none
WIndows 7 shares not (always) visible on other computers.

    Question

  • First of all, please note the subject line says "not visible ", not "not accessible ". There's a huge difference there.

    Next, allow me to sketch the situation first. These are the machines on my network:

    • (1) Router (LinkSys WRT310N)
    • (3) XP Pro 32bit PC
    • (1) NAS
    • (1) Media Player
    • (1) Windows 7 Pro x64 PC (I'll call that the "Win7 PC" from now on)

    I experience no problems sharing files and folders from the XP PCs, the NAS or the Media Player. But sharing files from the Win7 PC is a different story.

    For some strange reason, the Win7 shares are only visible on the other machines during the first 20 minutes (or so) after the Win7 PC has booted up. After those 20 minutes they disappear. Rebooting Win7 solves the problem for another 20 minutes again. Strangely enough, rebooting my router also cause the shares to show up for 20 minutes. So apparently, the shares show up 20 minutes after the Win7 PC connects to the network.

    Visible or not, the Win7 shares are always accessible . When they aren't visible, I can still access them by using their full network path, for instance "\\Win7\Share1". But, especially on the Media Player which has no keyboard, this is cumbersome at best.

    This is how the Win7 PC network is set up:

    • Network Type: WORK
    • Workgroup: WORKGROUP (same as all other machines on the network)
    • Network discovery: ON
    • File and Printer sharing: ON
    • Public folder sharing: OFF (I only want to share specific folders, but turning this on make no difference)
    • Media Streaming: OFF
    • File sharing connections: 128-bit
    • Password protected sharing: OFF
    • HomeGroup Connections: Allow Windows to manage

    The properties of my shared folders:

    • Sharing is ON
    • "Everyone " has read access

    Under gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options:

    • Network access: Allow anonymous SID/Name translation: Enabled
    • Network access: Do not allow anonymous enumeration of SAM accounts: Disabled
    • Network access: Do not allow anonymous enumeration of SAM accounts and shares: Disabled
    • Network access: Let Everyone permissions apply to anonymous users: Enabled
    • Network access: Restrict anonymous access to Named pipes and Shares: Disabled
    • Network security: LAN Manager authentication level: Send LM & NTLM - use NTLMv2 session security if negotiated

    Other Win7 settings:

    • Firewall: OFF
    • 3rd party firewalls: not installed

     

    So what could be causing the Win7 PC to become invisible on the network?

    Wednesday, December 29, 2010 10:30 AM

Answers

  • SOLVED!

    I found out what was causing the problems on all computers that disappeared form the network neighborhood. It was Windows Firewall . "But didn't you turn that off?". Yes I did, on all computers - but apparently that isn't enough. You need to complete disable the Windows Firewall service , prevent the service from starting altogether.

    Since I will mark this as answer (and this message will move to the top), let me recap the problem and solution.

     

    The Problem

    After startup, my Windows 7 computer and its shares would briefly appear in the other computer's network neighborhood only to disappear about half an hour later. At first I thought only my Windows 7 computer had this problem but after creating some shares on XP computers in the network, I found out those were experiencing the same problem. Only my NAS (running Linux), my network printer and a laptop with XP SP2 on it, didn't exhibit this problem.

    And even though the computers were not visible in the network neighborhood ("Network Places" in XP or simply "Network" in Windows 7), the shares were still reachable though their computername, for instance "\\Win7_PC\SharedFolder".

     

    What is supposed to happen

    In a simple Windows network segment, one computer serves as the master browser . The master browser is responsible for (amongst other things) collecting the names of computers that share some of their resources like folders or printers (so a computer which has File and Printer Sharing enabled). These computers are called servers .

    When a server starts up, it broadcasts it's presence for any master browser listening. This specific broadcast is called the Host Announce frame . Upon receiving of this frame, the master browser will add the server to the browser list . The server then, at set intervals, broadcasts the same Host Announce frame so the master browser knows the server is still up and running. The interval at which a server re-broadcasts these announcements is also sent with every Host Announce frame, so the master browser knows when to expect the server's next announcement. If 3 times this interval has passed without the master browser receiving another announcement from the server, it assumes the server has disconnected (due to a crash, power down, or network failure) and removes the computer from the browser list. So for instance, if a server send a Host Announce frame, and it contains it will send another Host Announce frame in 12 minutes, the master browser will remove the server from the browser list if it hasn't received a Host Announcement frame from this server in 36 (3 x 12) minutes.

