NETSTAT -S Output Displays a Large Number of IP Reassembly Failures

IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SYMPTOMS
Some User Datagram Protocol (UDP)-based programs may fail when the destination server is under a heavy load. If you use the netstat -s command to display per-protocol statistics, you may see a large number of Internet Protocol (IP) reassembly failures in the "IP Statistics" section of the output on the destination server. The following is an example of an "IP Statistics" section that indicates a large number of reassembly failures:
IP StatisticsPackets Received                           = 687750865Received Header Errors                     = 0Received Address Errors                    = 1Datagrams Forwarded                        = 0Unknown Protocols Received                 = 0Received Packets Discarded                 = 0Received Packets Delivered                 = 574556088Output Requests                            = 596445524Routing Discards                           = 0Discarded Output Packets                   = 0Output Packet No Route                     = 0Reassembly Required                        = 118445100Reassembly Successful                      = 5234431Reassembly Failures                        = 107976783Datagrams Successfully Fragmented          = 7642664Datagrams Failing Fragmentation            = 0Fragments Created                          = 15285321
CAUSE
This behavior may occur if any of the following conditions is true:
  • There is not enough memory to allocate a reassembly header structure.

    By default, in Microsoft Windows 2000 and Microsoft Windows NT 4.0 Service Pack 5 (SP5) or later, the TCP/IP stack permits a maximum of 100 IP reassembly headers.

    -or-
  • The IP stack times out the receipt of a segment that is required to complete the reassembly.
RESOLUTION
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To troubleshoot and resolve this behavior, verify that the
MaximumReassemblyHeaders
entry in the Windows registry of the Windows 2000 or Windows NT-based computer that receives the UDP messages is set to an appropriate value. You may require a setting that is greater than the default value of 100. To do so:
  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. Locate and click the following registry key:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  4. In the right pane, double-click MaximumReassemblyHeaders.
  5. In the Value data box, type a number to set the maximum number of IP reassembly headers, and then click OK. You can type any whole number between 100 and 65535.
  6. Quit Registry Editor.
STATUS
This behavior is by design.
MORE INFORMATION
When a fragmented IP packet is reassembled, the TCP/IP stack looks for a reassembly header for the fragment to fill the fragment into the correct buffer. The stack creates a reassembly header if an existing reassembly header to which the fragment belongs cannot be found.

By default, the
MaximumReassemblyHeaders
registry entry, introduced in Windows 2000 and Windows NT 4.0 Service Pack 5 (SP5) or later, limits the number of IP reassembly headers that the TCP/IP stack allows to100. Fragmented packets that arrive when the limit is reached are silently dropped. To change the limit, set a different value for the
MaximumReassemblyHeaders
registry entry. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
252366 New Registry Key to Limit Number of Reassembly Headers
For more information about the netstat command and other TCP/IP utilities, visit the following Microsoft Web site:Fragment reassembly failures is the number of failures that are detected by the IP reassembly algorithm. This is not necessarily a count of discarded IP fragments because some algorithms (for example, see Request for Comments 815) can lose track of the number of fragments by combining them as they are received.
fragmentation performance maxrh
Properties

Article ID: 811003 - Last Review: 11/14/2007 08:34:59 - Revision: 4.2

Microsoft Windows 2000 Advanced Server, Microsoft Windows 2000 Professional Edition, Microsoft Windows 2000 Server, Microsoft Windows NT Server 4.0 Standard Edition, Microsoft Windows NT Workstation 4.0 Developer Edition

  • KB811003
Feedback