The Browser Service

Find available network resources

When you click the Network Neighborhood icon on your desktop or select it from Windows NT Explorer, you can step down to a list of domains. From this list, you can drill down further to a list of computers in a domain, then a list of shared resources on a particular computer. The browser service generates these lists. You might have noticed that the list of domains is sometimes incomplete first thing in the morning and that the browser service consumes a lot of network bandwidth.

In this article, I explain how the browser service works and why it consumes so much bandwidth. I also suggest ways to reduce the network traffic associated with this service. (For more information about the browser service, see George Spalding, "Too Many Servers Spoil Network Performance," August 1997, and Bob Chronister, Tricks & Traps, September 1996.)

The Browser Service
The browser service has nothing to do with the Internet. This service compiles and distributes lists of available resources on the network. As Screen 1, page 172, shows, when you connect to Network Neighborhood from your computer, the browser service shows you a list of the other computers on your network from which you can drill down to see available resources. The idea behind the browser service is that when a computer needs to see the available resources on the network, it doesn't have to query every other computer on the network. This method would create an overwhelming load on the network and computers. Instead, a few computers known as browsers are responsible for compiling a list of available resources, distributing this list to other browsers, and making the list available to all the other computers on the network. This activity occurs in the background, as a service running under NT. Windows 98, Win95, and Windows for Workgroups (WFW) computers also browse for resources, but not as a service. You can start and stop browsing, like any service, from the Services applet in Control Panel.

Browser Roles
Several types of browsers exist. A computer can participate in the browsing process as a master browser, backup browser, browser candidate, or nonbrowser.

A master browser is the computer that compiles the list of available resources and makes the list available to the backup browsers. Each subnet has a master browser, because browsing is based on broadcasts. Broadcasts don't go through routers, so each subnet requires a master browser. The Primary Domain Controller (PDC) acts as a domain's master browser, coordinating browse lists from the other master browsers.

A backup browser is one of several computers that keep copies of the resource list and supply the list to client computers. You might not need a backup browser in a small network, but most midsized to large networks have one or more backup browsers. The master browser, rather than the administrator, determines the number of backup browsers.

A browser candidate (or potential browser) is a computer that can act as a master or backup browser. By default, NT computers are browser candidates, so they can be backup browsers unless you configure them to not participate. A computer such as a database server isn't suitable to be a backup browser because it can't handle the additional load necessary to support the browsing process. Thus, you'll want to configure it as a nonbrowser.

A nonbrowser isn't part of the browsing process. You must specifically configure a computer to be a nonbrowser.

Browser Election
Most of the time, you have no control over whether a system is the master browser or a backup browser. Browser election determines the master browser, and browser election occurs in the following two situations.

If a client computer can't find a master browser, it calls an election and simultaneously broadcasts its qualifications to be a master browser. Other computers on the network see this election packet and compare it with their qualifications. The process then proceeds much like a poker game: If a machine has higher qualifications, it sends out an election packet. Finally, the machine with the highest qualifications wins. In this context, highest qualifications means that NT beats Win98, NT 4.0 beats NT 3.51, server beats workstation, and so on. Thus, the master browser is typically an NT 4.0 server. Just as in a real election or a real poker game, other factors can influence the outcome. NT has favorites: A domain controller typically wins any election in which it participates, and the PDC always wins in a network with subnets because only a PDC can be a domain master browser.

A browser election also occurs when a domain controller comes online. If you look at the NT System event log on the domain controller, you'll see that a forced browser election occurred when this computer started. Screen 2 shows the event log entry. If you have more than one protocol running, you'll see more than one entry.

Configuring Browsers
The Registry key that controls browser entries is HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesBrowser. To configure a computer as a browser, set the MaintainServerList entry in the Parameters subkey to Yes, as Screen 3 shows. To ensure that a computer such as a database server doesn't participate in the browsing process, set this entry to No. To let a computer act as a browser if necessary, set this entry to Auto.

Note that the IsDomainMaster entry in Screen 3 is set to FALSE. If you set it to TRUE, you're effectively rigging the browser election, because the computer would always be the domain master browser.

Win98 computers can act as browsers. To prevent your Win98 clients from being browsers, open the Network applet in Control Panel, select File and Print Sharing for Microsoft Networks, and click Properties. The Browse Master options are Enabled, Disabled, and Automatic, with a default of Automatic. Selecting Disabled prevents Win98 computers from calling or winning elections. Make sure the network has another computer to act as a browser, or you won't see any browse lists.

WFW tends to generate excessive browsing traffic. To stop WFW computers from trying to become browsers, go to the Network section of the system.ini file and set the MaintainServerList entry to No. You might have to add this entry if it doesn't exist.