     

    What really happened

    After examining the network traffic, I found out the problematic computers only sent the Host Announce frame once - upon startup of the computer (or more precisely, when the network service was started). So when the computers started, they would appear in the network neighborhood, but dropped off 36 minutes later (some after 24 minutes because their Host Announce interval was set to 8 minutes). I had already turned the firewall off on these computers. But apparently that was not enough. For some reason, the Windows Firewall service was still blocking this traffic and the only way to solve it was to completely disable the Windows Firewall service (so prevent it from starting altogether).

    Since I've disabled the Windows Firewall service, I've seen the Host Announcements being broadcast at regular intervals again, and the servers no longer disappear from the network neighborhood.

    • Marked as answer by ClarkVent Monday, January 10, 2011 12:09 AM
    Monday, January 10, 2011 12:09 AM

All replies

  • I don't know but would try to identify which computer is the network browse master in the first 20 minutes and after.  It sounds like when the network connection is first established for the Win 7 PC (either by booting or interrupting the connection when you reset your router) its initial broadcast makes it visible but browsing malfunctions later.  It might be useful to fully enable NetBIOS on both PCs and see if that effects it.

    The venerable browstat utility doesn’t work with Windows 7.  There's a method shown below to use instead.
    http://scottiestech.info/2009/02/14/how-to-determine-the-master-browser-in-a-windows-workgroup/
    --

    "ClarkVent" wrote in message news:932e8866-9f05-40d2-b86e-12a3bffeae75@communitybridge.codeplex.com...

    First of all, please note the subject line says "not visible ", not "not*accessible* ". There's a huge difference there.

    Next, allow me to sketch the situation first. These are the machines on my network:

    * (1) Router (LinkSys WRT310N)
    * (3) XP Pro 32bit PC
    * (1) NAS
    * (1) Media Player
    * (1) Windows 7 Pro x64 PC (I'll call that the "Win7 PC" from now on)

    I experience no problems sharing files and folders from the XP PCs, the NAS or the Media Player. But sharing files from the Win7 PC is a different story.

    For some strange reason, the Win7 shares are only visible on the other machines during the first 20 minutes (or so) after the Win7 PC has booted up. After those 20 minutes they disappear. Rebooting Win7 solves the problem for another 20 minutes again. Strangely enough, rebooting my *router* /also/ cause the shares to show up for 20 minutes. So apparently, the shares show up 20 minutes after the Win7 PC connects to the network.

    Visible or not, the Win7 shares are /always/ accessible. When they aren't visible, I can still access them by using their full network path, for instance "\\Win7\Share1". But, especially on the Media Player which has no keyboard, this is cumbersome at best.

    This is how the Win7 PC network is set up:

    * Network Type: *WORK*
    * Workgroup: *WORKGROUP*   (same as all other machines on the network)
    * Network discovery: *ON*
    * File and Printer sharing: *ON*
    * Public folder sharing: *OFF*   (I only want to share specific folders, but turning this on make no difference)
    * Media Streaming: *OFF*
    * File sharing connections: *128-bit*
    * Password protected sharing: *OFF*
    * HomeGroup Connections: *Allow Windows to manage*

    The properties of my shared folders:

    * Sharing is *ON*
    * "/*Everyone*/   " has read access

    Under gpedit.msc -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options:

    * Network access: Allow anonymous SID/Name translation: *Enabled*
    * Network access: Do not allow anonymous enumeration of SAM accounts: *Disabled*
    * Network access: Do not allow anonymous enumeration of SAM accounts and shares:*Disabled*
    * Network access: Let Everyone permissions apply to anonymous users: *Enabled*
    * Network access: Restrict anonymous access to Named pipes and Shares: *Disabled*
    * Network security: LAN Manager authentication level: *Send LM & NTLM - use NTLMv2 session security if negotiated*

    Other Win7 settings:

    * Firewall: *OFF*
    * 3rd party firewalls: *not installed*



    So what could be causing the Win7 PC to become invisible on the network?

    Wednesday, December 29, 2010 4:48 PM
  • NetBios is already enabled on all PCs.

    Anyway, I wanted to find out who the Master Browser on the network was so I opened a command window. First I wanted a list of the computers in my workgroup:

    C:\>net view /domain:WORKGROUP
    Server Name      Remark
    
    -------------------------------------------------------------------------------
    \\NAS
    The command completed successfully.
    

