0000: 00000000 004a0003 00000000 c0001f43
0010: 00000000 00000000 0000055a 00000000
0020: 00000000 00000000
If a Windows domain spans more than one subnet and the TCP/IP protocol (NetBT) is used, each subnet will have a Master Browser. If a Master Browser receives server announcements from another computer, claiming to be a Master Browser, an election is forced to ensure that there is only one Master Browser per subnet. These browser elections cause the 8003 message to be recorded.
If the routers on the network are configured to forward UDP broadcasts to UDP ports 137 and 138, then the election broadcasts that are intended to remain in the subnet are forwarded to other subnets.
This has also been seen with bridges or switches between two dissimilar network segments within the same subnet.
Note Switches that are configured for VLAN's (virtual segmentation) have to be configured on a per VLAN basis to prevent UDP broadcast propagation.
Article ID: 135464 - Last Review: Jan 17, 2008 - Revision: 1