Microsoft KB Archive/811003

= NETSTAT -S Output Displays a Large Number of IP Reassembly Failures =

Article ID: 811003

Article Last Modified on 11/14/2007

-

APPLIES TO


 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Server
 * Microsoft Windows NT Server 4.0 Standard Edition
 * Microsoft Windows NT Workstation 4.0 Developer Edition

-



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
Some User Datagram Protocol (UDP)-based programs may fail when the destination server is under a heavy load. If you use the netstat -s command to display per-protocol statistics, you may see a large number of Internet Protocol (IP) reassembly failures in the &quot;IP Statistics&quot; section of the output on the destination server. The following is an example of an &quot;IP Statistics&quot; section that indicates a large number of reassembly failures: IP Statistics

Packets Received                          = 687750865 Received Header Errors                    = 0 Received Address Errors                   = 1 Datagrams Forwarded                       = 0 Unknown Protocols Received                = 0 Received Packets Discarded                = 0 Received Packets Delivered                = 574556088 Output Requests                           = 596445524 Routing Discards                          = 0 Discarded Output Packets                  = 0 Output Packet No Route                    = 0 Reassembly Required                       = 118445100 Reassembly Successful                     = 5234431 Reassembly Failures                       = 107976783 Datagrams Successfully Fragmented         = 7642664 Datagrams Failing Fragmentation           = 0 Fragments Created                         = 15285321



CAUSE
This behavior may occur if any of the following conditions is true:
 * There is not enough memory to allocate a reassembly header structure.

By default, in Microsoft Windows 2000 and Microsoft Windows NT 4.0 Service Pack 5 (SP5) or later, the TCP/IP stack permits a maximum of 100 IP reassembly headers.

-or-
 * The IP stack times out the receipt of a segment that is required to complete the reassembly.



RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To troubleshoot and resolve this behavior, verify that the  entry in the Windows registry of the Windows 2000 or Windows NT-based computer that receives the UDP messages is set to an appropriate value. You may require a setting that is greater than the default value of 100. To do so:  Click Start, and then click Run. In the Open box, type regedit, and then click OK. Locate and click the following registry key:

 In the right pane, double-click MaximumReassemblyHeaders. In the Value data box, type a number to set the maximum number of IP reassembly headers, and then click OK. You can type any whole number between 100 and 65535. Quit Registry Editor.</li></ol>

<div class="status_section">

STATUS
This behavior is by design.

<div class="moreinformation_section">

MORE INFORMATION
When a fragmented IP packet is reassembled, the TCP/IP stack looks for a reassembly header for the fragment to fill the fragment into the correct buffer. The stack creates a reassembly header if an existing reassembly header to which the fragment belongs cannot be found.

By default, the  registry entry, introduced in Windows 2000 and Windows NT 4.0 Service Pack 5 (SP5) or later, limits the number of IP reassembly headers that the TCP/IP stack allows to100. Fragmented packets that arrive when the limit is reached are silently dropped. To change the limit, set a different value for the  registry entry. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

252366 New Registry Key to Limit Number of Reassembly Headers

For more information about the netstat command and other TCP/IP utilities, visit the following Microsoft Web site:

http://technet.microsoft.com/en-us/windowsserver/2000/default.aspx

Fragment reassembly failures is the number of failures that are detected by the IP reassembly algorithm. This is not necessarily a count of discarded IP fragments because some algorithms (for example, see Request for Comments 815) can lose track of the number of fragments by combining them as they are received.

Additional query words: fragmentation performance maxrh

Keywords: KB811003

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.