Microsoft KB Archive/306469

= PRB: Excessive 408 Log Entries in Netshow.log on Windows NT 4.0 =

Article ID: 306469

Article Last Modified on 10/30/2003

-

APPLIES TO


 * Microsoft Windows Media Services 4.1, when used with:
 * Microsoft Windows NT 4.0

-



This article was previously published under Q306469



SYMPTOMS
Windows Media Services (WMS) 4.1 on Microsoft Windows NT 4.0 logs a 408 error log entry for each TCP SYN packet that is received on the unicast service port (TCP port 1755). This occurs regardless of whether the TCP handshake is completed, such as during a SYN attack.



CAUSE
Windows NT 4.0 does not have delayed acceptance protection. TCP/IP calls AFD, so the unicast server service is notified of the connection attempt.



STATUS
This behavior is by design in Windows NT 4.0.



MORE INFORMATION
WMS does not log a 408 error when it is installed on Microsoft Windows 2000 because the TCP/IP stack in Windows 2000 was designed with SYN attack protection code that delays calling AFD.

Keywords: kbprb KB306469

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.