOS over TCP. My Laptop does not appear to
respond any longer to NBSTAT name queries that are made via port 137.

I was using my laptop on a college campus over the weekend, and had my
Windows Firewall turned ON. When I returned to my home, I turned the
Windows Firewall OFF and tried to connect to my main desktop computer using
Windows Explorer and opening the network neighborhood - but, I received an
error that "\\XXXX is not accessible. You may not have permission to use
this network resource. Contact the administrator (blah, blah, blah)the
network path was not found".

However, when I use the IP address of the desktop computer I can connect to
the shared folders on the desktop fine (Start=>Run=>\\192.168.1.1). Using
the IP address, Windows explorer allows me to move, copy and delete files
once connected. I can connect both ways, from the desktop to the laptop and
from the laptop to the desktop. The desktop sees all of the computers on my
network, except for the laptop, in the network neighborhood. But I cannot
connect using either computer's NetBIOS name.

Further investigation using a packet sniffer shows that "NBSTAT queries"
are being sent to the laptop on port 137, but that the laptop makes no
response to the query. Since the symptoms mimic what would happen if a
firewall was set to block that port, I was wondering if there was any way
that the Windows Firewall could have gotten "stuck".

I have also noticed that the laptop is apparently ignoring packets from the
master browser in response to the laptop's "BROWSER Backup List" requests.

My set-up is
Laptop: WinXP SP-2
Desktop: Win2K SP-4
Hubs: A Netgear MR-324 broadband router and an Allied Telesyn FS series
8-port 10/100 switch.
DHCP served by the Netgear router, providing Client, Gateway and DNS
server addresses (confirmed)

I have tried uninstalling and reinstalling network services and protocols,
and have run the scripts to reset the Winsock LSP Chain and the Internet
Protocol (TCP/IP) stack as described in

http://support.microsoft.com/kb/892350 and
http://support.microsoft.com/kb/299357 respectively.


Any thoughts?

Dave.


"David Beder [MSFT]" <dbeder@online.microsoft.com> wrote in message
news:uSjtr$6eFHA.228@TK2MSFTNGP12.phx.gbl...
> Is there a typo and you had meant "and had my Windows Firewall turned
OFF"?
> ie, if you've got it turned on, then it's very likely set to block the
port
> (and most others). UDP 137 can be enabled in the firewall cpl under the
> File and Printer Sharing option.
>
> --
> David
> Microsoft Windows Networking
> This posting is provided "AS IS" with no warranties, and confers no
rights.
>


"Dave Morschhauser" <someone@microsoft.com> wrote in message news:...
> Thank you for your response.
>
> Not a typo, but still not very clear: While I was on the college campus,
I
> turned the Windows Firewall ON, (since I had no control over anything on
the
> campus network). When I returned home, I turned the Windows Firewall OFF
> (the router provides the necessary security), but I am still experiencing
> trouble with NetBIOS Name discovery.
>
>< snippage, annotated below>
>
> I have checked the Windows Firewall settings several times, even turning
the
> firewall on and off again, but with no success.
>
>

Chuck
07-10-2005, 02:00 AM
On Tue, 28 Jun 2005 10:56:52 -0400, "Dave Morschhauser" <someone@microsoft.com>
wrote:

