Event 5501-DNS-bad packets?

[Ashaman074]

Hi everyone,

Recently the following message starteed showing up in the DNS event logs: Event 5501: "The DNS server encountered a bad packet from 205.171.3.65. Packet processing leads beyond packet length. (205.171.3.65 is resolver.qwest.net, we have a T1 through them)

Here are the details of our setup, We have one Windows 2000 application server running Active Directory, one Windows 2000/Citrix server (member server), and ~30 95/98 workstations. We have been using this configuration for about a year now, and haven't had any errors previously. About a month ago, this message showed up a couple times out of the blue....then several times in the last 3 days.

I was suprised to see this error since there have been no changes the configuration, and after reading about this error it seems most referred to NT4. FWIW, I haven't noticed any problems in functionality; however when an error shows up suddenly for no apparent reason it kinda grabs my attention!

Anyone here have any suggetions/explanations as to what might be going on?

TIA!

Asha'man

 

[Ashaman074]

Hmm...no responses... So does this mean nobody has seen this or has any ideas? Or is it just such a dumb question nobody bothered?

 

[GlenJohnson]

I've had my best luck with event id's by going to something like google.com and searching for event id **. There's a lot of information out there. It may take some digging, but you'll find it. I just did a search that way and the first one to come up was at this address. Copy and paste it into a browser. Didn't read the article but it started with:
If DNS is installed on your Windows NT Server and you receive:

Event 5501
Source: DNS
Description: DNS Server encountered bad packet from IP Address. Packet processing leads beyond packet length
Good luck.

http://www.jsiinc.com/SUBC/tip1400/rh1489.htm

Glen A. Johnson
Microsoft Certified Professional

"To know, is to know that you know nothing.
That is the meaning of true knowledge."
Confucius (c. 551-479 B.C.) Chinese philosopher

 

[Ashaman074]

Well, thanks for the response. Unforutnately, I have done this, and all responses point to sloving problems under NT4 by installing a service pack. The most annoying thing about this problem is it just popped up for no apparent reason. This system had been running for about a year in its current config; then last month I get these messages. No changes, no new equipment, nothing. On the plus side, everything also seems to be working fine....ah well.

 

[jasonhand]

It could be an indication that your ISP may be sending a couple of bad packets here and there. It could also be an indication that your NIC card is having problems. I would say that it is more likely something to do with your ISP since it is only happening in packets from them. I wouldn't worry about it until it becomes a problem.

-Jason

 

[jnord24]

I have been receiving this same error for some time now. It does not appear to have an adverse affect on anything... per the article quoted... it logs the error and states that the packet was fragmented because the info (update) could not fit within the expected packet length, and that more data is to follow shortly. D

Doesn't really seem to be an error.. more of an information log.

 

[sleew]

http://www.eventid.net.....maybe

helps Sleew
Compaq & Microsoft TS
sleew@infosky.net