Re: ISA Server 2004 and RIS Error : 0xc0040016 FWX_E_NO_BACKLOG_PACKET_DROPPED

From: Sigalit Bar [MSFT] (sigalitb_at_online.microsoft.com)
Date: 03/08/05 

Date: Tue, 8 Mar 2005 14:57:19 +0200

Hi,

This error indicates that ISA is dropping packets because it does not have
the resources to perform the necessary logging for them. This could
typically happen if there is much traffic going through the ISA driver but
the ISA Firewall service is too busy or doesn't get enough CPU to perform
the necessary logging. 

-- 
Please do not send email directly to this alias. This alias is for newsgroup
purposes only.
This posting is provided "AS IS" with no warranties, and confers no rights.
"Yannick LaRue" <Sanmilie@hotmail.com> wrote in message
news:#bQ#WlUIFHA.3108@tk2msftngp13.phx.gbl...
> Hello,
>
> I have some problem with RIS installed on my isa server when a PXE rom
> client connect to get a copy of the RIS OS system the ISA server block all
> packet from the host to client ... raison : 0xc0040016
> FWX_E_NO_BACKLOG_PACKET_DROPPED
>
> On some pc this error never appair but on a Inter Server-Entry bord
> SE7210TP1-E with on board Intel network card (Intel pro 100M and Intel Pro
> 1000 CT). I'am not able to correcting this prob !!
> I have the last version of my bios, the last drivers for this network
card.
> The last board drivers One Intel P4 3E Ghz 1MB L2 cache, 800 FSB ,
PGA-478.
>
> Status
>
> DHCP --> ok
> AD --> ok
> RIS --> ok
>
> Client RIS screen receve ok
> chose the os
> start process to install ok ..
>
> When the server try to send packet to client the Firewall services drop
all
> packet for this raison.
> 0xc0040016 FWX_E_NO_BACKLOG_PACKET_DROPPED.
>
> Original Client IP Client Agent Authenticated Client Service Server Name
> Referring Server Destination Host Name Transport MIME Type Object Source
> Source Proxy Destination Proxy Bidirectional Client Host Name Filter
> Information Network Interface Raw IP Header Raw Payload Source Port
> Processing Time Bytes Sent Bytes Received Result Code HTTP Status Code
Cache
> Information Error Information Log Record Type Log Time Destination IP
> Destination Port Protocol Action Rule Client IP Client Username Source
> Network Destination Network HTTP Method URL
> 192.168.5.1 -   SRV-VOYLM  - UDP   - -  -  - - - 69 0 0 0 0xc0040016
> FWX_E_NO_BACKLOG_PACKET_DROPPED  0x0 0x0 Firewall 05/03/2005 00:00:08
> 192.168.5.11 52760 Unidentified IP Traffic Denied Connection -
192.168.5.1 -
> Local Host Internal
> 192.168.5.1 -   SRV-VOYLM  - UDP   - -  -  - - - 69 0 0 0 0xc0040016
> FWX_E_NO_BACKLOG_PACKET_DROPPED  0x0 0x0 Firewall 05/03/2005 00:00:26
> 192.168.5.11 52762 Unidentified IP Traffic Denied Connection -
192.168.5.1 -
> Local Host Internal
> 192.168.5.1 -   SRV-VOYLM  - UDP   - -  -  - - - 69 0 0 0 0xc0040016
> FWX_E_NO_BACKLOG_PACKET_DROPPED  0x0 0x0 Firewall 05/03/2005 00:00:24
> 192.168.5.11 52762 Unidentified IP Traffic Denied Connection -
192.168.5.1 -
> Local Host Internal
> 192.168.5.1 -   SRV-VOYLM  - UDP   - -  -  - - - 69 0 0 0 0xc0040016
> FWX_E_NO_BACKLOG_PACKET_DROPPED  0x0 0x0 Firewall 05/03/2005 00:00:16
> 192.168.5.11 52760 Unidentified IP Traffic Denied Connection -
192.168.5.1 -
> Local Host Internal
>
> If i un uninstall the isa server 2004, the RIS Work perfectly.
> Presently my firewall rule is unlimited access for LocalHost to internal
and
> Internal to LocalHost.
>
> This bug not appear on a Intel server board SE7501CW2 with 2 Intel Xeon
> processor.
> This bug not appear also on a Intel Desktop Board D915GAG with a P4 540
> processor.
>
> I need a help to correcting this bug.
>
> I need also more information on this error message for drop packet
> FWX_E_NO_BACKLOG_PACKET_DROPPED  !!
>
> TX for all
>
> Yannick LaRue
>
>

Relevant Pages

  • [REVS] Backdoor Spotcom Analysis
    ... Spotcom is a backdoor client application that allows a hacker to control ... The server IP address is hard-coded in ... msrsvp.exe accepts a couple of command line arguments. ... the packet payload. ...
    (Securiteam)
  • RE: sloww web browsing
    ... and ISA 2004, the internet access became slower than it used to be. ... Open the ISA Server management console, ... Click Start, point to Programs, point to Microsoft ISA server, and then ... will you be able to access the internet from the internal client ...
    (microsoft.public.windows.server.sbs)
  • RE: OWA page not displayed Outside
    ... Open ISA 2006 management console. ... Expand the server node and highlight 'Monitoring'. ... Click 'Configure Firewall Logging'. ... |> internal client as both the web proxy client and firewall client? ...
    (microsoft.public.windows.server.sbs)
  • Re: Socket weirdness
    ... client) before you will notice a shutdown receive at server. ... Then eventually a packet comes from the peer, and that will contain data, so the server responds RST: ... way back across the network. ...
    (microsoft.public.dotnet.framework)
  • Re: ISA firewall block outgoing email.
    ... I cannot send/receive email to the POP3 account unless I turn off the firewall in the CEICW. ... (This server is behind a router so I felt the test was safe enough to turn off the firewall). ... As I said, there is no need to add a hole for port 110, If the ISA client is installed on the workstation, Outlook will deliver the email. ...
    (microsoft.public.windows.server.sbs)