NETSTAT -S Output Displays a Large Number of IP Reassembly Failures

Article ID: 811003 - View products that this article applies to.
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986
(http://support.microsoft.com/kb/256986/EN-US/ )
Description of the Microsoft Windows Registry
Expand all | Collapse all

SYMPTOMS

Some User Datagram Protocol (UDP)-based programs may fail when the destination server is under a heavy load. If you use the netstat -s command to display per-protocol statistics, you may see a large number of Internet Protocol (IP) reassembly failures in the "IP Statistics" section of the output on the destination server. The following is an example of an "IP Statistics" section that indicates a large number of reassembly failures:
IP Statistics

Packets Received                           = 687750865
Received Header Errors                     = 0
Received Address Errors                    = 1
Datagrams Forwarded                        = 0
Unknown Protocols Received                 = 0
Received Packets Discarded                 = 0
Received Packets Delivered                 = 574556088
Output Requests                            = 596445524
Routing Discards                           = 0
Discarded Output Packets                   = 0
Output Packet No Route                     = 0
Reassembly Required                        = 118445100
Reassembly Successful                      = 5234431
Reassembly Failures                        = 107976783
Datagrams Successfully Fragmented          = 7642664
Datagrams Failing Fragmentation            = 0
Fragments Created                          = 15285321
Back to the top | Give Feedback

CAUSE

This behavior may occur if any of the following conditions is true:
  • There is not enough memory to allocate a reassembly header structure.

    By default, in Microsoft Windows 2000 and Microsoft Windows NT 4.0 Service Pack 5 (SP5) or later, the TCP/IP stack permits a maximum of 100 IP reassembly headers.

    -or-
  • The IP stack times out the receipt of a segment that is required to complete the reassembly.
Back to the top | Give Feedback

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To troubleshoot and resolve this behavior, verify that the
MaximumReassemblyHeaders
entry in the Windows registry of the Windows 2000 or Windows NT-based computer that receives the UDP messages is set to an appropriate value. You may require a setting that is greater than the default value of 100. To do so:
  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. Locate and click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  4. In the right pane, double-click MaximumReassemblyHeaders.
  5. In the Value data box, type a number to set the maximum number of IP reassembly headers, and then click OK. You can type any whole number between 100 and 65535.
  6. Quit Registry Editor.
Back to the top | Give Feedback

STATUS

This behavior is by design.
Back to the top | Give Feedback

MORE INFORMATION

When a fragmented IP packet is reassembled, the TCP/IP stack looks for a reassembly header for the fragment to fill the fragment into the correct buffer. The stack creates a reassembly header if an existing reassembly header to which the fragment belongs cannot be found.

By default, the
MaximumReassemblyHeaders
registry entry, introduced in Windows 2000 and Windows NT 4.0 Service Pack 5 (SP5) or later, limits the number of IP reassembly headers that the TCP/IP stack allows to100. Fragmented packets that arrive when the limit is reached are silently dropped. To change the limit, set a different value for the
MaximumReassemblyHeaders
registry entry. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
252366
(http://support.microsoft.com/kb/252366/EN-US/ )
New Registry Key to Limit Number of Reassembly Headers
For more information about the netstat command and other TCP/IP utilities, visit the following Microsoft Web site:
http://technet.microsoft.com/en-us/windowsserver/2000/default.aspx
(http://technet.microsoft.com/en-us/windowsserver/2000/default.aspx)
Fragment reassembly failures is the number of failures that are detected by the IP reassembly algorithm. This is not necessarily a count of discarded IP fragments because some algorithms (for example, see Request for Comments 815) can lose track of the number of fragments by combining them as they are received.
Back to the top | Give Feedback

Properties

Article ID: 811003 - Last Review: November 14, 2007 - Revision: 4.2
APPLIES TO
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Server
  • Microsoft Windows NT Server 4.0 Standard Edition
  • Microsoft Windows NT Workstation 4.0 Developer Edition
Keywords: 
KB811003
Back to the top | Give Feedback

Give Feedback

 
Back to the topBack to the top