>I am re-posting/summarizing this traffic here, as it does not appear to be a
>firewall problem, and possibly should have been posted in this group first.
>The original message is listed first annotated with additional information I
>have provided since, as well as a response I received on
>...windows.networking.firewall regarding the setting for Windows Firewall.
>
>"Dave Morschhauser" <someone@microsoft.com> wrote in message news:...
> I am having a problem with NetBIOS over TCP. My Laptop does not appear to
>respond any longer to NBSTAT name queries that are made via port 137.
>
> I was using my laptop on a college campus over the weekend, and had my
>Windows Firewall turned ON. When I returned to my home, I turned the
>Windows Firewall OFF and tried to connect to my main desktop computer using
>Windows Explorer and opening the network neighborhood - but, I received an
>error that "\\XXXX is not accessible. You may not have permission to use
>this network resource. Contact the administrator (blah, blah, blah)the
>network path was not found".
>
> However, when I use the IP address of the desktop computer I can connect to
>the shared folders on the desktop fine (Start=>Run=>\\192.168.1.1). Using
>the IP address, Windows explorer allows me to move, copy and delete files
>once connected. I can connect both ways, from the desktop to the laptop and
>from the laptop to the desktop. The desktop sees all of the computers on my
>network, except for the laptop, in the network neighborhood. But I cannot
>connect using either computer's NetBIOS name.
>
> Further investigation using a packet sniffer shows that "NBSTAT queries"
>are being sent to the laptop on port 137, but that the laptop makes no
>response to the query. Since the symptoms mimic what would happen if a
>firewall was set to block that port, I was wondering if there was any way
>that the Windows Firewall could have gotten "stuck".
>
>I have also noticed that the laptop is apparently ignoring packets from the
>master browser in response to the laptop's "BROWSER Backup List" requests.
>
>My set-up is
> Laptop: WinXP SP-2
> Desktop: Win2K SP-4
> Hubs: A Netgear MR-324 broadband router and an Allied Telesyn FS series
>8-port 10/100 switch.
> DHCP served by the Netgear router, providing Client, Gateway and DNS
>server addresses (confirmed)
>
>I have tried uninstalling and reinstalling network services and protocols,
>and have run the scripts to reset the Winsock LSP Chain and the Internet
>Protocol (TCP/IP) stack as described in
>
>http://support.microsoft.com/kb/892350 and
>http://support.microsoft.com/kb/299357 respectively.
>
>
> Any thoughts?
>
> Dave.

Dave,

How did you turn WF off? Did you use one of the applets (Security Center /
Windows Firewall), or did you turn the service off (Services)? If the former,
you're OK, if the latter, you're not.
<http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-help.html>

What Node Type does the laptop show?
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.html#Resolution>

Try activating Windows Firewall, and enable the File and Printer Sharing
exception.

--
Cheers,
Chuck
http://nitecruzr.blogspot.com/
Paranoia is not a problem - it's a normal response from experience.
My email is AT DOT
actual address pchuck sonic net.

Dave Morschhauser
07-10-2005, 02:00 AM
The problem was solved by changing the NodeType. Apparently, the NodeType
was changed to Peer-to-Peer by the DHCP server when I connected at the
college campus, but since the DHCP serverlet in the Netgear MR-314 does not
provide any of the optional settings, the NodeType was left as set on the
college campus when I returned to my home network.

Deleting the Registry Key
"HKLM\System\CurrentControlSet\Services\NetBT\Parameters\DHCPNodeType" and
rebooting the laptop did the trick.

Thanks to all who responded with suggestions. Along the way I accomplished
some clean-up I should have done anyhow, and I (re)learned something new.
Special thanks to (P)Chuck for his Network Blog!


