| Event Id | 1001 |
| Source | CCM |
| Description | Portmapper errors fill the NT event log (Event ID 1001) |
| Event Information | According to Symantec: Solution: by default every error encountered by the Portmapper service will be written to the event log. The event ID 1001 is a Windows API error return code: Recursion too deep; the stack overflowed. There are different reasons for such an error the most frequent one for the Portmapper is Network congestion. The Portmapper answers every client request immediately after receiving one. If many client requests are received and the process of producing a response is hold in a holding pattern or the answer gets lost or times out due to any reason, the client does not get the package send out by the server, which will oblige the client to resend another request which will be queue again and may amplify the congestion in the Portmapper buffer. This will therefore also amplify the phenomenon and can lead to a switch temporarily blocking a port further provoking more congestion. A condition like this can be observed only through initiating a network trace over a longer time period. A good idea also is to consult the log files of the switches of your network. Those files will already indicate if a unusual condition arises frequently. The statistics usually log Error conditions. In that case the switches and corresponding Windows Data transfer services have to be coordinated and fine-tuned accordingly. Unfortunately there is no universal Solution as the individual solution depends very much on factors though as: 1. Network topolog 2. Protocols in use 3. Size and Layout of the network itself 4. Amount of traffic of Packages in general 5. Package Windows and Package sizes 6. Broadcast issued |
| Reference Links | Portmapper errors filling the Server event log (Event ID 1001) |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.