| Event Id | 5501 |
| Source | DNS |
| Description | DNS Server encountered bad packet from IP Address. Packet processing leads beyond packet length. |
| Event Information | If you have the Domain Name System (DNS) service installed on your computer, 5000, 5501, 9999 event error messages may appear in the event log. CAUSE: The occurrence of these event error messages does not necessarily indicate a problem with the DNS service. Event 5501 indicates that after sending a recursive query on behalf of a client, DNS received a response with a fragmented flat set indicating that the answer did not fit in one packet and that there is more data to follow. In versions of Windows NT 4.0 earlier than Service Pack 4 (SP4), DNS incorrectly discards the packet. Windows 2000 behaves correctly in this case. Event 5000 indicates that DNS is not going to continue logging the warning events that are filling up the event log. Event 9999 indicates the number of events DNS blocked from being logged in Event Viewer, and then the logging of those events starts again. RESOLUTION: To resolve this problem in Windows NT 4.0, install SP4 or later. To adjust the level of DNS logging in Event Viewer, use the registry key listed below. NOTE: In Windows NT 4.0, SP4 or later is required for this key to work. Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DNS\Parameters Value: EventLogLevel Type: REG_DWORD Data values: 0 - Event logging disabled 1 - Only error events 2 - Warning and error events 4 - Information, warning, and error events For example, if the data value is set to 1, no warning or information events are logged. |
| Reference Links | DNS Events 5501, 5000, and 9999 Fill Up the Event Log |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.