Event ID 4321

[kodina]

Checked the Event Viewer a while back and a new culprit was waiting. Here are the details:

Event Type: Error

Event Source: NetBT

Event Category: None

Event ID: 4321

Date: 09-May-10

Time: 6:20:48 AM

User: N/A

Computer: mylaptop

Description:

The name "WORKGROUP :1d" could not be registered on the Interface with IP address 999.999.9.999. The machine

with the IP address 999.999.9.999 did not allow the name to be claimed by this machine. For more information, see

Help and Support Center at ...

Any clues?

[HawkMan]

Did you edit the IP? cause that ip is illegal and shouldn't be able to be set.

[+BudMan MVC]

Yeah no wonder you would get that error, as already stated that IP is not a valid one - it would be impossible to set in an sort of normal fashion.. The dialog will not allow you to enter that for example.

Or are you hiding what the IP was?? If so there is no point to hiding Private ips, 192.168.x.x, 10.x.x.x or 172.16-31.x.x -- since they are not routable on the public net - and there for tells us nothing of where you are or how to connect to your network..

My computer is 192.168.1.100, my kids are 192.168.1.101, my server is .4 my router is .253 -- hack away ;) etc.. etc.. etc..

here is help with that error

http://www.chicagotech.net/troubleshooting/eveny4321.htm

[kodina]

Thanks for the reply folks.

Yes I did not post my actual IP because i read a post or article way back that never disclose your ip or name of personal things. I guess I'm being too paranoid and ...Sorry but I don't know what's okay/safe to post on the internet and what's not.

Ok I did not hide/fake my IP and am not using any ip hiding/faking software. The following 2 things might have something to do with the reason for the error

1) I am using Sygate, and the 1st attached image shows the options I have used. I might me wrong but could any of the red circled one's be the reason for this and some other problems I have been facing. I have a 80% gut feeling that the problem probably could be due to one of the settings shown in the attached file

2) I have a second pc at home with is running Win7 Home Edition. I hardly use it and have recently put it in place for people visiting me and wanting to use my laptop. So my silly way of saying "sorry you can't use my laptop but here's something which has the internet and everything else". That PC has COMODO firewall BTW

3) Budman I read the link and based on the little i can understand i probably need to take care of the following

• need to clean the WINS records.
  Comment: How do I do this?[/b]
  
• "If this is multihomed computer, make both NICs are in the different subnet.".
  Comment: Could this have anything to do with the other PC I have??? On that PC too there is no IP hiding/faking software and just a simple installation with COMODO being the only difference
  
• What are the things (if any) that I need to check on the other PC?
  Comment: Maybe not and all my problems are originating from my own PC
  
• "If this is the RRAS server, make sure only the one IP registers the record in the WINS.".
  Comment: Oh boy. What is a RRAS server??? Can I ignore this point?
  
• "Make sure the computer is in the correct subnet."
  Comment: I have not made any changes to the IP related stuff and how the settings as per my ISP's recommendation. The links to the additional images (3rd onwards) shows the relevant settings (if it helps). Could the culprit for many of my problem be sitting somewhere here?
  
• The stuff about "Duplicate Name. Symptoms: You are running mixed OS in a domain network. Two computers, one is win98 and another is w2k/XP, receive the duplicate name ..." could also be the cuplrit??? This is now getting confusing :wacko:
  

Links to screen-shots

Sygate Setting 1: http://i42.tinypic.com/mtxidk.jpg

Sygate Setting 2: http://i42.tinypic.com/30vyzko.jpg

TCP/IP related screen shot #1: http://i40.tinypic.com/w97jgm.jpg

TCP/IP related screen shot #2: http://i43.tinypic.com/34qoh20.jpg

TCP/IP related screen shot #3: http://i40.tinypic.com/n20dx2.jpg

TCP/IP related screen shot #4: http://i43.tinypic.com/jqrpms.jpg

TCP/IP related screen shot #5: http://i40.tinypic.com/35c21kj.jpg

TCP/IP related screen shot #6: http://i43.tinypic.com/29ljk78.jpg

[+BudMan MVC]

First off -- whats the IP in the error, is it yours or your other machines?

