3

On a SMB/CIFS network using NetBIOS over TCP, the group name \x01\x02__MSBROWSE__\x02\x01 is registered, which is the master browser for the subnet.

If I have different domains/workgroups on my subnet, should I expect to see one of these registrations per group, or is it simply per subnet only?

SilverlightFox
  • 138
  • 2
  • 17
  • AFAIK you can have any number of master-browsers, but only one is elected as the Domain Master Browser identified as `<01><00>__MSBROWSE__<00><01>`. – harrymc May 28 '15 at 07:21
  • @harrymc: The `MSBROWSE` is the master browser for the current _subnet_, not for the domain. Suffix `<1b>` is the domain master browser (PDC for Windows domains) and `<1d>` is the master browser for each domain on subnets other than the domain master browser. – SilverlightFox May 28 '15 at 10:04
  • I repeat that I think that in theory you *should* only see one Domain Master Browser per network. However, for me NetBIOS technology doesn't work, and even a simple office network may fragment itself into disconnected sub-networks. You might need to fall back to using IP addresses and the hosts file. The only solution for total visibility is to have all computers under one PDC in one domain. – harrymc May 29 '15 at 19:35

1 Answers1

1

For a domain or workgroup to be seen on a given subnet (really, broadcast domain of a LAN, not necessarily a single IPv4 subnet per se), it must have at least one member on that subnet, and that member (or "one of those members" if there are more than one) must act as a master browser for that domain or workgroup on that subnet.

So you should expect to see one master browser for each domain or workgroup that has members present on that subnet. So if you have a subnet with 4 machines and each is a member of a different domain or workgroup, then each will be the master browser for its own domain/workgroup on that subnet, so you will have 4 master browsers on that subnet.

I don't know the internals of the exact registrations well enough to tell you how that maps to registrations of the group name \x01\x02__MSBROWSE__\x02\x01.

Spiff
  • 101,729
  • 17
  • 175
  • 229
  • Your last paragraph is what my question is about. `msbrowse` merges browse lists from different domains. Also a broadcast domain of a lan _is_ a subnet isn't it? – SilverlightFox Jun 02 '15 at 18:33
  • @SilverlightFox Nothing limits you to a single IPv4 subnet per Ethernet LAN. It's often a good network design to only put a single IPv4 subnet per Ethernet LAN, but there are also other perfectly valid reasons for putting multiple IPv4 subnets on the same Ethernet LAN. So it's not uncommon to see a publicly routable subnet, an RFC1918 private subnet (e.g. 192.168.0.x, like behind a NAT gateway), and the IPv4 link-local subnet (169.254.0.0/16) all on the same Ethernet LAN. – Spiff Jun 02 '15 at 18:41
  • Got you - I didn't realise the distinction you were digging at. Thanks. – SilverlightFox Jun 02 '15 at 18:43