browstat (Browser Service)

MS Windows NT Browser
Introduction
Maintaining an accurate and efficient browse list on the network is important topic for Microsoft customers. This technical paper provides up-to-date information on Microsoft network browser architecture and reference material for advanced troubleshooting of browsing issues.
The browse list can be accurately maintained in any environment if the browser architecture, capabilities, and the way in which the network topology affects the browser's ability to gather information on the network are taken into consideration.
Understanding the operation of the browser services available on Microsoft operating systems is critical in effective troubleshooting. For example, the browser service relies on broadcasts when gathering information locally and needs the services of WINS or other name-resolution methods to pass a browse list to remote networks. The details of this process and the methods used are presented in this paper.
This paper should dispel some common misunderstandings about the browse list. The presence or lack of a computer name in the browse list does not give a clear indication of the computer's status on the network. A delay in gathering a browse list may occur due to various circumstances; however, a system can typically be contacted directly even though it cannot be found in Network Neighborhood. A system missing from the browse list should not be a cause for immediate concern, unless the system is consistently missing.
Although the primary focus of this paper is to give network administrators an understanding of browser architecture, it also deals with troubleshooting situations where the browse list is inaccurate or unavailable.

MS Browsing Overview

Microsoft Network Browser System

The browser is a network resource enumeration tool first created for LAN Manager 1.0. Windows for Workgroups enhanced the browser to make it truly client/server, and finally it was enhanced for domain browsing on a Windows NT® operating system–based network. The Microsoft networking browser maintains a list called the browse list. The browse list is an enumeration of all the available servers, workgroups, and domains (for Windows NT and LAN Manager networks). For example, when a user attempts to connect to any network resource, using Network Neighborhood, the list of servers that appears is the browse list. The browse list is provided by a browser in the local computer's workgroup or domain.
The Microsoft networking browser system consists of a domain master browser, master browsers, backup browsers, and client computers. The domain master browser maintains the complete domain browse list. The master browsers periodically query the domain master browser to obtain a complete list of domain resources. The master browser maintains the browse list and periodically sends copies to the backup browsers. When a browser client needs information, it obtains the current browse list by sending a NetServerEnum2 call to either the master browser or a backup browser.
NetServerEnum2 returns information about the server type (SV_TYPE_SERVER) entries in a domain or workgroup. It allows client computers to view a specific set of servers in the workgroup or domain. NetServerEnum2 provides a server type mask that allows users to query for various types of servers, such as workstations, servers, time servers, domain controllers, and so on. Printer browsing and Windows Terminal Server clients rely on this type of browsing to enumerate their respective resources
This centralized browser architecture for Windows networking resources reduces the number of broadcast datagrams on the network. A datagram is a network packet that is sent to a mailslot on a specified computer (a directed datagram) or to a mailslot on any number of computers (a broadcast datagram). The centralized browser architecture also reduces the demands on the client computer's CPU and memory.
Note: For Microsoft networking using the Microsoft TCP/IP protocol, broadcast name resolution is a direct implementation of Request for Comments (RFCs) 1001 and 1002 (NetBIOS Service Protocols). This implementation of NetBIOS over TCP/IP is wholly compliant with the RFCs, and does not involve any method of what has been referred to as NetBEUI encapsulation. For more information about NetBIOS over TCP/IP (NetBT), see the discussion of name resolution for Windows-based networking in Windows NT Server NetworkingGuide.

How Servers Manage Browsing for Microsoft Networking

In a Windows NT domain, every Windows NT Server–based computer is a browser. The primary domain controller (PDC), if there is one, is the domain master browser, and the other computers running Windows NT Server, Windows NT Workstation, or the Windows® 95 operating system are backup browsers. If there is more than one Windows NT Server–based computer in the domain, no computer running Windows NT Workstation or Windows 95 should ever be a master browser in the domain. In a workgroup containing computers running Windows 95 and Windows NT Workstation, there is always one master browser. If there are at least two Windows 95- or Windows NT Workstation–based computers in the workgroup, there is also one backup browser. For every 32 computers running Windows 95 and Windows NT Workstation in the workgroup, there is another backup browser. The following section describes how computers become browsers and summarizes the roles played by master and backup browsers.
[...]
When a browser receives an election datagram, the receiving browser compares the election version in the datagram with its own. If the receiving browser has a higher election version than any other browser, it is elected, regardless of any other election criteria. For example, a computer running any version of Windows NT is always elected over a computer running Windows 95. If the election versions are identical, the receiving browser compares the election criteria as follows:

• If the receiving browser has a higher election criterion than the sending browser, the receiving browser issues its own election datagram and enters the election in progress state.
  
• If the receiving browser does not have a higher election criterion than the sending browser, the receiving browser attempts to determine which computer is the new master browser.
  
• If there is still a tie, the browser that has been running longest is elected. If there is still a tie, the browser that has a lexically lower name is elected. For example, when all other criteria are equal, a server named A1 is elected over a server named B1.
  

