Can't access network shares

[Char Jackson]

The Grolsch we get here is on our 'do not buy' list :-(

Since you guys won't stop talking about beer, I'll add a story of my
own. I had a taste for Heineken 'Red Star' during my 7-year stint in
Germany, and toured the brewery in Amsterdam at least half a dozen
times. (Unlimited free samples at the end of the tour at that time.)
Upon my return to the States, imagine my surprise when I tasted the
Heineken over here and it was completely different. That was my harsh
introduction to domestic versus export. The same happened with Beck's
and Bitburger, two German beers. Good over there within the shadow of
their respective breweries, not nearly as good here.

 

[Fokke Nauta]

You also asked about LLMNR. Here's a Wikipedia page on it.
<http://en.wikipedia.org/wiki/LLMNR>
That also explains why 224.0.0.252 showed up in your capture.

Thanks. That explains the lot.

I disabled IPv6 on the laptop, tried to login into the shares on the server,
and made a capture on the server.
Now it works fine and I see:
10.0.0.160 (laptop) -> 10.0.0.140 (server) SMB 134 Trans2 Request,
QUERY_PATH_INFO, Query File Basic Info, Path:
10.0.0.160 -> 10.0.0.140 SMB 134 Trans2 Request, QUERY_PATH_INFO, Query File
Standard Info, Path:
10.0.0.140 -> 10.0.0.160 SMB 158 Trans2 Response, QUERY_PATH_INFO
Etc, a communication over SMB between the laptop and the server.

Are you accessing the various PC's by hostname or by IP address? I
always use IP address because it seems to be more reliable and doesn't
require any kind of name resolution.

No, to address other workstations I use IP addresses. For the same reasons.
However, to map network drives, I use for instance \\server\shares

Should I change the latter to IP addresses as well?
For instance \\10.0.0.140\shares

Fokke

 

[Fokke Nauta]

Since you guys won't stop talking about beer, I'll add a story of my
own. I had a taste for Heineken 'Red Star' during my 7-year stint in
Germany, and toured the brewery in Amsterdam at least half a dozen
times. (Unlimited free samples at the end of the tour at that time.)
Upon my return to the States, imagine my surprise when I tasted the
Heineken over here and it was completely different. That was my harsh
introduction to domestic versus export. The same happened with Beck's
and Bitburger, two German beers. Good over there within the shadow of
their respective breweries, not nearly as good here.

Fully agree about the Grolsch. Just pour it in the loo.
It's not what it used to be, and the export Grolsch is a shame.

I was in the Heineken brewery as well, in ± 1980. Interesting, but I don't
like lagers.
The famous Dutch lagers, Heineken, Amstel and Grolsch are lager beers.
The German beers are lagers as well, but they are much more tastful. Perhaps
the Reinheitsgebot?
But I recognice that. Whan I was in the US, I drank a Becks (horrible) and a
Bavaria (horrible).
You are right. It proves that the export beers are less in quality that the
beers you get in the original country. But why?

There's another factor which may be interesting.
When I was young, I went on holidays many times in the former republic of
Jugoslavia, as it was called then. There was wonderful beer out there and we
loved it.
I took a box back home and there it wasn't as we expected. Way below. I can
very well remember that.

Was it the atmosphere? The surroundings?

And, not being English, what's a stint BTW?

Fokke

 

[Gene E. Bloch]

And, not being English, what's a stint BTW?

A stint is a period of time, usually in the sense of a period of time
doing something or being somewhere, such as 'a stint in the Army'.

Other meanings are possible, but in the context, it means Char Jackson's
stay in Germany.

 

[Fokke Nauta]

Thanks. That explains the lot.

I disabled IPv6 on the laptop, tried to login into the shares on the
server, and made a capture on the server.
Now it works fine and I see:
10.0.0.160 (laptop) -> 10.0.0.140 (server) SMB 134 Trans2 Request,
QUERY_PATH_INFO, Query File Basic Info, Path:
10.0.0.160 -> 10.0.0.140 SMB 134 Trans2 Request, QUERY_PATH_INFO, Query
File Standard Info, Path:
10.0.0.140 -> 10.0.0.160 SMB 158 Trans2 Response, QUERY_PATH_INFO
Etc, a communication over SMB between the laptop and the server.