    As you can see, for some reason only my NAS was returned. I then decided to completely reset my network. So I turned everything off, including my router. Then I switched everything back on in the following order:

    1. Router
    2. Win7 PC
    3. XP PCs
    4. NAS
    5. Media Player

    Then I again called up a list of all computers in my workgroup:

    C:\>net view /domain:WORKGROUP
    Server Name      Remark
    
    -------------------------------------------------------------------------------
    \\WIN7_PC
    \\NAS
    \\XP_PC1
    \\XP_PC2
    \\MEDIA
    The command completed successfully.
    

    Now it did list all the machines on my network. I also saw my Win7 PC was the Master Browser:

    C:\>nbtstat -a win7_pc
    
    Local Area Connection:
    Node IpAddress: [192.168.1.100] Scope Id: []
    
          NetBIOS Remote Machine Name Table
    
        Name        Type     Status
      ---------------------------------------------
      WIN7_PC    <00> UNIQUE   Registered
      WORKGROUP   <00> GROUP    Registered
      WIN7_PC    <20> UNIQUE   Registered
      WORKGROUP   <1E> GROUP    Registered
      WORKGROUP   <1D> UNIQUE   Registered
      ..__MSBROWSE__.<01> GROUP    Registered
    
      MAC Address = 00-XX-XX-XX-XX-XX
    
    
    Bluetooth Network Connection:
    Node IpAddress: [0.0.0.0] Scope Id: []
    
      Host not found.
    

    I then waited about 30 minutes and called up the list of computers in my workgroup again:

    C:\>net view
    Server Name      Remark
    
    -------------------------------------------------------------------------------
    \\NAS
    The command completed successfully.
    
    Again, only the NAS was listed.

    So it appears that there's something wrong with the Win7 PC being the Master Browser. But what? And how to solve it?

    Wednesday, December 29, 2010 8:15 PM
  • That's a lot of good information.  It might have been useful to also run the nbtstat -a against the XP machines to see if there was a master browser conflict.  I don't know what's going on with the Windows 7 browsing functionality.  Very strange.

    I see a possible workaround by maybe preventing the Windows 7 machine from becoming the master browser with the registry settings below.  (or maybe vice versa the XP machines? - not sure what's best but it could be something to experiment with)

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Browser\Parameters\
    MaintainServerList = No
    IsDomainMaster =FALSE

    --
     SNIP


    So it appears that there's something wrong with the Win7 PC being the Master Browser. But what? And how to solve it?

    Wednesday, December 29, 2010 9:35 PM
  • Ok, this gets weirder. Contrary to what I said in my original post, it's not only the Win7 PC that is disappearing from the list, it's all machines - except for the NAS. The reason I hadn't noticed that before is because usually only the Win7 PC, the NAS and the Media Player are active on the network. Since the Media Player has no shares, it never appears on the network list anyway. So when I request a list of shares on the Media Player, I usually only see the NAS and since the only other shares on the network are from the Win7 PC, I always figured it was a problem on the Win7 PC.

    Anyway, I made the registry changes you suggested and confirmed one of the XP PC's was now the Master Browser. And... the exact same thing happened. After about 20 minutes, all machines disappeared from the network list except for the NAS. Then I switched all PCs off and on again (so not the NAS), and confirmed the NAS was now the Master Browser. And again, after 20 minutes everything but the NAS disappeared.

    So apparently this is not a problem with the Win7 PC but a general problem on my network.

    But what causes this, I have no idea. And I have equally no idea why this isn't affecting the NAS.

    Thursday, December 30, 2010 9:16 AM
  • I've done some more testing - specifically how long it takes before a PC disappears from the network neighborhood. I've tested every PC at least 5 times. This is how I tested it:

    1. Disable the network adapter
    2. Enable the network adapter
    3. Note the time the PC shows up in network neighborhood
    4. Note the time the PC disappears from network neighborhood
    5. Calculate the difference

    The results are quite surprising, but very consistent. Every test it took exactly (give or take 10 seconds) the same amount of time before the PC became invisible:

    • Win7 PC: 24 minutes
    • XP PC's (all of them): 6 minutes
    • NAS: never

     

    Thursday, December 30, 2010 1:23 PM
  • I suspect that the NAS is running Linux with SAMBA and that the problems lies there.  If so, it would be useful to turn off the NAS for a while to test this.   SAMBA is known to sometimes cause problems along these lines. On a PC running Linux it is possible to modify smb.conf to fix this.  Is that file present and accessible on the NAS?  If so and you can confirm this theory, I can advise further.
    --

    "ClarkVent" wrote in message news:4e17a7d4-d017-48f6-8c70-e7bcaf67991c@communitybridge.codeplex.com...

