NETSTAT -S Output Displays a Large Number of IP Reassembly Failures (811003)


The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows 2000 Server
  • Microsoft Windows NT Server 4.0
  • Microsoft Windows NT Workstation 4.0
IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry

SYMPTOMS

Some User Datagram Protocol (UDP)-based programs may fail when the destination server is under a heavy load. If you use the netstat -s command to display per-protocol statistics, you may see a large number of Internet Protocol (IP) reassembly failures in the "IP Statistics" section of the output on the destination server. The following is an example of an "IP Statistics" section that indicates a large number of reassembly failures:
IP Statistics

Packets Received                           = 687750865
Received Header Errors                     = 0
Received Address Errors                    = 1
Datagrams Forwarded                        = 0
Unknown Protocols Received                 = 0
Received Packets Discarded                 = 0
Received Packets Delivered                 = 574556088
Output Requests                            = 596445524
Routing Discards                           = 0
Discarded Output Packets                   = 0
Output Packet No Route                     = 0
Reassembly Required                        = 118445100
Reassembly Successful                      = 5234431
Reassembly Failures                        = 107976783
Datagrams Successfully Fragmented          = 7642664
Datagrams Failing Fragmentation            = 0
Fragments Created                          = 15285321

CAUSE

This behavior may occur if any of the following conditions is true:
  • There is not enough memory to allocate a reassembly header structure.

    By default, in Microsoft Windows 2000 and Microsoft Windows NT 4.0 Service Pack 5 (SP5) or later, the TCP/IP stack permits a maximum of 100 IP reassembly headers.

    -or-
  • The IP stack times out the receipt of a segment that is required to complete the reassembly.

RESOLUTION

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk. To troubleshoot and resolve this behavior, verify that the MaximumReassemblyHeaders entry in the Windows registry of the Windows 2000 or Windows NT-based computer that receives the UDP messages is set to an appropriate value. You may require a setting that is greater than the default value of 100. To do so:
  1. Click Start, and then click Run.
  2. In the Open box, type regedit, and then click OK.
  3. Locate and click the following registry key:

    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

  4. In the right pane, double-click MaximumReassemblyHeaders.
  5. In the Value data box, type a number to set the maximum number of IP reassembly headers, and then click OK. You can type any whole number between 100 and 65535.
  6. Quit Registry Editor.

STATUS

This behavior is by design.

MORE INFORMATION

When a fragmented IP packet is reassembled, the TCP/IP stack looks for a reassembly header for the fragment to fill the fragment into the correct buffer. The stack creates a reassembly header if an existing reassembly header to which the fragment belongs cannot be found.

By default, the MaximumReassemblyHeaders registry entry, introduced in Windows 2000 and Windows NT 4.0 Service Pack 5 (SP5) or later, limits the number of IP reassembly headers that the TCP/IP stack allows to100. Fragmented packets that arrive when the limit is reached are silently dropped. To change the limit, set a different value for the MaximumReassemblyHeaders registry entry. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

252366 New Registry Key to Limit Number of Reassembly Headers

For more information about the netstat command and other TCP/IP utilities, visit the following Microsoft Web site:

http://www.microsoft.com/windows2000/en/server/help/sag_TCPIP_ovr_utilities.htm

Fragment reassembly failures is the number of failures that are detected by the IP reassembly algorithm. This is not necessarily a count of discarded IP fragments because some algorithms (for example, see Request for Comments 815) can lose track of the number of fragments by combining them as they are received.
Modification Type:MajorLast Reviewed:6/6/2003
Keywords:KB811003
©2002 Microsoft Corporation. All rights reserved.