No, to address other workstations I use IP addresses. For the same
reasons.
However, to map network drives, I use for instance \\server\shares

Should I change the latter to IP addresses as well?
For instance \\10.0.0.140\shares

Well, my joy didn't last long. The problem has come back.
I made a capture on the server during trying to open the server's share from
the laptop:
10.0.0.160 (laptop) -> 255.255.255.255 DHCP 342 DHCP Inform - Transaction
ID 0xec302db4
10.0.0.160 -> 224.0.0.252 LLMNR 64 Standard query A wpad
10.0.0.160 -> 10.255.255.255 NBNS 92 Name query NB WPAD<00>

I have seen no response back to the laptop.

I also tried to make a new drivemapping on the laptop, instead of
\\server\xxx I made \\10.0.0.140\xxx, where 10.0.0.140 is the server.
I didn't succeed. The following capture shows why:
10.0.0.160 (laptop) -> 10.0.0.140 (server) TCP 62 49277 > microsoft-ds [SYN]
Seq=0 Win=8192 Len=0 MSS=1460 SACK_PERM=1
10.0.0.140 -> 10.0.0.160 TCP 62 microsoft-ds > 49277 [SYN, ACK] Seq=0 Ack=1
Win=65535 Len=0 MSS=1460 SACK_PERM=1
10.0.0.160 -> 10.0.0.140 TCP 60 49277 > microsoft-ds [ACK] Seq=1 Ack=1
Win=17520 Len=0
10.0.0.160 -> 10.0.0.140 SMB 213 Negotiate Protocol Request
10.0.0.140 -> 10.0.0.160 SMB 143 Negotiate Protocol Response
10.0.0.160 -> 10.0.0.140 SMB 162 Session Setup AndX Request,
NTLMSSP_NEGOTIATE
10.0.0.140 -> 10.0.0.160 SMB 311 Session Setup AndX Response,
NTLMSSP_CHALLENGE, Error: STATUS_MORE_PROCESSING_REQUIRED
10.0.0.160 -> 10.0.0.140 SMB 506 Session Setup AndX Request, NTLMSSP_AUTH,
User: Solfon\xxx (Solfon is the name of the laptop, xxx means the username)
10.0.0.140 -> 10.0.0.160 SMB 93 Session Setup AndX Response, Error:
STATUS_LOGON_FAILURE
10.0.0.160 -> 10.0.0.140 TCP 60 49277 > microsoft-ds [ACK] Seq=720 Ack=386
Win=17135 Len=0

Anything useful here?

Fokke

 

[Char Jackson]

No, to address other workstations I use IP addresses. For the same reasons.
However, to map network drives, I use for instance \\server\shares

Should I change the latter to IP addresses as well?
For instance \\10.0.0.140\shares

Google has a bunch of things to try, (I did a quick search on 'windows
shares sometimes'), but to be honest, I don't remember ever having a
problem myself and I've been setting up systems for myself and others
(I run a small shop) since at least the Win98 days, so I can't really
tell you much. For me, it always just works. When I map a network
drive I use the Windows Explorer wizard, but if I just want quick
access I use \\IP in the Start Run box. That brings up a list of
shared folders and printers on the target system, and I go from there.
Using the IP address allows me to ignore Workgroup names and
Hostnames. When you're denied access, try the Start Run \\IP method
and see what happens. If even that fails, can you still ping the
target? Maybe you're losing more than just shares connectivity.

 

[Fokke Nauta]

Google has a bunch of things to try, (I did a quick search on 'windows
shares sometimes'),

There's a lot out there but I haven't tried this one before. Just tried. A
lot of info but it's all different from my problem.

but to be honest, I don't remember ever having a
problem myself and I've been setting up systems for myself and others
(I run a small shop) since at least the Win98 days, so I can't really
tell you much. For me, it always just works.

For me the same. I have been working in the IT and have troubleshooted some
network issues but all could be solved.
Never had a problem with my network at home until W7 came in.

When I map a network
drive I use the Windows Explorer wizard,

It takes so long that way. Most of the time I used \\otherpc\share. That
works the fastest.

but if I just want quick
access I use \\IP in the Start Run box. That brings up a list of
shared folders and printers on the target system, and I go from there.

