| Event Id | 20002 |
| Source | FTP Access Filter |
| Description | SOCKS filter: failed to bind IP address %1 for listening. Future SOCKS requests will be refused. |
| Event Information | According to Microsoft Cause: This alert occurs when the SOCKS configuration is changed or when Firewall service starts. The SOCKS filter assigns listeners to the networks that are served by SOCKS filter. Listener assignment may fail for one of the following reasons: Network stack failure.The port assigned for SOCKS is already used by another server or client on the ISA Server computer. Resolution: Since the SOCKS filter is in unpredictable state when this alert is generated, we recommend that you disable the SOCKS filter until the failure is understood. Use the error code and IP address specified in event description to help you determine the cause of the failure. The IP address also specifies the network and network adapter with the specific issue. The error code in the description is an error code of WinSOCK bind request. The default port for SOCKS is 1080, but other ports can be configured. Use ISA Server Management to determine the port configured for the SOCKS filter. One possible cause is that the specified port is already used by another service or application on the ISA Server computer (or even by ISA Server itself for outbound connection). In this case, use netstat.exe to determine which application is using the IP/port. Either disable or restart that service/application. |
| Reference Links | Event Id:20002 Source Id:FTP Access Filter |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.