Badpacket from the DNS Server of the ISP

[Fred]

Hello,

I have a lot of event with the ID 5501 with the source DNS
and the description: the dns server encoutered a bad
packet from 212.53.4.5. Packetprocessing leads beyond
packet length.

This is a issue that's resolve with SP4. I have install
SP4 but the message is still generate.

 

[Kevin D. Goodknecht [MVP]]

In

Hello,

I have a lot of event with the ID 5501 with the source DNS
and the description: the dns server encoutered a bad
packet from 212.53.4.5. Packetprocessing leads beyond
packet length.

This is a issue that's resolve with SP4. I have install
SP4 but the message is still generate.

Is this NT4 or Win2k?
I believe the article that refers to this event is for NT4 earlier than SP4,
Win2k is supposed to behave correctly.
DNS Events 5501, 5000, and 9999 Fill Up the Event Log
http://support.microsoft.com/default.aspx?scid=kb;en-us;Q198757#appliesto

 

[Michael Johnston [MSFT]]

This error can be caused by several different problems, Q198757. The SP4 issue you mention actually requires that you enable
a registry setting to reduce the logging level of DNS. This article is also refering to SP4 for NT4. Are you running NT4 or
Windows 2000? The regkey should be the same for either. This isn't necessarily a fix. It just suppresses that event message.
The article mentions that one possible source is that the packet sent to your server was fragmented and the server was unable
rebuild the packet. The most likely cause of that is a firewall that blocks IP fragments. Verify that your firewall isn't blocking IP
fragments. Enable DNS logging on the server. The next time this event is thrown, check the DNS.LOG file found in winnt
\system32\dns. This log may give you a clue about what cause the event. Lastly, you could try removing your ISP as a
forwarder.

Thank you,
Mike Johnston
Microsoft Network Support
--

This posting is provided "AS IS" with no warranties, and confers no rights. Use of included script samples are subject to the
terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all responses to this message are best directed to the newsgroup/thread from
which they originated.

 

[Guest]

-----Original Message-----
In Fred <[email protected]> posted a question
Then Kevin replied below:

Is this NT4 or Win2k?
I believe the article that refers to this event is for NT4 earlier than SP4,
Win2k is supposed to behave correctly.
DNS Events 5501, 5000, and 9999 Fill Up the Event Log
http://support.microsoft.com/default.aspx?scid=kb;en- us;Q198757#appliesto




.
This is Windows 2000 Server SP4,Now I have enabled Log on

this DNS Server to have a clue on what happening.

Frederic (MCSA)

 

[Fred]

-----Original Message-----
This error can be caused by several different problems,

Q198757. The SP4 issue you mention actually requires that
you enable

a registry setting to reduce the logging level of DNS.

This article is also refering to SP4 for NT4. Are you
running NT4 or

Windows 2000? The regkey should be the same for either.

This isn't necessarily a fix. It just suppresses that
event message.

The article mentions that one possible source is that the

packet sent to your server was fragmented and the server
was unable

rebuild the packet. The most likely cause of that is a

firewall that blocks IP fragments. Verify that your
firewall isn't blocking IP

fragments. Enable DNS logging on the server. The next

time this event is thrown, check the DNS.LOG file found in
winnt

\system32\dns. This log may give you a clue about what

cause the event. Lastly, you could try removing your ISP
as a

forwarder.

Thank you,
Mike Johnston
Microsoft Network Support

confers no rights. Use of included script samples are
subject to the

terms specified at
http://www.microsoft.com/info/cpyright.htm

Note: For the benefit of the community-at-large, all

responses to this message are best directed to the
newsgroup/thread from

which they originated.



.

I have configured the forwarders to use another DNS
server, and apparently is everything fine. thanks a lot
for you help.

Fred MCSA