    I've done some more testing - specifically how long it takes before a PC disappears from the network neighborhood. I've tested every PC at least 5 times. This is how I tested it:

    1. Disable the network adapter
    2. Enable the network adapter
    3. Note the time the PC shows up in network neighborhood
    4. Note the time the PC disappears from network neighborhood
    5. Calculate the difference

    The results are quite surprising, but very consistent. Every test it took exactly (give or take 10 seconds) the same amount of time before the PC became invisible:

    * Win7 PC: 24 minutes
    * XP PC's (all of them): 6 minutes
    * NAS: never

    Thursday, December 30, 2010 4:03 PM

  • You are right. Shutting down the NAS causes the problem to go away - all machines in the workgroup stay visible. So that's one step towards solving this problem. :)

    However, I don't have access to the NAS' smb.conf. This is a Buffalo Linkstation Pro (LS-XHL) which does not offer telnet. I found a few "hacks" on the net which claim can enable a telnet daemon on the LS-XHL - I'm currently looking in to that.
    Thursday, December 30, 2010 8:51 PM
  • Ok, one more step closer to a solution.

    After I had switched the NAS back on again, the other machines were disappearing from my network neighborhood again. That got me thinking. Why would the NAS be the only device that stayed visible? Then I realized that since the NAS is a Linux based device, it probably supports more than one method to resolve names. So perhaps it supported something other than NetBIOS and the network switched to this alternative name resolution.

    Then I remembered DNSMasq running on the router. DNSMasq offers DNS functionality as well so maybe that was conflicting with NetBIOS. So I went through the settings of my router (with dd-wrt firmware) and saw "DNSMasq for DNS " was turned on. I turned it off and saw the rest of my network devices pop back up again.

    What I don't understand is why it's conflicting. I also don't know what the consequences are of turning "DNSMasq for DNS" off in my router.

     

    Friday, December 31, 2010 12:09 AM
  • Hate to make this a one man show, but turning of "DNSMasq for DNS " in my router didn't solve the problem. It just took (a lot) longer for the other machines to drop off the list. But it's back to only listing the NAS again...
    Friday, December 31, 2010 1:32 AM
  • I suspect that the NAS is running Linux with SAMBA and that the problems lies there.  If so, it would be useful to turn off the NAS for a while to test this.   SAMBA is known to sometimes cause problems along these lines. On a PC running Linux it is possible to modify smb.conf to fix this.  Is that file present and accessible on the NAS?  If so and you can confirm this theory, I can advise further.

    Ok, I can now SSH into the NAS. I checked and the smb.conf file is available. So what do I need to change?

    Saturday, January 01, 2011 3:28 PM
  • Your experiment with DNSMasq is interesting.  I'm not sure what to make of it.

    It occurred to me that another option might be to disable browsing on all the PCs and let the NAS be the only browse master on the theory that it might resolve a conflict of master browsers.  It's probably more straightforward though to try the smb.conf change and restart the NAS and see how it goes.

    I would first try the following setting which disables all browsing functionality on the NAS

    [global]
    domain master = no
    local master = no
    preferred master = no
    os level = 0

    See http://web.mit.edu/rhel-doc/4/RH-DOCS/rhel-rg-en-4/s1-samba-network-browsing.html for some other options.

    There's also some interesting, though dated, discussion of these issue at http://www.samba.org/samba/docs/man/Samba-HOWTO-Collection/NetworkBrowsing.html
    --

    "ClarkVent" wrote in message news:7c09034e-e67f-4a38-b2cc-d952bea61501@communitybridge.codeplex.com...

    I suspect that the NAS is running Linux with SAMBA and that the problems lies there.  If so, it would be useful to turn off the NAS for a while to test this.   SAMBA is known to sometimes cause problems along these lines. On a PC running Linux it is possible to modify smb.conf to fix this.  Is that file present and accessible on the NAS?  If so and you can confirm this theory, I can advise further.

    Ok, I can now SSH into the NAS. I checked and the smb.conf file is available. So what do I need to change?