When a browser receives an election datagram indicating that it is elected, the browser enters the running election state. In the running election state, the browser sends an election request after a delay based on the browser's current browser role:

• 200 ms delay for master browsers
  
• 400 ms delay for backup browsers
  
• 800 ms delay for all other browsers
  

The browser broadcasts up to four election datagrams. If, after four election datagrams, no other browser with an election criterion that would win the election has responded, the browser becomes the master browser. If the browser receives an election datagram indicating that another system would be elected, the browser demotes itself to backup browser. To avoid unnecessary network traffic, a browser that has lost an election does not broadcast any unsent election datagrams.
Role of Master Browsers
The master browser maintains the browse list, which is the list of all servers in the master browser's domain or workgroup, plus the list of all domains on the network. For a domain that spans more than one subnetwork or broadcast collision zone (Like a V-LAN), the master browser maintains the browse list for the portion of the domain on its subnetwork or broadcast collision zone. The rest of the domain is known based on domain announcements made by the domain master browser. Individual servers running Windows NT Server, Windows NT Workstation, Windows 95, Windows for Workgroups, or LAN Manager announce their presence by sending a directed datagram called a server announcement (HostAnnouncement) datagram to the domain or workgroup's master browser.
This announcement includes the server's NetBIOS name of {01}{02}MSBROWSE{02}{01}, {DOMAIN}{1d}, or {DOMAIN}{1e}, as appropriate for the type of server. When the master browser receives a server announcement from a computer, it adds that computer to the browse list. The master browser then returns lists of backup browsers to computers running Windows NT Server, Windows NT Workstation, Windows 95, and Windows for Workgroups. When a computer starts that is configured to automatically become a browser if required, the current master browser must tell that computer whether to become a backup browser. If its browse list is empty when a computer first becomes a master browser, it can force all servers to register with it by broadcasting an announce request (AnnouncementRequest) datagram. All computers receiving this datagram must respond by sending a server announcement at a random time within the next 30 seconds. The randomized delay ensures that the network and the master browser itself are not overwhelmed with responses. When a master browser receives a server announcement from another computer that claims to be the master browser, the receiving master browser demotes itself and forces an election as described in the previous section. This ensures that there is always only one master browser in each domain or workgroup.
[...]
http://technet.microsoft.com/en-us/library/cc739367%28WS.10%29.aspx
Browstat uses the following general syntax:
browstat Operation [Options]
To view the command syntax, click an operation.
Browstat dumpnet
Browstat elect
Browstat getblist
Browstat getmaster
Browstat getpdc
Browstat listwfw
Browstat stats
Browstat status
Browstat tickle
Browstat view

Browstat dumpnet

Displays the list of transports bound to browser.

Syntax

browstat dumpnet

Sample Usage

browstat dumpnet

Browstat elect

Forces election on a specified domain.

Syntax

browstat elect Transport Domain [/help]

Parameters

Transport

Enter a network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Enter the domain in which the election will be forced.

Browstat getblist

Gets backup list for domain.

Syntax

browstat getblist Transport [[Domain] refresh] [/help]

Parameters

Transport

Enter a network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Enter the name of the domain for which the backup list will be displayed.

refresh

Generates an updated browser for a segment.

Browstat getmaster

Displays the Master Browser name (using NetBIOS) for a specified domain.

Syntax

browstat getmaster Transport Domain

Parameters

Transport

Enter a network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Enter the name of the domain for which the Master Browser name will be displayed.

Browstat getpdc

Displays the PDC name (using NetBIOS)for a specified domain.

Syntax

browstat getpdc Transport Domain

Parameters

Transport

Enter a network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Enter the domain for which the PDC name is retrieved.

Browstat listwfw

Lists Windows for Workgroups computers that are acting as a browser.

Syntax

browstat listwfw Domain

Parameters

Domain

Enter the domain to which the Windows for Workgroups browser belong.

Browstat stats

Displays browser statistics.

Syntax

browstat stats [\\Computer [reset]]

Parameters

\\ Computer

Enter the name of the browser from which statistics are retrieved.

reset

Resets the statistics to zero.

Examples

See Browstat Examples.

Browstat status

Displays status about a domain.

Syntax

browstat status [-v] [Domain]

Parameters

-v

Displays a detailed output.

Domain

Enter the domain to query.

Examples

See Browstat Examples.

Browstat tickle

Forces the master browser to stop.

Syntax

browstat tickle Transport {Domain|\\Server} [EmulatedDomain]

Parameters

Transport

Enter a network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Enter the name of the domain to query.

\\ Server

Enter the name of the server that receives the query.

EmulatedDomain

Enter an alternate domain the specified server should use when announcing its presence.

Browstat view

Lists the browsers and their browser roles for a server or domain.
Syntax

browstat view Transport [Domain|\\Server [Flags|/domain [DomainToQuery]]]

Parameters

Transport

Enter the network device name (case-insensitive) for a transport in one of the following formats:

• \device\Transport_{MAC address} (for example, \device\Nbf_{elnk1601})
• \Transport_{MAC address}
• Transport

Domain

Specifies the domain to query.

\\ Server

Specifies the server that will receive the query.

Flags

Filters the list to show certain browser or server roles.

Flag	Description
AFP	AFP server
BBR	Backup browser
BDC	Backup domain controller
DFS	Distributed file system
DL	Dial-in server
DMB	Domain master browser
MBR	Master browser
MDC	Member domain controller
MFPN	Microsoft File and Print for NetWare
NT	Windows NT
NV	Novell
OSF	OSF server
PBR	Potential browser
PDC	Primary domain controller
PQ	Print server
S	Server
SQL	SQL server
SS	Windows NT member server
TS	Time source
VMS	Vax VMS Server
W	Workstation
W95	Windows 95
WFW	Windows for Workgroups
XN	Xenix

/domain [DomainToQuery]

Passes the 0x80000000 flag to the query.

DomainToQuery

Enter name of the domain to query.

See Also
Concepts 
Browstat Overview
Browstat Remarks
Browstat Examples
Alphabetical List of Tools
Spcheck Overview
Nltest Overview
Netdom Overview
Netdiag Overview
Netcap Overview
Httpcfg Overview
Dnslint Overview
Dnscmd Overview
Dhcploc Overview
Dcdiag Overview