DOCUMENT:Q194881 10-AUG-2001 [winnt] TITLE :WinNT Router May Drop IP Packets While Awaiting ARP Response PRODUCT :Microsoft Windows NT PROD/VER:WinNT:4.0 OPER/SYS: KEYWORDS:kbnetwork ====================================================================== ------------------------------------------------------------------------------- The information in this article applies to: - Microsoft Windows NT Server version 4.0 - Microsoft Routing and Remote Access Service Update for Windows NT Server version 4.0 ------------------------------------------------------------------------------- SUMMARY ======= When Windows NT Server version 4.0 is configured as a router, some routed IP packets may be dropped while the server awaits an ARP response from the destination or next hop router. MORE INFORMATION ================ If a Windows NT router does not have an Ethernet (media access control) address entry for the destination or next hop router in its ARP cache, it will have to send an ARP Request. While Windows NT awaits an ARP Response, ARP will "queue" the IP packet that needs to be sent. When Windows NT receives the ARP Response, it will only transmit the "latest" or last packet that it received in its "ARP Packet Queue" for any given destination host. A common example of this phenomenon would be a ping (ICMP) message larger than the MTU of a given network segment. This will force TCP/IP to fragment the message into multiple packets. When Windows NT receives packet 1 of 2, it will send an ARP Request for the destination or next hop router. Before it receives the ARP Response, it will receive packet 2 of 2 of the ping message. When Windows NT finally receives the ARP Response, it will only transmit the "latest" or last packet it received -- the rest would be discarded. REFERENCES ========== For detailed information about the Address Resolution Protocol (ARP) in Windows NT Server version 4.0, please download the "TCP/IP Implementation Details" white paper from the Microsoft FTP Site: ftp://ftp.microsoft.com/bussys/winnt/winnt-docs/papers/TCPIMP2.EXE For more information about the ARP Packet Queue, please see RFC 1122 - "Requirements for Internet Hosts -- Communication Layers". RFCs may be obtained via the Internet as follows: Paper copies of all RFCs are available from the NIC, either individually or on a subscription basis (for more information, contact NIC@NIC.DDN.MIL). Online copies are available via FTP or Kermit from NIC.DDN.MIL as rfc/rfc####.txt or rfc/rfc####.PS (#### is the RFC number without leading zeros). Additionally, RFCs may be requested through electronic mail from the automated NIC mail server by sending a message to SERVICE@NIC.DDN.MIL with a subject line of "rfc ####" for text versions, or a subject line of "rfc ####.PS" for PostScript versions. To obtain the RFC index, the subject line of your message should read "rfc index". Additional query words: ntrouter ====================================================================== Keywords : kbnetwork Technology : kbWinNTsearch kbWinNT400search kbWinNTSsearch kbWinNTS400search kbWinNTS400 kbAudDeveloper kbRRASNTSearch kbRRASNT400 Version : WinNT:4.0 Hardware : ALPHA x86 Issue type : kbinfo ============================================================================= THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY. Copyright Microsoft Corporation 2001.