Microsoft KB Archive/829701

Knowledge Base

Network load balancing heartbeat packets may be dropped and a cluster may be disbanded in a Windows Server 2003 cluster environment

Article ID: 829701

Article Last Modified on 10/26/2006

---

APPLIES TO

• Microsoft Windows Server 2003, Datacenter Edition (32-bit x86)
• Microsoft Windows Server 2003, Enterprise Edition (32-bit x86)

---

SYMPTOMS

On a cluster member in a Microsoft Windows Server 2003 cluster environment, you may experience one or more of the following symptoms:

• The Windows Load Balancing Service (WLBS) fails and the incoming Network Load Balancing (NLB) heartbeat packets are lost.
• The number of incoming and outgoing TCP segments significantly increases. Therefore, more bandwidth is consumed.
• All members in the cluster are disconnected and the cluster is disbanded.
• The following informational event ID message about changes in the cluster state may be logged on all member servers:

  Event Type: Information
  Event Source: WLBS
  Event Category: None
  Event ID: 69
  Date: date
  Time: time
  User: N/A
  Computer: computer name
  Description: NLB Cluster IP address : Initiating convergence on host 2. Reason: Host 3 is leaving the cluster.
  
  For more information, see Help and Support Center at
  http://support.microsoft.com.
  Data:
  0000: 00 00 0c 00 04 00 5a 00 ......Z.
  0008: 00 00 00 00 45 00 07 40 ....E..@
  0010: 00 00 00 00 00 00 00 00 ........
  0018: 00 00 00 00 00 00 00 00 ........
  0020: 00 00 00 00 00 00 00 00 ........
  0028: bf 0b 06 00 00 00 00 00 ¿.......
  0030: 00 00 00 00

CAUSE

This problem occurs because the cluster member servers have become the target of a malicious attack known as "TCP/IP SYN Flooding" or "TCP/IP SYN Attacks."

RESOLUTION

To resolve this problem, obtain the latest service pack for Microsoft Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 How to obtain the latest service pack for Windows Server 2003

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.

Keywords: kbhotfixserver kbqfe kbfix kbbug kbwinserv2003presp1fix kbprb KB829701

---

Send feedback to Microsoft

© Microsoft Corporation. All rights reserved.