Article ID: 166222
Article Last Modified on 11/1/2006
APPLIES TO
- Microsoft Windows NT Server 4.0 Standard Edition
- Microsoft Windows NT 4.0 Service Pack 1
- Microsoft Windows NT 4.0 Service Pack 2
- Microsoft Windows NT 4.0 Service Pack 3
- Microsoft Windows NT 4.0 Service Pack 4
- Microsoft Windows NT 4.0 Service Pack 5
- Microsoft Windows NT 4.0 Service Pack 6
- Microsoft Windows NT 4.0 Service Pack 6a
- Microsoft Windows NT Workstation 3.51
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0
- Microsoft Windows NT Workstation 4.0 Developer Edition
- Microsoft Windows NT Workstation 4.0 Developer Edition
This article was previously published under Q166222
SYMPTOMS
On Windows NT, when you run an application that uses Dlc.sys to communicate to a remote system using DLC/802.2 over Token Ring, Ethernet, or FDDI, Windows NT may erroneously send a frame reject (FRMR) and drop the connection.
If SNA Server is being used, this will cause an SNA Server connection failure with the following Windows NT application event log entries:
Event 228: SNA Server
FRMR sent (0x03) = invalid or unsupported command/response received
Event 238: SNA Server
Connection <name> statistics
Event 23, SNA Server
Connection <name> using Link Service <SNADLCx> failed Qualifier = 00AC
When this occurs, all SNA sessions using this connection will be lost.
The following excerpt from a network monitor trace illustrates the reproduction scenario:
Frame Src MAC Dst MAC Description
1 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x07, N(R) = 0x1A
2 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x08, N(R) = 0x1A
3 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x09, N(R) = 0x1A
4 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x0A, N(R) = 0x1A
5 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x0B, N(R) = 0x1A
6 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x0C, N(R) = 0x1A
7 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x0D, N(R) = 0x1A
8 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x0E, N(R) = 0x1B
POLL
9 HOST SNASRV RR DSAP=0x04 SSAP=0x05 R N(R) = 0x07 FINAL
10 SNASRV HOST I DSAP=0x04 SSAP=0x04 C N(S) = 0x07, N(R) = 0x1B
POLL
11 HOST SNASRV I DSAP=0x04 SSAP=0x04 C N(S) = 0x1B, N(R) = 0x07
12 HOST SNASRV RR DSAP=0x04 SSAP=0x05 R N(R) = 0x08
13 HOST SNASRV RR DSAP=0x04 SSAP=0x05 R N(R) = 0x09
14 SNASRV HOST FRMR DSAP=0x04 SSAP=0x05 R
CAUSE
Windows NT Dlc.sys was incorrectly handling acknowledgements for I-frames when the t1 send timer has expired on a DLC connection.
In the above trace of LLC frames, SNA Server sends a window of I-frames to the host from frame 1-8, with the N(S) counter incremented from 0x07-0x0E. The host then replies with a N(R) of 0x07, causing SNA Server to reset its N(S) counter and begin resending the I-frames again. However, SNA Server then receives host acknowledgments for later frames (sending N(R) = 0x08 and 0x09 in frame 12 and 13 above). Because the Windows NT DLC driver detects that the N(S) is now 0x07, DLC sends a frame reject (FRMR) to the host, causing the connection to drop.
RESOLUTION
It is possible to work around this problem by increasing the DLC t1 timer so that it will never expire. If SNA Server is being used, the t1 timer can be increased to a maximum value of 10 within the connection properties dialog or folder within SNA Server 2.x Admin or SNA Server 3.x Manager.
An update to Dlc.sys is available to correct this problem. The Dlc.sys driver now keeps track of a new maximum N(S) counter sent value and validates I-frame acknowledgements based on this value
STATUS
Microsoft has confirmed this to be a problem in Windows NT version 3.51 (SP1-SP5) and Windows NT 4.0 (SP1, SP2). This problem was corrected in the latest Microsoft Windows NT 4.0 U.S. Service Pack. For information on obtaining the service pack, query on the following word in the Microsoft Knowledge Base (without the spaces):
S E R V P A C K
Additional query words: 2.0 2.1 2.11 3.0 4.00 3.51 prodnt
Keywords: kbapi kbnetwork KB166222
