Interesting Traces - WINS ACTIVE NAME ERROR

Background: a new Win2K server was being installed that would be replacing an existing server. The old server was taken down and the new server was installed with the old server's name and IP address. With the name change a reboot was required and after the reboot an error was repoorted indicating that the name was in use. The following trace was captured with netmon on the new server. The first 2 octets of the IP address have been masked and the name has been changed. Both the new server and the WINS server are on the same class B network but on different subnets. When the new server was taken down and the old server booted it came up without the name error.

The trace shows a name registration request being sent to the WINS server and an active name error being returned. Ordinarily this means that the name is in use but in this instance we know for a fact that the name is not in use by any other system.

The key is that the registration is a "MultiHomed Name Registration". What happened is that the WINS server had the name statically defined as UNIQUE. When it received the MultiHomed registration it conflicted with the UNIQUE setting and reported an error. The new server had 2 IP interfaces so used the MultiHomed request. The old server had just 1 interface so used a standard registration request. Once the static entry was removed the new server came up just fine.

One other note the WINS server was a Windows NT 4 system. I was unable to duplicate the problem with a Win2K WINS server.


Network Monitor trace  Fri 05/30/03 20:12:20  ftserver 2925 trace mon.txt

Frame    Time      Src MAC Addr    Dst MAC Addr    Protocol    Description      Src Other Addr     Dst Other Addr     Type Other Addr

1637     86.281250    000347E313BE    3COM  98D8C7    NBT      NS: MultiHomed Name Registration req. for MY_NAME xx.xx.161.17     xx.xx.159.11      
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
  IP: ID = 0x701; Proto = UDP; Len: 96
      IP: Version = 4 (0x4)
      IP: Header Length = 20 (0x14)
      IP: Precedence = Routine
      IP: Type of Service = Normal Service
      IP: Total Length = 96 (0x60)
      IP: Identification = 1793 (0x701)
    + IP: Flags Summary = 0 (0x0)
      IP: Fragment Offset = 0 (0x0) bytes
      IP: Time to Live = 128 (0x80)
      IP: Protocol = UDP - User Datagram
      IP: Checksum = 0xEA48
      IP: Source Address = xx.xx.161.17
      IP: Destination Address = xx.xx.159.11
      IP: Data: Number of data bytes remaining = 76 (0x004C)
+ UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 76 (0x4C)
  NBT: NS: MultiHomed Name Registration req. for MY_NAME        <00>
      NBT: Transaction ID = 32902 (0x8086)
    + NBT: Flags Summary = 0x7900 - Req.; MultiHomed Name Registration; Success
      NBT: Question Count = 1 (0x1)
      NBT: Answer Count = 0 (0x0)
      NBT: Name Service Count = 0 (0x0)
      NBT: Additional Record Count = 1 (0x1)
      NBT: Question Name = MY_NAME        <00>
      NBT: Question Type = General Name Service
      NBT: Question Class = Internet Class
      NBT: Resource Record Name = MY_NAME        <00>
      NBT: Resource Record Type = NetBIOS General Name Service
      NBT: Resource Record Class = Internet Class
      NBT: Time To Live(Milliseconds) = 300000 (0x493E0)
      NBT: RDATA Length = 6 (0x6)
    + NBT: Resource Record Flags = 24576 (0x6000)
      NBT: Owner IP Address = xx.xx.161.17

********************************************************************************************************************************************************
1638     86.281250    3COM  98D8C7    000347E313BE    NBT      NS: Registration (Node Status) resp. for MY_NAME xx.xx.159.11     xx.xx.161.17      
+ Frame: Base frame properties
+ ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
  IP: ID = 0xE809; Proto = UDP; Len: 90
      IP: Version = 4 (0x4)
      IP: Header Length = 20 (0x14)
      IP: Precedence = Routine
      IP: Type of Service = Normal Service
      IP: Total Length = 90 (0x5A)
      IP: Identification = 59401 (0xE809)
    + IP: Flags Summary = 0 (0x0)
      IP: Fragment Offset = 0 (0x0) bytes
      IP: Time to Live = 128 (0x80)
      IP: Protocol = UDP - User Datagram
      IP: Checksum = 0x0946
      IP: Source Address = xx.xx.159.11
      IP: Destination Address = xx.xx.161.17
      IP: Data: Number of data bytes remaining = 70 (0x0046)
+ UDP: Src Port: NETBIOS Name Service, (137); Dst Port: NETBIOS Name Service (137); Length = 70 (0x46)
  NBT: NS: Registration (Node Status) resp. for MY_NAME        <00>, Name Active error., Owner Addr. xx.xx.161.17
      NBT: Transaction ID = 32902 (0x8086)
    + NBT: Flags Summary = 0xAD86 - Resp.; Registration; Name Active error.
      NBT: Question Count = 0 (0x0)
      NBT: Answer Count = 1 (0x1)
      NBT: Name Service Count = 0 (0x0)
      NBT: Additional Record Count = 0 (0x0)
      NBT: Resource Record Name = MY_NAME        <00>
      NBT: Resource Record Type = NetBIOS General Name Service
      NBT: Resource Record Class = Internet Class
      NBT: Time To Live(Milliseconds) = 518400 (0x7E900)
      NBT: RDATA Length = 6 (0x6)
    + NBT: Resource Record Flags = 24576 (0x6000)
      NBT: Owner IP Address = xx.xx.161.17

This page was last modified on 03-06-14

Send comments and suggestions
to ndav1@cox.net