Hey, that's great. Never knew that!

Using the IP address allows me to ignore Workgroup names and
Hostnames. When you're denied access, try the Start Run \\IP method
and see what happens.

A small window pops up, asking for a password for 10.0.0.140

If even that fails, can you still ping the
target?

Yep, no problem

Maybe you're losing more than just shares connectivity.

Yes, I'm losing my patience with W7 as well.
Have some more issues with this OS.

But it's between W7 and the server only. W7 can access the shares on the
other machines. But all other machines AND the server run on the same
version of XP Pro, SP3, fully updated, and all have the same user account
( loginname / passord). Apart from the hardware and installed software they
are identical. BTW, the other machines have no problems with the server.
Weird problem, isn't it?

And in the beginning it worked well. It was changed after a lot of updates
(coincedence, I think) and since we used the laptop elsewere (coincedence ?)
....

Fokke

 

[Char Jackson]

There's a lot out there but I haven't tried this one before. Just tried. A
lot of info but it's all different from my problem.


For me the same. I have been working in the IT and have troubleshooted some
network issues but all could be solved.
Never had a problem with my network at home until W7 came in.


It takes so long that way. Most of the time I used \\otherpc\share. That
works the fastest.

I never use machine names because I don't want to get caught up in
'name resolution' hell or worry about workgroup names. On my own LAN,
I use static IP's that I've long ago memorized. One of these days I
may actually have the DHCP server assign them based on MAC, but static
is simpler for now.

Hey, that's great. Never knew that!


A small window pops up, asking for a password for 10.0.0.140

The LOGON_FAILURE message you saw in your capture, coupled with the
password prompt above, seem to indicate an account/password issue, but
I think you said it _sometimes_ works. Besides, you've already
verified that the accounts and passwords all match.

Have you tried turning on Simple File Sharing on the server, just as a
temporary test? That would eliminate the user authentication steps and
might highlight another issue, the underlying issue, that's currently
being masked by the LOGON failures.

Yep, no problem


Yes, I'm losing my patience with W7 as well.
Have some more issues with this OS.

But it's between W7 and the server only. W7 can access the shares on the
other machines. But all other machines AND the server run on the same
version of XP Pro, SP3, fully updated, and all have the same user account
( loginname / passord). Apart from the hardware and installed software they
are identical. BTW, the other machines have no problems with the server.
Weird problem, isn't it?

Annoying, frustrating, but not weird. Not that it matters.

And in the beginning it worked well. It was changed after a lot of updates
(coincedence, I think) and since we used the laptop elsewere (coincedence ?)
...

Here's a website that warns about what can happen when a laptop
travels away from 'home'. It can elect itself the Master Browser, even
though another PC on the network is already Master Browser, which can
make shares seem to disappear. The advice, way at the end of the
article, is to disable the browser service on the traveling laptop.

<http://networking.nitecruzr.net/2005/04/nt-browser-or-why-cant-i-always-see.html#Summary>
"5. If you have a small LAN with no computers running a server OS, and
any of the servers are wirelessly connected, disable the browser
service on all wirelessly connected servers. Or be prepared to
diagnose browser conflicts."

I'm not sure if that's your problem, (you can probably check by
running the browstat utility), but some of the symptoms seem to apply.
I'm under the impression that accessing a LAN PC by its IP address
completely bypasses the whole browser mess, which is why I suggested
using IP addresses rather than machine names.

 

[Fokke Nauta]

I never use machine names because I don't want to get caught up in
'name resolution' hell or worry about workgroup names. On my own LAN,
I use static IP's that I've long ago memorized. One of these days I
may actually have the DHCP server assign them based on MAC, but static
is simpler for now.

In small home networks I always use static IP addresses.
Binding a MAC to a reserved IP address is too much of a hassle. But it has
advantages.

The LOGON_FAILURE message you saw in your capture, coupled with the
password prompt above, seem to indicate an account/password issue, but
I think you said it _sometimes_ works. Besides, you've already
verified that the accounts and passwords all match.

