Browsing & Other Traffic Incur High Costs over ISDN Routers

This article was previously published under Q134985
This article has been archived. It is offered "as is" and will no longer be updated.
SYMPTOMS
Your ISDN TCP/IP router telecommunication connection costs appear to bevery high.

This problem occurs if all of the following are true:
  • Your network spans two or more sites.
  • You use ISDN TCP/IP routers.
  • You use an ISDN service that charges you based on connection time.
NOTE: This problem frequently occurs in Germany where ISDN TCP/IP routers are popular and the ISDN connections are charged by connection time.

The length of the time interval for a GBE shortens withgreater distances between the sites, and vice versa.

CAUSE
The following Windows NT features may cause a lot of traffic betweendomain servers on different sites, causing your ISDN telecommunicationcosts to be high:
  • Domain browsing
  • Windows Internet Name Service (WINS) replication
  • Directory replication
  • User accounts database (SAM) replication
  • Printer browsing
  • Other (DHCP, etc.)
You can use Network Monitor to check which of these features cause trafficon your network, including traffic from and to the ISDN router.

How Domain Browsing Causes a lot of Network Traffic

The Windows NT domain master browser (DMB) exchanges computer browse listswith the master browsers (MBRs), usually the backup domain controllers(BDCs), in the other remote networks several times per hour.

In your multi-site company, Microsoft recommends you have at least one BDCat each site. As a result, your company's domain may span multiple sites.This causes browsing network traffic across the your ISDN routers.

Twelve minutes after an MBR boots and every twelve minutes thereafter, theMBR connects to the DMB, that is also the Primary Domain Controller (PDC),by sending a request to the NetBIOS name <domain>0x1b that is owned by theDMB. The MBR then sends the local browse list to, and retrieves the globalbrowse list from, the DMB. This causes the first connection over ISDN andusually lasts several seconds, so this may take up more than one GBE onthe ISDN line.

Browsing communication uses RPC over a named pipe connection. After thenamed pipe connection is closed the logical network connection is stillentertained by the redirector for ten more minutes because that is whenthe MBR redirector's KeepConn parameter expires by default. Although, thislogical connection does not incur ISDN router costs, frames sent todisconnect the connection after the ten minute period cause another ISDN connection to be established, which incurs costs.

Two minutes later, 24 minutes after booting, the MBR connects again to theDMB for a browse list exchange. This occurs every twelve minutes.

RESOLUTION
To correct this problem, upgrade to Windows NT 3.51 (if you have notalready done so) and install the latest U.S. Service Pack for Windows NTversion 3.51.

To work around this problem, read the sub-section that applies to yourtraffic problem:
  • Working Around the Domain Browsing Problem
  • Solving the Domain Browsing Problem with a Fix
  • Configuring Other Features That Cause Traffic

Working Around the Domain Browsing Problem

To work around this problem, modify the following parameters in theWindows NT registry and/or configure your ISDN router to turn off duringidle hours:

WARNING: Using the Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correctthem. Microsoft cannot guarantee that any problems resulting from the useof the Registry Editor can be solved. Use this tool at your own risk.
  • To minimize ISDN connections with full availability of the domain browse list:

    1. Under the subtree HKEY_LOCAL_MACHINE, locate the following registry subkey:
      \SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Parameters
    2. Set the KeepConn parameter to a small value, for example, five seconds.

      This prevents network traffic between browse cycles to disconnect. The connection made during the browse list exchange. Set this Parameter on all domain controllers.
  • To further minimize ISDN connections during idle hours, for example, during the night and during the weekend, set a filter option on the ISDN TCP/IP router to turn off the ISDN line during the idle hours.

    NOTE: This results in loss of browse listings of computers on remote sites.

Solving the Domain Browsing Problem with a Fix

The browser service supports the parameters MasterPeriodicity and the BackupPeriodicity in the KEY_LOCAL_MACHINE subtree under the following subkey:
\SYSTEM\CurrentControlSet\Services\Browser\Parameters
Use the following information to configure these two new parameters.

