Event ID 6004

  • Thread starter Thread starter Martin B.
  • Start date Start date
M

Martin B.

I'm getting Event ID 6004 (A driver packet received from
the I/O subsystem was invalid. The data is the packet.)
in my System Log every minute or so on all my Windows
2000 (Advanced Server) servers (8 servers) with Terminal
server installed in application mode and in load
balancing. The servers each have a dual port intel
pro/1000 gigabit card also configured for load balancing
running the latest drivers from Intel. If more info is
needed let me know.
 
This article seems to apply to Windows NT 3.5 and 4.0 but
I did look in to it anyways but I did not have that
problem the article is mentionning about LAA or UAA. I
had the same issue with an older driver. The nics are
brand new in all 8 servers.

Thanks for you help
 
Hi Martin
Just because the servers are new does not mean they wont/don't have a fault
don't dismiss it its possible ..
I have seen them flaky out of the box from day 1

Okay I was just thinking that as the error was the same it may have given
you a clue
if anyone had given the servers Locally administered addresses (LAA) or
universally administered addresses (UAA) in the advance settings on the
nic's..
I know it refers to Token Ring in the article but the fact that some OEM
Ethernet drivers allow the same functionality I was wondering if the setting
of the servers had been accidentally configured at some time (Proset allows
you to do this on the Intel server pro adapter) and the Macs were in
conflict

Questions
Does the Mac data in the error log match the Mac address of the nic?
what is the data shown in the event log ?
Are you running Auto Negotiate on the nics and switches. this can cause
issues.
what happens if you drop the speed of the nics at all, does the error still
appear
You got any software broadcasting that could cause this error
Are your bindings set up correctly (open network connections select advance
advance settings)

The servers each have a dual port Intel pro/1000 gigabit card you say are
they on the motherboard?
did you get OEM drivers at the vendors site or did you get them from Intel ?
Are they sharing any irq's for the 2 ports at all? are the settings on all
of the affected servers at the bios level the same ?
Have you checked for known issues for the hardware platform (I am assuming
they are all the same) on the vendor forums ?
Is the server bios, firmware, etc all up to date ?

Are the network cables new?

Are you teaming the 2 ports at all using teaming software ? if you are have
you got any reported errors for the nic in the teaming software ?

have you got a pci server nic in the servers
what happens if you run the network interface via a pci nic. do you get the
error still.

Install the network monitor driver on the servers and capture the packets
using netmon and see what your getting from the wire you can do address
pairs to capture between the server and one of the other servers and review
the captures
this may help if you need help with netmon post back..

hth
rgds
Steve
 
Some important data left out of the original posting.

1. Does each node have dual NICs?
2. Are they all plugged in to the switch?
3. Is it a single switch or multiple and is it Layer 2 or 3?
4. Have you read through the following articles yet?

303608 HOW TO: Configure Network Load Balancing Parameters in Windows 2000
http://support.microsoft.com/?id=303608

193602 Configuration options for WLBS hosts connected to layer 2 switches
http://support.microsoft.com/?id=193602

324963 Support WebCast: Network Load Balancing in Microsoft Windows 2000
http://support.microsoft.com/?id=324963

324814 Support WebCast: Microsoft Windows Terminal Services: How to
Configure
http://support.microsoft.com/?id=324814

--
Hope this helps,
Mike Rosado
Windows 2000 MCSE + MCDBA
Microsoft Enterprise Platform Support
Windows NT/2000/2003 Cluster Technologies

====================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
====================================================

This posting is provided "AS IS" with no warranties, and confers no rights.
<http://www.microsoft.com/info/cpyright.htm>

-----Original Message-----
 
The following is the exact event I'm getting...

