WINS parsing using NetMON and WINS.DLL not working--suggestions?

Discussion in 'Windows Server' started by James Ervin, Jan 3, 2005.

  1. James Ervin

    James Ervin Guest

    I apologize if this is posted to the wrong group. We're having a WINS
    replication problem. As part of my diagnosis, I tried to install the WINS.DLL
    parser for Netmon from the Windows 2003 resource kit tools package as
    indicated here:

    However, the DLL appears to do nothing. I am able to load additional parsers
    without difficulty. Is there a newer version of this file that I should be
    using? I am running NetMon on a Windows 2003 platform; I have also tried
    NetMon 2.1 (full) from the SMS 2003 installation CD. I have not tried running
    NetMon on a Windows 2000 platform but can do so if necessary; however, it
    seems that this should work, since the WINS.DLL file is part of the 2003
    resource kit!

    This is the directory information for the file:

    04/18/2003 04:55 PM 30,152 wins.dll

    Thanks in advance for any suggestions-

    James Ervin
    Chapel Hill, NC
    James Ervin, Jan 3, 2005
    1. Advertisements

  2. James Ervin

    Todd J Heron Guest

    Can you tell us what the replication problem is exactly? Regarding the
    Netmon problem, why not take a look at Ethereal instead?
    Todd J Heron, Jan 4, 2005
    1. Advertisements

  3. James Ervin

    James Ervin Guest


    The replication problem is a typical 4102 error. After enabling WINS debug
    logging, I receive the following errors routinely when the server attempts to
    replicate with one particular server:

    4152 "informational" error:
    The timeout period has expired on a call to another WINS server. Assuming
    that the network and routers are working properly, either the remote WINS
    server is overloaded, or its TCP listener thread has terminated.

    followed by 4102:
    The connection was aborted by the remote WINS. Remote WINS may not be
    configured to replicate with the server.

    So far, I've only been able to determine that there are some significant
    delays when the server attempts to replicate with this particular partner--up
    to two seconds in some cases, although the server responds with
    sub-millisecond ping times. I was hoping that decoding the WINS protocol
    might give me some more clues. At this point it is also a political battle,
    since I'm convinced that the problem is on the OTHER end, but I'm having
    difficulty getting personnel in charge of the other server to reset
    replication on their end (our server IS currently configured as a partner on
    their side; I was able to ascertain that much), which usually fixes this sort
    of problem. So, collecting more information is useful for supporting our case.

    I actually wasn't aware that Ethereal has a WINS decoding capability. I've
    tried both Packetyzer and Ethereal, but they don't give much detail on the
    contents of the WINS transaction. I was hoping to get information of the sort
    listed in KB article 321208, under the "Example of a WINS Replication Frame"
    heading, which looks very comprehensive.

    If Ethereal has WINS decoding capability, can you elaborate? I haven't found
    a plugin that will do that yet. I may be using an old or incorrectly
    configured version, though, so I'll check on that.

    Thanks for the tip!

    James Ervin
    Chapel Hill, NC
    James Ervin, Jan 4, 2005
  4. James Ervin

    Todd J Heron Guest

    Are we talking just two replication partners here? Error 4102's happen when
    the Remote Access Service (RAS) WAN Wrapper is bound before the network
    interface card (NIC).
    Todd J Heron, Jan 4, 2005
  5. James Ervin

    James Ervin Guest

    This is the configuration (names changed, of course)

    server_1 (windows 2003) has two replication partners: server_2 (windows
    2003) and server_3 (windows 2003).

    Server_2 has only server_1 as a partner; server_3 is a hub with many other

    I checked the binding order on server_1 (which is exhibiting the problem)
    and found:

    Adapter Order:

    Local Area Connection
    Local Area Connection 2 (this adapter is currently disabled)
    Remote Access Connections

    Bindings for Local Area Connection:

    File and Printer Sharing for Microsoft Networks --> TCP/IP
    Client for Microsoft Networks --> TCP/IP

    There are no other bindings; that should be acceptable; right? I haven't
    verified binding order on server_3 yet (again, because it's not under my

    Thanks for all the help-

    James Ervin, Jan 4, 2005
  6. James Ervin

    Todd J Heron Guest

    Looks good, can you at least get the owner of Server_3 to report to you it's
    binding order and then we'll take it from there?
    Todd J Heron, Jan 4, 2005
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.