And from your firewall settings --- yeah your going to have issues.. You prevented file sharing and network browsing, etc.. WHY??? Are there machines on your network that are hostile?? Don't you want to be able to share files between machines?? If you dont -- then don't freaking share anything.. Blocking stuff with 3rd party firewalls -- yup going to cause you problems and event errors ;)

[kodina]

Hi HawkMan and BudMan,

The following answers are based on some assumptions (as I have understood your replies):

1) Yes I changed the IP and the actual one is same as the IP which BudMan has posted in his report. I don't know what is safe/ok to post on help forums and what's not safe. I really just don't know the answer :wacko:

2) @BudMan: The IP in the error is of my laptop (not the other Win7 PC) which I have talked about in another post (BudMan you might recall my other post related to problems on my Win7) PC

3)

And from your firewall settings --- yeah your going to have issues.. You prevented file sharing and network browsing, etc.. WHY??? Are there machines on your network that are hostile?? Don't you want to be able to share files between machines?? If you dont -- then don't freaking share anything.. Blocking stuff with 3rd party firewalls -- yup going to cause you problems and event errors

To be honest I do not have a clue what the settings (the 2 snapshots of Sygate) do. I just read the descriptions and thought that it is safe to click/select those options. Should I disable (uncheck) some of the settings (boxes) on Sygate? If so which one?

There are no hostile machines on my mini home network (if I can use the word network here). It's just my laptop (running XP Pro SP3), a PC which I recently got and running Win7, a router (have switched from TPLink to DLink after upgrading DLink's firmware) and that's about it. Like i said earlier, I am not a networking/IT/security expert. Heck, until recently I didn't even have my router secured and a guy came and helped me to secure it. I think he used something called WPA or WEP or something like that. Just sharing this to give you a feel of my high calibre IT knowledge :blush:

As I write there is a new Event IS that has popoed up in my event viewer and I really feel as if I have had it. I know at the end of the day it's probably something that I'm doing wrong which is making these Event ID's to pop-up but till I solve them, life is nothing but a pain in he wrong place. For the past few days, I have just been trouble shooting and this is sooo frustrating :cry:

So again my request is that what setting in your opinion (looking at the 2 Sygate Screen shots that I attached earlier) should I change?

Thanks.

[+BudMan MVC]

"Should I disable (uncheck) some of the settings (boxes) on Sygate? If so which one? "

I have to wonder why your running some 3rd party firewall in the first place.. As to those specific settings -- do you want to share files between your machines?? If not -- like I said don't turn on sharing there is no point is blocking stuff on a firewall behind a nat router you have no idea what any of it does -- so why are you blocking it???

If your saying that the error is on the laptop, and the ip listed in the error is the laptops -- then I will pretty much bet that 4321 error is due to your 3rd party firewall..

lets put to bed some of your tinfoil hat concerns..

Posting an IP that starts with 192.168.x.x, or 10.x.x.x or 172.16-31.x.x is NOT a security risk -- its completely useless to anyone anywhere in tracking you down, accessing your router or network or anything about you at all.. These are private reserved addresses that are not routable on the public internet -- and everyone behind a nat is using the same numbering systems.. Same goes with 169.254.x.x -- this an APIPA that windows machines will sometimes randomly give themselves when set to auto get an IP and they dont -- you can post these with no issues.

Same goes for MAC addresses of your devices -- again utterly useless to anyone not directly connected to your network, the only thing they can do with a mac is look up who made your devices..

But understanding what machine your talking about can be very helpful in helping you..

Question for you -- do you think this error is why your having a problem??? What are you trying to do that you feel this event message should concern you?? Are you trying to share files and can not access the other machine? Are you trying to browse your workgroup and don't see your machines? What is not working that you feel you need to be concerned with the event log?

If you do not understand what it is telling you, and you do not notice anything wrong -- why are you looking in the event log?? I assure you your just going to frustrate yourself with information overload for something with lots of things you don't understand.

I for one wonder why your running sygate firewall -- who told you needed this? Where did you read that you needed this? Your OS has its own built in firewall -- unless you are wanting to do something specific that it does not provide -- you have NO use for a 3rd party one.. And clearly if you do not understand what its doing and how -- why in the world would you go dicking around with settings in it, etc.?? If my I would just remove it all together and use the built in one, this way if you want to share files -- windows will automatically make the changes in the firewall for you when you turn of file sharing, etc. etc..

[kodina]

I have to wonder why your running some 3rd party firewall in the first place.. As to those specific settings -- do you want to share files between your machines?? If not -- like I said don't turn on sharing there is no point is blocking stuff on a firewall behind a nat router you have no idea what any of it does -- so why are you blocking it???