    Saturday, January 01, 2011 4:23 PM
  • These steps will turn off the brwing features of Samba but keep the service active. Look for the following three lines:

    local master =

    preferred master =

    domain master =

    Make sure all three values equal "no" Then restart the samba service. Note, you have to be "root" user to do this.

    If you don't see the above mentioned lines in the smb.conf then add them and again. The values must equal "no"

    In order to restart the smb service use commands:

    # service smb stop  (you might want to execute this commad twice to make sure the processes are stopped)

    # service smb start

    If you decide to just turn of the service completely then just use the "stop" command mentioned above.

     

    Saturday, January 01, 2011 4:35 PM
  • I made the changes and restarted the samba service. The other computers popped up in my network neighborbood. Now let's hope they stay there. :) I will report back later.

    # service smb stop  (you might want to execute this commad twice to make sure the processes are stopped)

    # service smb start

    Yeah, that didn't work so I did

    # /etc/init.d/smb restart
    
    instead.
    Saturday, January 01, 2011 5:47 PM
  • Ok, that didn't help. Everything except the NAS is still disappearing from the network neighborhood...
    Saturday, January 01, 2011 6:56 PM
  • *SIGH*

    It isn't the NAS that is causing the problem. If I switch the NAS off, the problem still occurs (although it does take a lot longer for the other machines to disappear of the list)...

    EDIT:

    I take that back. I really have no idea if the NAS is causing the problem, or if it's part of the problem...

    When the NAS is on, soon (within 30 minutes) all machines disappear from the network neighborhood and don't return until I either reset the network connection of the missing machine, or turn of the NAS.

    When the NAS is off, some machines disappear while others don't, and the machines that do disappear, randomly appear again. I don't know if this is the same problem or just "normal behavior" for a Windows network.

    Confused? I am.

    Saturday, January 01, 2011 10:28 PM
  • SNIP
    "ClarkVent" wrote in message news:b76a801f-3f56-4d5d-8130-fd5e80e598b5@communitybridge.codeplex.com...

    *SIGH*

    It isn't the NAS that is causing the problem. If I switch the NAS off, the problem still occurs (although it does take a lot longer for the other machines to disappear of the list)...

    EDIT:

    I take that back. I really have no idea if the NAS is *causing *the problem, or if it's *part *of the problem...

    When the NAS is on, soon (within 30 minutes) all machines disappear from the network neighborhood and don't return until I either reset the network connection of the missing machine, or turn of the NAS.

    When the NAS is off, some machines disappear while others don't, and the machines that do disappear, randomly appear again. I don't know if this is the same problem or just "normal behavior" for a Windows network.

    Confused? I am.

    Yes  :)

    Monday, January 03, 2011 8:40 PM
  • In my company we have a very similar problem. The only difference is that together with the XP machines the NAS servers disappear as well, and only the three Win 7 PC's that we have on the network remain visible.

    I found a link that mentions that the IPv6 implementation of Windows 7 may be problematic:

    http://itexpertvoice.com/home/windows-7-and-ipv6-useful-at-last/

    Since we are using Windows Server 2003, I have disabled IPv6 on the Win 7 PC's. I am not sure yet if this solves the problem (still testing) but you can try to see for yourself this works or not.

    Wednesday, January 05, 2011 5:42 AM
  • I had disabled IPv6 on the WIndows 7 machine entirely and that didn't help.

    To figure out what was happening, I wrote a little program that monitored the network and would notify me whenever the master browser changed, or whenever a device appeared/disappeared from the network.

    I used an old 233MHz laptop to run the network monitor program. When I booted the network, guess who won the master browser election every single time? The 233 MHz laptop! According to the election rules, the laptop would be at the bottom of the list but still it won the election every single time. I actually had to change a registry value to make sure it didn't participate in the browser election!

    Anyway, I ran the network monitor program and booted up all machines. Here's the log of my network monitor:

    1:13:40 (00:00:03): NAS is the master browser.
    1:13:41 (00:00:04): \\LAPTOP appeared on the network.
    1:13:41 (00:00:04): \\NAS appeared on the network.
    1:14:59 (00:01:82): \\WIN7_PC appeared on the network.
    1:15:07 (00:02:90): \\PRINTER appeared on the network.
    1:15:15 (00:02:98): \\XP_PC1 appeared on the network.
    1:17:38 (00:04:41): \\XP_PC2 appeared on the network.
    1:18:34 (00:05:97): \\XP_PX3 appeared on the network.
    1:24:01 (00:10:24): \\WIN7_PC disappeared from the network.
    1:25:43 (00:12:26): \\WIN7_PC appeared on the network.
    1:45:50 (01:28:67): \\XP_PC2 disappeared from the network.
    1:52:16 (01:21:81): \\XP_PC1 disappeared from the network.
    1:56:28 (01:17:29): \\WIN7_PC disappeared from the network.