Have you tried turning on Simple File Sharing on the server, just as a
temporary test? That would eliminate the user authentication steps and
might highlight another issue, the underlying issue, that's currently
being masked by the LOGON failures.

Not yet. See my answer later on.

Annoying, frustrating, but not weird. Not that it matters.


Here's a website that warns about what can happen when a laptop
travels away from 'home'. It can elect itself the Master Browser, even
though another PC on the network is already Master Browser, which can
make shares seem to disappear. The advice, way at the end of the
article, is to disable the browser service on the traveling laptop.
<http://networking.nitecruzr.net/2005/04/nt-browser-or-why-cant-i-always-see.html#Summary>
"5. If you have a small LAN with no computers running a server OS, and
any of the servers are wirelessly connected, disable the browser
service on all wirelessly connected servers. Or be prepared to
diagnose browser conflicts."

I think you got a point here.
Interesting article. I have seen browser election issues passing by in my
captures.
This is what I did:
Replaced all the names in \\othermachine\whatever in \\IPaddress\whatever. I
have done this in all drivemappings on all PC's, the laptop as well.
I disabled the computer browser service on all the PC's (laptop as well)
except the one we use as server. Restarted the whole lot, the server first.

At first I noticed that everything worked fine, inclusive the laptop with
the server. It asked for a password only once, when I made the drivemapping,
but never again. It seems to work.
Disadvantage was thet I was not able to see the other machines in the LAN
from my own PC, the one I work on. After turning on the browser service I
could see all machines, but I found out that my PC turned out to be the
master browser instead the server. Well never mind, with 4 PC's you may have
a master browser and a backup browser.

I'm not sure if that's your problem, (you can probably check by
running the browstat utility), but some of the symptoms seem to apply.
I'm under the impression that accessing a LAN PC by its IP address
completely bypasses the whole browser mess, which is why I suggested
using IP addresses rather than machine names.

I will never use names again, will always use IP addresses in the future. I
learned a lot here!

I already restarted my laptop four times, and all 4 times it worked fine.
Likely it was the browser service on the laptop?

There were some other strange things in our LAN as well, like machines
dissapearing from the network every now and then.. Now there are only 2
browsers, the server and my PC, this issue might be solved as well?

Fokke

 

[Char Jackson]

In small home networks I always use static IP addresses.
Binding a MAC to a reserved IP address is too much of a hassle. But it has
advantages.


Not yet. See my answer later on.


I think you got a point here.
Interesting article. I have seen browser election issues passing by in my
captures.
This is what I did:
Replaced all the names in \\othermachine\whatever in \\IPaddress\whatever. I
have done this in all drivemappings on all PC's, the laptop as well.
I disabled the computer browser service on all the PC's (laptop as well)
except the one we use as server. Restarted the whole lot, the server first.

At first I noticed that everything worked fine, inclusive the laptop with
the server. It asked for a password only once, when I made the drivemapping,
but never again. It seems to work.
Disadvantage was thet I was not able to see the other machines in the LAN
from my own PC, the one I work on. After turning on the browser service I
could see all machines, but I found out that my PC turned out to be the
master browser instead the server. Well never mind, with 4 PC's you may have
a master browser and a backup browser.


I will never use names again, will always use IP addresses in the future. I
learned a lot here!

I already restarted my laptop four times, and all 4 times it worked fine.
Likely it was the browser service on the laptop?

There were some other strange things in our LAN as well, like machines
dissapearing from the network every now and then.. Now there are only 2
browsers, the server and my PC, this issue might be solved as well?

You've had some other temporary successes so I'm going to proceed
cautiously before doing any celebrating.

 

[Fokke Nauta]

You've had some other temporary successes so I'm going to proceed
cautiously before doing any celebrating.

I keep my fingers crossed as well. Today it worked. But that has happened
before, and the other day it didn't. So I'll keep checking the next days.
I discovered some other issues as well.
I wrote I changed on all systems the share name from \\name\share to
\\IPaddress\share. It works on all systems as before, but it worked well on
the laptop. In one condition it didn't. On the laptopt the server shares
were accessible with \\IP\share, but the shares on my own PC were absolutely
inaccessable with \\IPaddress\share. Only until I changed it back to
\\myPCname\share, it worked again.