If your saying that the error is on the laptop, and the ip listed in the error is the laptops -- then I will pretty much bet that 4321 error is due to your 3rd party firewall..

Maybe, just maybe you are right but prior to doing this fresh installation I was using exactly the same firewall (Sygate) for over 3 years and never faced any of the problem. I really do value your advice and suggestions but i guess the only (i repeat the only) area where I will respectfully disagree is using Microsoft's built-in firewall that comes with XP. I used it in the early days when I started using XP and it simply did NOT block any thing. There are software products (now mostly freeware) which constantly try to access the web sites of the authors/publishers and Sygate immediately blocks the access and gives me the notification and keep a details log and everything and the interface is so simple and easy to use as if it was made for someone like me.

Thank you for educating me about disclosing IP address or MAC address. Did not know any of this and the tinfoil is beginning to come off automatically. Thanks you again for helping me learn BudMan!

Question for you -- do you think this error is why your having a problem??? What are you trying to do that you feel this event message should concern you?? Are you trying to share files and can not access the other machine? Are you trying to browse your workgroup and don't see your machines? What is not working that you feel you need to be concerned with the event log?

BudMan as I have shared earlier (probably in the other post where you helped me), there is nothing unusual that I am doing on my Laptop. The usage is simple like most home users. No, I have never tried to browse anything on my workgroup. I don't even know how to browse my workgroup (I have that other Win7 PC) at home which is also causing some things in the Event Log and I will post a separate (and hopefully the last post) about my miseries.

Why do I look at the Event Logs? 2 Reasons:

1) Because ever since the fresh install my internet performance is not even 1/2 of what it used to be, and

2) I have been using computers for a few years but my learning has been pretty much where it was years back. I shared in one of my posts that i want to learn. I maybe taking the wrong approach but in my opinion probably one of the best ways to learn (amongst many other possibilities) is to share the problems you are facing, and learn from the advice/suggestions from people who have been there.

Other than Comodo and MSFT's firewall, would you recommend a firewall that I should try?

Regardless of your next reply, I thank you again for your help and for helping me again (I'll keep on doing this thanking act because I AM learning from replies to my questions)

Sincerely.

[+BudMan MVC]

"my internet performance is not even 1/2 of what it used to be"

My guess is your firewall!! Again why are you running it?? Oh yeah your tinfoil hat again and what software you trust to run is doing.

"I will respectfully disagree is using Microsoft's built-in firewall that comes with XP. I used it in the early days when I started using XP and it simply did NOT block any thing."

WTF do you need to block outbound for?? Why should you give a **** if some software you trust enough to run in the first place is checking in to see if there is an update.. This is what 1 or 2 bytes.. Do you think its sending your banking info to the makers?? If so WTF are you running it for in the first place????

If you so concerned with what this software is sending to the public net -- then fire up your fav sniffer like wireshark and actually look to see what its doing -- vs just blocking it without clue one to what its trying to do.. More than likely its checking for updates which you can turn off in the software if your so worried about it.

edit: I would love to help you get your system running the way you want.. But I can tell you right now with entries like the last one in your event log -- your firewall rules must be all jacked up.. What you block everything your firewall says is trying to talk on the network?? And you wonder why your getting errors and slow internet???

[kodina]

I can see that clearly BudMan i.e. you really want to help me out but my (well as per you), my tinfoil is the bottleneck and this is understandably frustrating you. Well if it's any consolation, my frustration level (with combined problems with my xp laptop and the Win7 PC related problems) is probably 50 times more than you. I must be doing something right (other than using Sygate) for keeping my calm while you feel like beating the s77t out of me until i change my mindset lol

on a serious note, I see the sincerity with which you have been trying to help me and the resultant thanks comes very sincerely. Please give me a day or whatever to get my act together and then post back with what else interesting has happened in life ;)

Regards.

[+BudMan MVC]

I am happy to help... But errors like that 4321 error are most likely from your firewall -- since from your settings you are preventing all network browsing and sharing. Which would explain the error. There is not one valid reason to block this on your 2 machine network with both of the machines being yours.

You say your internet speed is 1/2 -- on just this new xp install, or your win7 box as well?

What speed did you use to get, and what do you show now? Where are you testing your speeds from speednet.net or something?

[soldier1st]

listen to budman, he knows what he is talking about.