[Samba] How does Samba find a domain controller?

[Gautier, B (Bob)]

> -----Original Message-----
> From: Gerald (Jerry) Carter [mailto:jerry at samba.org] 
> Sent: 05 May 2006 13:53
> To: Gautier, B (Bob)
> Cc: samba at lists.samba.org
> Subject: Re: [Samba] How does Samba find a domain controller?
> 
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
> 
> Gautier, B (Bob) wrote:

> > 
> > Can someone spell out to me the way Samba looks up DCs and chooses 
> > amongst them?  For extra points: is there a way we can 
> influence the 
> > choice?
> 
> ok.  Here goes.  This applies to >= 3.0.14.
> 
> The process breaks down into 2 parts:  finding a list of 
> domain controllers, and then choosing which one to contact.
> 
> Finding a DC is dependent on the 'name resolve order 
> parameter' value.  NetBIOS lookups search for the 
> DOMAIN<0x1c>.  DNS lookups query for _ldap._tcp.<domain>.

The recommendation in the smb.conf manpage is 'name resolve order = wins
bcast' when you are in security=ads mode, with a remark that in that
case ADS-style DNS lookups are done anyway, first.  Is my reading right?

> 
> Samba 3.0.23 will query the correct 
> _ldap._tcp.dc._msdcs.<domain> name and includes affinity for 
> a server once connected so that for example winbindd will 
> reconnect to the server used during the domain join to avoid 
> lags in replication delays between DCs.

Is that in pre1, or still to come?
 
> Once you have a list of IP addresses, winbindd will spray all 
> the DCs with a socket connect and select the first one that replies.

So as I understand it there is no plan to do any 'nearest DC' guessing
(which is what Windows appears to do, based on IP address comparisons)
but we can influence choice of DC by what we put in the DNS in the first
place, and by firewalling to prevent access to inappropriate (e.g.
offsite) DCs?

Thanks for the quick response,

Bob G

> 
> 
> cheers, jerry
> =====================================================================
> Samba                                    ------- http://www.samba.org
> Centeris                         -----------  http://www.centeris.com
> "What man is a man who does not make the world better?"      --Balian
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.2 (GNU/Linux)
> Comment: Using GnuPG with SUSE - http://enigmail.mozdev.org
> 
> iD8DBQFEW0qnIR7qMdg1EfYRAoOAAKCfDu9BZuDTPgdTEVVxI8MEeDwXDgCgkNkC
> 7xchFyDigXLW6hiCVQ+1d5E=
> =kFzY
> -----END PGP SIGNATURE-----
> 
_____________________________________________________________

This email (including any attachments to it) is confidential, legally privileged, subject to copyright and is sent for the personal attention of the intended recipient only. If you have received this email in error, please advise us immediately and delete it. You are notified that disclosing, copying, distributing or taking any action in reliance on the contents of this information is strictly prohibited. Although we have taken reasonable precautions to ensure no viruses are present in this email, we cannot accept responsibility for any loss or damage arising from the viruses in this email or attachments. We exclude any liability for the content of this email, or for the consequences of any actions taken on the basis of the information provided in this email or its attachments, unless that information is subsequently confirmed in writing. If this email contains an offer, that should be considered as an invitation to treat.
_____________________________________________________________