    (Switch off \\XP_PC1:)
    2:19:18 (01:06:41): \\XP_PC1 appeared on the network.

    (Switch off \\XP_PC2:)
    2:31:32 (01:18:75): \\XP_PC2 appeared on the network.

    (Switch off \\WIN7_PC:)
    2:36:08 (01:23:51): \\WIN7_PC appeared on the network.
    2:55:20 (02:18:97): \\XP_PC1 disappeared from the network.
    2:55:35 (02:18:82): \\XP_PC2 disappeared from the network.
    3:06:22 (02:-7:35): \\PRINTER disappeared from the network.
    3:08:44 (02:-5:93): \\XP_PC3 disappeared from the network.
    3:12:16 (02:-1:81): \\WIN7_PC disappeared from the network.

    In above situation, the NAS was the master browser all the time and as you can see, eventually all machines except the NAS and (strangely enough) the laptop disappeared from the network. Weird thing is, that switching a few machine OFF actually made them reappear on the network. PS: don't mind the strange numbers between the brackets. That was actually a bug in the program and was fixed later.

    I then wanted to know if the NAS was the problem and decided to restart the network with the NAS off. I also took a few machine off the network to make things a bit more oversee-able. Here's the next log:

     

    16:06:58 (00:00:03): WIN7_PC is the master browser.
    16:06:58 (00:00:03): \\WIN7_PC appeared on the network.
    16:06:58 (00:00:03): \\XP_PC2 appeared on the network.
    16:06:58 (00:00:03): \\LAPTOP appeared on the network.
    16:06:58 (00:00:03): \\XP_PC1 appeared on the network.
    16:07:14 (00:00:19): \\XP_PC1 disappeared from the network.
    16:14:08 (00:07:13): \\XP_PC1 appeared on the network.
    16:54:52 (00:47:57): \\XP_PC2 disappeared from the network.
    17:19:09 (01:12:14): \\XP_PC1 disappeared from the network.
    17:30:47 (01:23:52): \\WIN7_PC disappeared from the network.
    17:38:42 (01:31:47): \\WIN7_PC appeared on the network.
    18:54:45 (02:47:50): \\WIN7_PC disappeared from the network.
    19:03:11 (02:56:16): \\WIN7_PC appeared on the network.
    20:18:42 (04:11:47): \\WIN7_PC disappeared from the network.
    20:27:40 (04:20:45): \\WIN7_PC appeared on the network.
    21:43:08 (05:36:13): \\WIN7_PC disappeared from the network.
    21:52:07 (05:45:12): \\WIN7_PC appeared on the network.

    As you can see, even without the NAS all machines (again, except the laptop) disappear from the network. And the WIN7 machine gets into some weird cycle where it disappears from the network (even though it's the master browser itself) only to re-appear 9 minutes later.

    So next I take the WIN7_PC off-line. I won't bore you with yet another log because the result was the same. Still all other machines disappeared of the network.

    In the end, I have taken all PC's off the network one by one and that didn't make a difference. I've also made each machine master browser at one time, and that didn't make any difference either.

    So in short, it does not matter which PC is the master browser. It also doesn't matter which machines are on and which are off. Machines keep disappearing from the network. And the weird thing is that only 3 machines never disappear: the NAS, the printer and the laptop. The NAS and the Printer both run some Linux distribution no doubt. And the laptop is the only machine with XP Home. The machines that disappear either run Win7 or XP Pro (SP3).

     

     

    Friday, January 07, 2011 8:56 PM
  • Just brainstorming here.

    What would cause a computer to drop of the network list? I believe it can only be one of two reasons: either it's no longer broadcasting its presence, or its broadcasts no longer reach the master browser.