The Microsoft Windows NT 4.0 Resource Kit contains a useful tool, the Browser Monitor, that shows you which computers on your network are acting as browsers and what their status is (e.g., how many servers and domains they're communicating with). This tool isn't a must-have, but it provides interesting information about the various browsers on a network. For more information about Browser Monitor, see Mark Minasi, This Old Resource Kit: "Browser Monitor and Domain Monitor," January 1999.

The Browsing Process: Reporting In
When an NT computer starts up, it announces its presence on the network. It also broadcasts a list of the resources it has available (i.e., shared drives, folders, and printers). The computer repeats this broadcast every minute for the first 5 minutes and every 12 minutes thereafter. Because every computer on the network performs this action, browsing announcements contribute significantly to total network traffic. A benefit is that these broadcast messages don't go through the routers and thus don't flood the network. A drawback is that the broadcasts go out on every protocol a computer is running. Thus, if you start with the NetBEUI protocol, switch to NWLink, and finally switch to TCP/IP, the browser broadcasts generate three times as much network traffic as necessary. You need to remove old protocols that you no longer use.

The master browser listens for these broadcasts. When it receives information about a computer joining the network, it adds that computer to its list of available resources. Every 15 minutes, the master browser sends its compiled list to each of the backup browsers. Because each computer reports in every 12 minutes, the master browser's 15-minute updates are current. Unfortunately, you can't configure the reporting intervals to reduce network traffic.

You might have noticed that sometimes you can't see all the computers in the network when you first log on in the morning. Remember that each computer broadcasts its presence when it starts up. The master browser receives this message immediately but notifies the backup browsers only every 15 minutes. In an office in which users turn their computers off at night, no one can see anyone else for the first 15 minutes or so in the morning. Although a computer might not be visible, you can still connect to it. You must enter the share's server name and folder name (i.e., \server namefolder name).

The opposite problem occurs in the evening. Suppose you're working late and you need to access a spreadsheet on a colleague's computer. You can see the shared directory in the browse list, but when you try to connect you receive the message Accounting1 is not accessible. The network path was not found. When a computer shuts down, it sends yet another browser broadcast. Again, the master browser receives this message immediately but doesn't notify the backup browser for as long as 15 minutes. Although you can see the resource you need, the resource is inaccessible because your coworker's computer is offline.

Another annoying situation occurs when a computer or network connection fails suddenly (or when a user powers off a computer rather than shutting it down). In this type of situation, the master browser doesn't receive the standard broadcasts every 12 minutes. After the master browser notices three missed broadcasts (i.e., as long as 36 minutes later), it finally removes the computer from the browse list. The backup browsers might then take another 15 minutes to update. Thus, the computer might show up in the browse list for as long as 51 minutes after it goes offline.

The Browsing Process: Requesting a Browse List
When a client computer needs a list of resources, it contacts a master browser. One way it can locate a master browser is by broadcasting. Alternatively, if the network has a Windows Internet Naming Service (WINS) server, the client can ask the WINS server for the master browser's address. (A computer can register its services in the WINS database; one of the entries in the WINS database is for a master browser.)

If the network has backup browsers, the master browser responds with a list of backup browsers rather than providing the resource list itself. The client picks one of the backup browsers and requests a browse list of the available resources. The backup browser then sends this list to the client. The user on the client computer can look through the list and select the appropriate computer and resource.

Browsing Subnets and Other Domains
Browsing is a broadcast-based process, so you might wonder how the browse list can contain computers that are on the other side of a router. The domain master browser makes this feat possible. Each subnet has a master browser that builds the browse list for that subnet. The local subnet master browser sends its list to the domain master browser, which is always the PDC. The PDC's address is in the WINS database or an LMHOSTS file, so the local master browser can send a directed datagram, rather than a broadcast, right to the PDC. The PDC must then compile all the lists from each subnet and send the compiled list back to each master browser. Eventually, each subnet receives information about all the other subnets. If the PDC is down, each subnet's master browser contains only information about that subnet. If the router between the local subnet and the PDC is down, browsing outside the local subnet is impossible.

The PDC in each domain exchanges information about itself with the PDCs in other domains. The other domains appear in the browse list that the master browser distributes to the backup browsers, which the backup browsers then distribute to the clients. When you click a domain name in Network Neighborhood, your computer sends a request to the PDC in that domain. The PDC then sends you a list of backup browsers in the domain, and you must send another request to actually get the list of computers with available resources in the domain.

Don't Get Too Attached
The browser service generates a lot of network traffic—and like many of us, it isn't at its best first thing in the morning or around quitting time. To reduce the amount of network traffic the browser service generates, reduce the number of protocols you have installed. Don't get too attached to the browser service, though, because Windows 2000 (Win2K—formerly NT 5.0) will include an improved directory services tool that will make the browser service obsolete.