The other issue has a more serious impact.
On all systems including the laptop, there are more user accounts in fact,
but they are all defined as <first name> <space> <surname> , both beginning
with a capital, and supplied with a password. They all have admin rights.
When I look in the XP Pro machines in the user rights of the shares (hope I
translated that well), the account names are indeed listed as "Firstname
Surname", among Administrator and other things. This is no surprise,
ofcourse.
Now back to the laptop. I was really surprised to see the account names
listed as "firstname", only the first name, no beginning capital. Just like
Ubuntu does, it never takes a name with a space, only the first name without
the starting capital. However, the accounts were created as <first name>
<space> <surname> , both beginning with a capital, just like on the XP
machines. And they show up on the login screen as <first name> <space>
<surname> as well.
So this was the reason I was not able to acces a share on the laptop, from
other machines. Once I logged in from the other machines on the laptop with
the login name "firstname" instead of "Firstname Surname", as I used to do,
it works. Another problem solved.

I'll take a cool beer tonight. Only one. I think we deserved that.
I'll keep you posted about the next days.

Until so far, many thanks for your help.

Fokke

 

[Char Jackson]

I keep my fingers crossed as well. Today it worked. But that has happened
before, and the other day it didn't. So I'll keep checking the next days.
I discovered some other issues as well.
I wrote I changed on all systems the share name from \\name\share to
\\IPaddress\share. It works on all systems as before, but it worked well on
the laptop. In one condition it didn't. On the laptopt the server shares
were accessible with \\IP\share, but the shares on my own PC were absolutely
inaccessable with \\IPaddress\share. Only until I changed it back to
\\myPCname\share, it worked again.

The obvious question is whether you were using the right IP address.
Is there a chance of a typo? Did ping continue to work? Did \\IP give
you a list of shares?

The other issue has a more serious impact.
On all systems including the laptop, there are more user accounts in fact,
but they are all defined as <first name> <space> <surname> , both beginning
with a capital, and supplied with a password. They all have admin rights.
When I look in the XP Pro machines in the user rights of the shares (hope I
translated that well), the account names are indeed listed as "Firstname
Surname", among Administrator and other things. This is no surprise,
ofcourse.
Now back to the laptop. I was really surprised to see the account names
listed as "firstname", only the first name, no beginning capital. Just like
Ubuntu does, it never takes a name with a space, only the first name without
the starting capital. However, the accounts were created as <first name>
<space> <surname> , both beginning with a capital, just like on the XP
machines. And they show up on the login screen as <first name> <space>
<surname> as well.
So this was the reason I was not able to acces a share on the laptop, from
other machines.

That's why I initially use \\IP to get a list of valid share names
rather than specifying both the hostname and the share name.

Once I logged in from the other machines on the laptop with
the login name "firstname" instead of "Firstname Surname", as I used to do,
it works. Another problem solved.

I'll take a cool beer tonight. Only one. I think we deserved that.
I'll keep you posted about the next days.

Until so far, many thanks for your help.

Your welcome. I apologize for being combative at times.

 

[Fokke Nauta]

The obvious question is whether you were using the right IP address.
Yes

Is there a chance of a typo?
No

Did ping continue to work?

Yes, of course. The share with the name \\myPC\share kept working.

Did \\IP give
you a list of shares?

W7 does not have a Start - Run as facility, but I entered it in the search
facility. And the shares all come up but are not accessible.It says No
access to \\10.0.0.141\share
This is also what happens when I try to map a network drive with
\\10.0.0.141\share. The mapping is there but it says Access denied.
Whereas \\myPC\share works fine.

That's why I initially use \\IP to get a list of valid share names
rather than specifying both the hostname and the share name.

But this was no matter of host or share names but the actual bname of the
user account. Though I created a user account on the laptop defined as
<First name> <space> <Surname>, the actual account name is listed as

Your welcome. I apologize for being combative at times.

No need for apologies!
Being combative is OK when one is sure one is right. And you were.

Today the connection from the laptop to the server was OK again. I can see
that because the icons of the drive mappings show the acual percentage used
of the shared partition. Opening the share is piece of cake.

You deserve a beer of my server as well
www.pc3.nl/beer

Fokke