    But if I monitor network traffic with Process Monitor, I see this:

    23:43:15,3132268    System    4    UDP Send    WIN7_PC:netbios-ns -> 192.168.1.255:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:43:15,3133025    System    4    UDP Receive    192.168.1.255:netbios-ns -> WIN7_PC:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:43:16,0628226    System    4    UDP Send    WIN7_PC:netbios-ns -> 192.168.1.255:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:43:16,0628925    System    4    UDP Receive    192.168.1.255:netbios-ns -> WIN7_PC:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:43:16,8128606    System    4    UDP Send    WIN7_PC:netbios-ns -> 192.168.1.255:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:43:16,8129483    System    4    UDP Receive    192.168.1.255:netbios-ns -> WIN7_PC:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0

    To me, that looks like WIN7_PC broadcasting its NETBios name. However, the WIN7_PC is currently not in the network list. So perhaps the broadcasts are not arriving? But how can a machine not receive its own broadcasts?

    PS: one thing that bothers me, is that I also see this:

    23:58:10,3462580    System    4    UDP Send    WIN7_PC:netbios-ns -> 128.172.131.178:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:58:10,3910397    System    4    UDP Send    WIN7_PC:netbios-ns -> 89.23.149.2:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:58:10,3991340    System    4    UDP Send    WIN7_PC:netbios-ns -> 95.158.166.19:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:58:10,4530984    System    4    UDP Send    WIN7_PC:netbios-ns -> 91.203.79.218:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0
    23:58:10,5182295    System    4    UDP Send    WIN7_PC:netbios-ns -> 87.97.217.229:netbios-ns    SUCCESS    Length: 50, seqnum: 0, connid: 0

    Is that something I should be worried about?

    Friday, January 07, 2011 10:57 PM
  • Ok, another update. I now know what is causing the computers to drop off the network list. I don't know what is "causing the cause" though.

    The problem is indeed that computers don't broadcast their presence.  In a nutshell, this is what is supposed to happen:

    When a computer starts up, it broadcasts it's presence for any master browser listening. This is called the Host Announce . It then, at regular intervals, keeps broadcasting the same Host Announce so the master browser knows the computer is still up and running. With every broadcast, it also tells the master browser how long until it can expect the next Host Announce broadcast - for instance, in 12 minutes from now. The master browser waits 3 times this interval for the broadcast to arrive. So in this case 3 x 12 = 36 minutes. If it hasn't received the computer's broadcast in those 36 minutes, it assumes the computer has disconnected (due to a crash, power down, or network failure) and removes the computer from the browser list.

    On my system, only my XP laptop, the NAS and my printer do not disappear from the network. All other computers (4 x XP and 1 x Win7) do.

    I've run a packet sniffer to see what was happening and found out that all "defective" computers display the same behavior: all of them only broadcast their presence once (so they only broadcast the Host Announce once). After that, they keep quiet. So after 3 times the time period the computers said they will broadcast again, the master browser removes them from the list.

    At first I thought maybe they did send other broadcasts but that they were for some reason blocked by a firewall. But, besides the fact I have no firewalls running, this isn't the case. The initial broadcast isn't blocked by anything and there's no difference between the initial Host Announce broadcast and subsequent Host Announce broadcasts. Also, if I broadcast a message (from for instance the master browser) to all computers that they should announce themselves (a Forced Announce ), the computers broadcast their Host Announce just fine and those broadcasts arrive at the master browser (causing the computers to pop-up again in the network list).

    I also noticed another problem. Whenever a computer gracefully shuts down, it should do another Host Announce broadcast, but this time telling the master browser it's no longer a server . So in fact, it's not telling the master browser it's shutting down, it's just saying it no longer has something to share. None of the Windows computers broadcast this message. So when you shut down a Windows machine, it keeps lingering around in the network list for 3 times it's announcement interval.

    Now I haven't found what is causing these computers to stop broadcasting. The only thing they have in common is that they are running Windows (XP and Win7). But so is the laptop and the laptop is not displaying this behavior. The only difference I can find between the XP Laptop and the other Windows machines, is that the laptop is running SP2. The other machines are running SP3.

    So now I'm suspecting there's a bug in the newer implementations of the Browser Service. I really can't think of anything else.

     

    Sunday, January 09, 2011 12:44 PM
  • SOLVED!

    I found out what was causing the problems on all computers that disappeared form the network neighborhood. It was Windows Firewall . "But didn't you turn that off?". Yes I did, on all computers - but apparently that isn't enough. You need to complete disable the Windows Firewall service , prevent the service from starting altogether.