Event Type: Error
Event Source: EventLog
Event Category: None
Event ID: 6004
Date: 9/15/2004
Time: 14:14:17
User: N/A
Computer: TRMSRV01
Description:
A driver packet received from the I/O subsystem was
invalid. The data is the packet.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: de ee 33 d0 4f 9b c4 01 Þî3ÐO›Ä.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 42 00 46 00 2d 00 4c 00 B.F.-.L.
0088: 4f 00 52 00 45 00 4e 00 O.R.E.N.
0090: 5a 00 45 00 54 00 54 00 Z.E.T.T.
0098: 49 00 00 00 4e 00 65 00 I...N.e.
00a0: 74 00 42 00 54 00 5f 00 t.B.T._.
00a8: 54 00 63 00 70 00 69 00 T.c.p.i.
00b0: 70 00 5f 00 7b 00 42 00 p._.{.B.
00b8: 37 00 43 00 39 00 36 00 7.C.9.6.
00c0: 30 00 45 00 32 00 2d 00 0.E.2.-.
00c8: 37 00 42 00 33 00 42 00 7.B.3.B.
00d0: 2d 00 34 00 35 00 43 00 -.4.5.C.
00d8: 34 00 2d 00 39 00 00 00 4.-.9...


Martin B.
 
I have just encounterd this on an old Windows 2000 workstation.
It has never done this before, and it started just after I installed
McAfee 8.0 and the GDI detection tool.

Only one card, no load balancing, a boring workstation in fact.

Any ideas?
 
we have just deployed McAfee 8.0 and the GDI detection tool on our la
and are seeing this event appearing in a growing number o
workstations our unmanaged pc's that are still on mcafee 7 enterpris
are not having the issu


-
jwmc
 
Since 9/10/2004 we began seeing these errors in the Event viewer of 2 of
our Servers...simultaneously the network connections became highly
unreliable however we don't see any error's reported by the NIC nor did
we do any driver-updates, there is no NIC-Teaming installed...It's just
W2K3 with SQL2K and SMS2K3.
(None of our other Servers show this event...all W2K3, some with
SQL2K.)

Has anyone else seen this problem? (And maybe has a solution?)

Following article isn't too helpful because we do have a problem:
http://www.microsoft.com/technet/su...indows+Operating+System&LCID=1033&ProdVer=5.0

----------
A driver packet received from the I/O subsystem was invalid. The data
is the packet.

For more information, see Help and Support Center at
http://go.microsoft.com/fwlink/events.asp.

0000: 0c 00 e0 00 0e 00 00 00 ..à.....
0008: 25 74 ab 6f 77 b0 c4 01 %t«ow°Ä.
0010: 40 00 00 00 00 00 00 00 @.......
0018: 00 00 00 00 04 00 4e 00 ......N.
0020: 00 00 00 00 cb 0b 00 80 ....Ë..€
0028: 00 00 00 00 10 00 00 c0 .......À
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 4d 00 52 00 78 00 53 00 M.R.x.S.
0048: 6d 00 62 00 00 00 5c 00 m.b...\.
0050: 44 00 65 00 76 00 69 00 D.e.v.i.
0058: 63 00 65 00 5c 00 4c 00 c.e.\.L.
0060: 61 00 6e 00 6d 00 61 00 a.n.m.a.
0068: 6e 00 52 00 65 00 64 00 n.R.e.d.
0070: 69 00 72 00 65 00 63 00 i.r.e.c.
0078: 74 00 6f 00 72 00 00 00 t.o.r...
0080: 41 00 44 00 00 00 4e 00 A.D...N.
0088: 65 00 74 00 42 00 54 00 e.t.B.T.
0090: 5f 00 54 00 63 00 70 00 _.T.c.p.
0098: 69 00 70 00 5f 00 7b 00 i.p._.{.
00a0: 32 00 37 00 34 00 45 00 2.7.4.E.
00a8: 39 00 44 00 35 00 41 00 9.D.5.A.
00b0: 2d 00 39 00 32 00 36 00 -.9.2.6.
00b8: 34 00 2d 00 34 00 43 00 4.-.4.C.
00c0: 43 00 42 00 2d 00 39 00 C.B.-.9.
00c8: 35 00 41 00 36 00 2d 00 5.A.6.-.
00d0: 34 00 35 00 42 00 39 00 4.5.B.9.
00d8: 33 00 30 00 35 00 00 00 3.0.5...
 
Back
Top