Thousands of ESTABLISHED microsoft-ds Connections in Netstat -a Results
We have a Windows 2008 R2 RODC in a site office which, every week or so, develops a fault which generates an error message saying: "The name limit for the local computer network adapter card was exceeded." The server handles DNS, Folder Redirection, File and Print services and is part of our SCCM 2007 deployment. I have looked at kb315904 but it is not for the same software version and, in any event, the registry keys the recommendations suggest to change to not exist in the 2008 R2 registry and nor are the netstat -a results the same. What I have noticed in troublsehooting the problem, however, is the following odd situation in the results of netstat -a. Over the course of the week the results returned just grow, until I end up with around 16,000 established connections for microsoft-ds on port 445. There are two blocks of these connections, below is a selection from the output showing the end of the first block and the beginning of the second: TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65530 ESTABLISHED TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65531 ESTABLISHED TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65532 ESTABLISHED TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65533 ESTABLISHED TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65534 ESTABLISHED TCP [**IPv6 Address**%11]:445 SVR-CONT-01:65535 ESTABLISHED TCP [**IPv6 Address**%11]:49155 SVR-CONT-01:52657 ESTABLISHED TCP [**IPv6 Address**%11]:49156 SVR-CONT-01:microsoft-ds ESTABLISHED TCP [**IPv6 Address**%11]:49157 SVR-CONT-01:microsoft-ds ESTABLISHED TCP [**IPv6 Address**%11]:49160 SVR-CONT-01:microsoft-ds ESTABLISHED TCP [**IPv6 Address**%11]:49161 SVR-CONT-01:microsoft-ds ESTABLISHED TCP [**IPv6 Address**%11]:49162 SVR-CONT-01:microsoft-ds ESTABLISHED The port range is from 149160>65535 inclusive when we get the 'name limit' error. Before this point arrives, the list of port numbers grows, at random, until every port number is established. Can anybody offer some advice on what to troubleshoot next? I do not know what is causing the connections so do not know where to begin with why they do not close again afterwards. Many thanks, Chris
January 13th, 2011 6:32am

Hello Chris, Please try to disable SNP Feature in Network card properties and in registry on the affected Server. To disable RSS and Chimneyoffload, follow these commands: netsh int tcp set global rss=disabled netsh int tcp set global chimney=disabled To disable NetDMA, follow these steps: Click Start, click Run, type regedit, and then click OK. Locate the following registry subkey, and then click it: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters Double-click the EnableTCPA registry entry. Note If this registry entry does not exist, right-click Parameters, point to New, click DWORD Value, type EnableTCPA, and then press ENTER. To disable NetDMA, type 0 in the Value data box, and then click OK. TCP Chimney and RSS Features May Cause Slow File Transfers or Cause Connectivity Problems http://msmvps.com/blogs/acefekay/archive/2009/08/20/tcp-chimney-and-rss-features-may-cause-slow-file-transfers-or-cause-connectivity-problems.aspx BrentPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.
Free Windows Admin Tool Kit Click here and download it now
January 14th, 2011 2:29am

Hi Brent, Thank you for your response, I've made the suggested changes and will see if the number of ESTABLISHED connections continues to increase or not. Cheers, Chris
January 14th, 2011 4:53am

Hi Brent, After making the suggested changes and re-booting the server I can confirm that the problem still exists. I have run netstat -a again this morning and there are already many ESTABLISHED microsoft-ds entries. Chris
Free Windows Admin Tool Kit Click here and download it now
January 17th, 2011 5:19am

Hi David, Thank you for your reply. Unfortunately the connections are owned by the system process so I will try and debug this myself first. Are you able to offer any pointers on how best to proceed with this? Thanks, Chris
January 19th, 2011 6:27am

Thanks David, Using a combination of TCPView and Process Monitor I tracked it down to SCCM 2007. Deleting the site from the Primary Site server and then uninstalling the software from the server in question resolved the issue. The netstat results are now as I would expect. We are due to review our deployment of SCCM this year anyway and will most likely be deploying the new version in due course so this does not cause us any concern in the short term. Thanks again for your help. Cheers, Chris
Free Windows Admin Tool Kit Click here and download it now
January 24th, 2011 4:57am

i am more interested how to fix the issue. Unfortunatelly on the infrastructure at hand, we did not delete the site and problem spanned to all SCCM servers. Any other comments or ideas?
September 5th, 2011 2:16pm

hi again guys, I narrowed down to the thread which is causing the issue - SMS_DISTRIBUTION_MANAGER. Now I will be going through the logs. Will still appreciate any form of help.
Free Windows Admin Tool Kit Click here and download it now
September 6th, 2011 7:25am

Hello all, i suffers the same problem on my RODC with DHCP and WDS Role. To Solve the problem i must reboot the server approximately every 100 days :/ I have a lot of the same hardware (Dell PowerEdge) with the same OS (Windows 2008R2) without this problem. Anyone have found a fix to this problem ? Thanks for any advice or reply :)
July 9th, 2012 6:57am

This topic is archived. No further replies will be accepted.

Other recent topics Other recent topics