As imagined, the PKT cache was still keeping the old referral in memory.
I decide to run a dfsutil /pktflush to forcibly flush the Referral Cache and the problem was immediately solved.
What surprised me was that I wasn't seeing the XP box coming in and asking to the DFSSVC the referral target as I had expected.
It looked clear to me that some sort of cache had stored the wrong referral target somewhere in the Windows meanders and that the PC was stuck with this wrong old information.
At that moment my understanding was that Windows XP systems have a MUP cache for DFS targets but they have no built-in tool to check its content. I said myself that if I restarted the Workstation service the MUP cache would be flushed...
but I was wrong this time too, as the PKT Cache stayed untouched.
As I always do when I meet weird communication problems, I fired my good old Network Monitor for Windows 2008 (ah yes, DFS server is running on a Windows 2008 Server).
After one minute spent putting in place the required filter based on the IP address of the test PC running Windows XP, I started a Network Capture.
I was wrong because I was able to resolve and ping the DFS server as well as the real file server hosting the data.
Instead, the referral expires after the Time to Live value lapses.
This change has several effects: So this was a really good piece of information.
I thought that if I could restart the Windows XP box the problem could get solved, but I didn't want to go straight to that point and confirm all the bad hype about Windows like "Windows has detected that you have moved your mouse, please restart..."."For DFS clients that are not running Windows XP with SP2 or Windows Server 2003 with SP1, the Time to Live for a referral determines the earliest time that a client will request a new referral, but only if the existing referral expires before it is accessed again.
Clients that use a cached referral will renew the Time to Live of the referral and thus use the referral indefinitely until the client’s referral cache is cleared or the client is restarted.
This behavior has changed for clients running Windows XP with SP2 or Windows Server 2003 with SP1.