Network load balancing heartbeat packets may be dropped and a cluster may be disbanded in a Windows Server 2003 cluster environment

View products that this article applies to.

System TipThis article applies to a different operating system than the one you are using. Article content that may not be relevant to you is disabled.

Expand all | Collapse all

SYMPTOMS

On a cluster member in a Microsoft Windows Server 2003 cluster environment, you may experience one or more of the following symptoms:

The Windows Load Balancing Service (WLBS) fails and the incoming Network Load Balancing (NLB) heartbeat packets are lost.
The number of incoming and outgoing TCP segments significantly increases. Therefore, more bandwidth is consumed.
All members in the cluster are disconnected and the cluster is disbanded.
The following informational event ID message about changes in the cluster state may be logged on all member servers:
Event Type: Information
Event Source: WLBS
Event Category: None
Event ID: 69
Date: date
Time: time
User: N/A
Computer: computer name
Description: NLB Cluster IP address : Initiating convergence on host 2. Reason: Host 3 is leaving the cluster.

For more information, see Help and Support Center at
http://support.microsoft.com.
Data:
0000: 00 00 0c 00 04 00 5a 00 ......Z.
0008: 00 00 00 00 45 00 07 40 ....E..@
0010: 00 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........
0028: bf 0b 06 00 00 00 00 00 ¿.......
0030: 00 00 00 00

Back to the top

CAUSE

This problem occurs because the cluster member servers have become the target of a malicious attack known as "TCP/IP SYN Flooding" or "TCP/IP SYN Attacks."

Back to the top

To resolve this problem, obtain the latest service pack for Microsoft Windows Server 2003. For more information, click the following article number to view the article in the Microsoft Knowledge Base:

889100 (http://support.microsoft.com/kb/889100/ ) How to obtain the latest service pack for Windows Server 2003

Back to the top