    Since I will mark this as answer (and this message will move to the top), let me recap the problem and solution.

     

    The Problem

    After startup, my Windows 7 computer and its shares would briefly appear in the other computer's network neighborhood only to disappear about half an hour later. At first I thought only my Windows 7 computer had this problem but after creating some shares on XP computers in the network, I found out those were experiencing the same problem. Only my NAS (running Linux), my network printer and a laptop with XP SP2 on it, didn't exhibit this problem.

    And even though the computers were not visible in the network neighborhood ("Network Places" in XP or simply "Network" in Windows 7), the shares were still reachable though their computername, for instance "\\Win7_PC\SharedFolder".

     

    What is supposed to happen

    In a simple Windows network segment, one computer serves as the master browser . The master browser is responsible for (amongst other things) collecting the names of computers that share some of their resources like folders or printers (so a computer which has File and Printer Sharing enabled). These computers are called servers .

    When a server starts up, it broadcasts it's presence for any master browser listening. This specific broadcast is called the Host Announce frame . Upon receiving of this frame, the master browser will add the server to the browser list . The server then, at set intervals, broadcasts the same Host Announce frame so the master browser knows the server is still up and running. The interval at which a server re-broadcasts these announcements is also sent with every Host Announce frame, so the master browser knows when to expect the server's next announcement. If 3 times this interval has passed without the master browser receiving another announcement from the server, it assumes the server has disconnected (due to a crash, power down, or network failure) and removes the computer from the browser list. So for instance, if a server send a Host Announce frame, and it contains it will send another Host Announce frame in 12 minutes, the master browser will remove the server from the browser list if it hasn't received a Host Announcement frame from this server in 36 (3 x 12) minutes.

     

    What really happened

    After examining the network traffic, I found out the problematic computers only sent the Host Announce frame once - upon startup of the computer (or more precisely, when the network service was started). So when the computers started, they would appear in the network neighborhood, but dropped off 36 minutes later (some after 24 minutes because their Host Announce interval was set to 8 minutes). I had already turned the firewall off on these computers. But apparently that was not enough. For some reason, the Windows Firewall service was still blocking this traffic and the only way to solve it was to completely disable the Windows Firewall service (so prevent it from starting altogether).

    Since I've disabled the Windows Firewall service, I've seen the Host Announcements being broadcast at regular intervals again, and the servers no longer disappear from the network neighborhood.

    • Marked as answer by ClarkVent Monday, January 10, 2011 12:09 AM
    Monday, January 10, 2011 12:09 AM
  • Great work!  And an intriguing discussion - it led me to dig more deeply into WINS and NetBIOS though I never found an answer that made sense.

    So, apparently the Windows firewall service is preventing the periodic Host Announcements from occurring at all as contrasted to the firewall blocking NetBIOS traffic.  This would, as you speculated, seem to be a bug that should be fixed.

    I don't recall seeing this happening routinely at customer sites with workgroups, though I haven't routinely monitored network browsing there. I'm curious to keep an eye on it.

    Thanks for your insight.
    --
     "ClarkVent" wrote in message news:d16858c5-44ce-4121-880d-7f6aebf74209@communitybridge.codeplex.com...

    SOLVED!

    I found out what was causing the problems on all computers that disappeared form the network neighborhood. It was*Windows Firewall* . "But didn't you turn that off?". Yes I did, on all computers - but apparently that isn't enough.*You need to complete disable the Windows Firewall service* , prevent the service from starting altogether.

    Since I will mark this as answer (and this message will move to the top), let me recap the problem and solution.

    Monday, January 10, 2011 3:27 PM
  • I read through this entire post because I have the exact same problem.  However my major problem is my non Windows applications failing to find my Windows 7 SMB Shares and only find them when the Win 7 is rebooted "for a short time" then nothing, shares disappear.. Specifically the app im using is XBMC running on apple tv's and my OUYA running XBMC.  Since they're not windows based OS devices, the smb shares would disappear and drive me insane.

    Sure enough, the dam windows firewall service was running.  I've disabled it like you suggested.  Hopefully this fixes my issue as well.

    Thank you for your diligent diagnosing.  I would have never have thought to disable the actual service rather then just turning off the firewall in the control panel.  Way to go dude and thanks again!

    I'll have to come back and repost letting you all know it worked for me as well.  So far It seems ok.

    Tytuss

    Saturday, January 04, 2014 1:58 AM