MasterPeriodicity:

DWORD specifies in seconds how frequently an MBR contacts the DMB. Thedefault is 720 (twelve minutes), the minimum is 300 (five minutes). Themaximum is 4,294,967 (or 0x418937 hex), which is 49 days and 8 hours. Thisparameter can be changed dynamically (without rebooting) with the RegistryEditor or REGINI (from the Windows NT Resource Kit). You can scheduleREGINI with the scheduler service to reduce browser traffic during thenight or over the weekend.

The parameter should be set on each MBR. Because another computer can beelected to be the MBR you should apply the fix to each Windows NT computerin the domain, because they are most likely to win browser elections. Foradditional information, please see the following article in the MicrosoftKnowledge Base:

ARTICLE-ID:102878
TITLE :Information on Browser Operation


If you set the parameter on the DMB it affects the frequency it asks WINSfor the domain list (this might also cause WAN traffic).

NOTE: Maximum value for MasterPeriodicity is 2147483 (0x20C49B hex) not 4294967 (0x418937 hex) as specified.

BackupPeriodicity:

DWORD specifies in seconds how frequently a backup browser contacts theMBR. The default is 720 (twelve minutes), the minimum is 300 (fiveminutes). The maximum is 4,294,967 (or 0x418937 hex), which is 49 days and8 hours. This parameter is not read dynamically so you have to restartyour computer. This parameter does not affect the WAN, since this trafficis always on one subnet.

CAUTION: BackupPeriodicity is used to determine when an entry in thebrowse list has to be deleted. This is done after three periods ofBackupPeriodicity. Because of the way dynamic update of MasterPeriodicityis implemented, it is possible you can lose entries in your browse list onthe PDC when you change MasterPeriodicity from a high value to somethingelse.

To prevent this you should increase BackupPeriodicity to at least a thirdof the maximum value of MasterPeriodicity. You must implement this onevery computer which can become the PDC.

Configuring Other Features That Cause Traffic

To minimize non-domain browsing traffic, modify the following parametersin WINS Server Admin or the Windows NT registry:

WARNING: Using the Registry Editor incorrectly can cause serious, system-wide problems that may require you to reinstall Windows NT to correctthem. Microsoft cannot guarantee that any problems resulting from the useof the Registry Editor can be solved. Use this tool at your own risk.
  • For WINS replication, the interval is configurable in WINS Server Admin.
  • The following services are configurable in the Windows NT registry under the subtree HKEY_LOCAL_MACHINE:
    • For directory replication, the interval is configurable with the Interval parameter in the subkey:
      \CurrentControlSet\Services\Replicator
    • For SAM replication, the interval is configurable with the PulseMaximum parameter in the subkey:
      \CurrentControlSet\Services\Netlogon
    • For printer browsing, the interval is configurable with the DisableServerThread parameter in the subkey:
      \CurrentControlSet\Control\Print
STATUS
Microsoft has confirmed the domain browsing to be a problem in Windows NTversions 3.5 and 3.51. This problem has been corrected in the latest U.S.Service Pack for Windows NT version 3.51. For information on obtaining theService Pack, query on the following word in the Microsoft Knowledge Base(without the spaces):
S E R V P A C K
prodnt Novell sniffer trace expensive cost router
Properties

Article ID: 134985 - Last Review: 02/24/2014 08:21:06 - Revision: 2.1

  • Microsoft Windows NT Workstation 3.5
  • Microsoft Windows NT Workstation 3.51
  • Microsoft Windows NT Workstation 4.0 Developer Edition
  • Microsoft Windows NT Server 3.5
  • Microsoft Windows NT Server 3.51
  • Microsoft Windows NT Server 4.0 Standard Edition
  • kbnosurvey kbarchive kbnetwork KB134985
Feedback