"Chuck" <none@example.net> wrote in message
news:oqr2c1d5cinblfhgpdj8eli7hgtkpstnms@4ax.com...
> On Tue, 28 Jun 2005 10:56:52 -0400, "Dave Morschhauser"
<someone@microsoft.com>
> wrote:
>
> >I am re-posting/summarizing this traffic here, as it does not appear to
be a
> >firewall problem, and possibly should have been posted in this group
first.
> >The original message is listed first annotated with additional
information I
> >have provided since, as well as a response I received on
> >...windows.networking.firewall regarding the setting for Windows
Firewall.
> >
> >"Dave Morschhauser" <someone@microsoft.com> wrote in message news:...
> > I am having a problem with NetBIOS over TCP. My Laptop does not appear
to
> >respond any longer to NBSTAT name queries that are made via port 137.
> >
> > I was using my laptop on a college campus over the weekend, and had my
> >Windows Firewall turned ON. When I returned to my home, I turned the
> >Windows Firewall OFF and tried to connect to my main desktop computer
using
> >Windows Explorer and opening the network neighborhood - but, I received
an
> >error that "\\XXXX is not accessible. You may not have permission to use
> >this network resource. Contact the administrator (blah, blah, blah)the
> >network path was not found".
> >
> > However, when I use the IP address of the desktop computer I can connect
to
> >the shared folders on the desktop fine (Start=>Run=>\\192.168.1.1).
Using
> >the IP address, Windows explorer allows me to move, copy and delete files
> >once connected. I can connect both ways, from the desktop to the laptop
and
> >from the laptop to the desktop. The desktop sees all of the computers on
my
> >network, except for the laptop, in the network neighborhood. But I
cannot
> >connect using either computer's NetBIOS name.
> >
> > Further investigation using a packet sniffer shows that "NBSTAT queries"
> >are being sent to the laptop on port 137, but that the laptop makes no
> >response to the query. Since the symptoms mimic what would happen if a
> >firewall was set to block that port, I was wondering if there was any way
> >that the Windows Firewall could have gotten "stuck".
> >
> >I have also noticed that the laptop is apparently ignoring packets from
the
> >master browser in response to the laptop's "BROWSER Backup List"
requests.
> >
> >My set-up is
> > Laptop: WinXP SP-2
> > Desktop: Win2K SP-4
> > Hubs: A Netgear MR-324 broadband router and an Allied Telesyn FS
series
> >8-port 10/100 switch.
> > DHCP served by the Netgear router, providing Client, Gateway and DNS
> >server addresses (confirmed)
> >
> >I have tried uninstalling and reinstalling network services and
protocols,
> >and have run the scripts to reset the Winsock LSP Chain and the Internet
> >Protocol (TCP/IP) stack as described in
> >
> >http://support.microsoft.com/kb/892350 and
> >http://support.microsoft.com/kb/299357 respectively.
> >
> >
> > Any thoughts?
> >
> > Dave.
>
> Dave,
>
> How did you turn WF off? Did you use one of the applets (Security Center
/
> Windows Firewall), or did you turn the service off (Services)? If the
former,
> you're OK, if the latter, you're not.
>
<http://nitecruzr.blogspot.com/2005/05/your-personal-firewall-can-either-hel
p.html>
>
> What Node Type does the laptop show?
>
<http://nitecruzr.blogspot.com/2005/05/troubleshooting-network-neighborhood.
html#Resolution>
>
> Try activating Windows Firewall, and enable the File and Printer Sharing
> exception.
>
> --
> Cheers,
> Chuck
> http://nitecruzr.blogspot.com/
> Paranoia is not a problem - it's a normal response from experience.
> My email is AT DOT
> actual address pchuck sonic net.

Chuck
07-10-2005, 02:00 AM
On Tue, 28 Jun 2005 12:47:26 -0400, "Dave Morschhauser" <someone@microsoft.com>
wrote:

>
>The problem was solved by changing the NodeType. Apparently, the NodeType
>was changed to Peer-to-Peer by the DHCP server when I connected at the
>college campus, but since the DHCP serverlet in the Netgear MR-314 does not
>provide any of the optional settings, the NodeType was left as set on the
>college campus when I returned to my home network.
>
>Deleting the Registry Key
>"HKLM\System\CurrentControlSet\Services\NetBT\Parameters\DHCPNodeType" and
>rebooting the laptop did the trick.
>
>Thanks to all who responded with suggestions. Along the way I accomplished
>some clean-up I should have done anyhow, and I (re)learned something new.
>Special thanks to (P)Chuck for his Network Blog!

Dave,

Thanks for the update, and for the feedback!

--
Cheers,
Chuck
http://nitecruzr.blogspot.com/
Paranoia is not a problem - it's a normal response from experience.
My email is AT DOT
actual address pchuck sonic net.


XP NetBIOS Name Discovery Problems (WAS: Stuck Firewall Setting)