PRB: Excessive 408 Log Entries in Netshow.log on Windows NT 4.0 (306469)


The information in this article applies to:

  • Microsoft Windows Media Services 4.1, when used with:
    • the operating system: Microsoft Windows NT 4.0
This article was previously published under Q306469

SYMPTOMS

Windows Media Services (WMS) 4.1 on Microsoft Windows NT 4.0 logs a 408 error log entry for each TCP SYN packet that is received on the unicast service port (TCP port 1755). This occurs regardless of whether the TCP handshake is completed, such as during a SYN attack.

CAUSE

Windows NT 4.0 does not have delayed acceptance protection. TCP/IP calls AFD, so the unicast server service is notified of the connection attempt.

STATUS

This behavior is by design in Windows NT 4.0.

MORE INFORMATION

WMS does not log a 408 error when it is installed on Microsoft Windows 2000 because the TCP/IP stack in Windows 2000 was designed with SYN attack protection code that delays calling AFD.
Modification Type:MajorLast Reviewed:10/30/2003
Keywords:kbprb KB306469
©2003 Microsoft Corporation. All rights reserved.