Terminal Services Shuts Down - Under Attack

[SpeedyDude]

I am getting the following error on my Win2K3/MF XP FR3 server. It thinks the system is under attack, which it is not. All connections are secure connections comin in through a site-to-site VPN. It seems to shutdown both RDP and ICA and produces the following error. Is there a way to disable this?

Event Type: Error
Event Source: TermService
Event Category: None
Event ID: 1006
Date: 4/26/2004
Time: 9:09:39 AM
User: N/A
Computer: COMPUTER
Description:
The terminal server received large number of incomplete connections. The system may be under attack.


Data:
0000: 49 00 43 00 41 00 2d 00 I.C.A.-.
0008: 74 00 63 00 70 00 00 00 t.c.p...
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: 00 00 00 00 00 00 00 00 ........
0030: 00 00 00 00 00 00 00 00 ........
0038: 00 00 00 00 00 00 00 00 ........
0040: 00 00 ..

 

[xs4citrix]

Make sure to read

http://eventid.net/display.asp?eventid=1006&eventno=1361&source=TermService&phase=1

http://www.printingsupport.com

Free citrixprinting support

 

[patrickrouse]

Please see this thread:

http://groups.google.com/groups?hl=...m=40e601c1e6e0$a1574b40$9ae62ecf@tkmsftngxa02

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.workthin.com

 

[SpeedyDude]

I appreciate all your assistance, but these posts are all related to Win2K and NT4.0 TS, not Win2K3. I have all the hotfixes loaded and up to date. The server does not have access from the internet through the firewall, the only access is via my site-to-site VPN's via a private IP address. I have looked at the registry stuff related in those posts and will monitor the situation.

Thanks

 

[patrickrouse]

If you think it's a bug then call PSS and have your event logs ready.

Patrick Rouse
Microsoft MVP - Terminal Server

http://www.workthin.com