| Event Id | 228 |
| Source | SNA Server |
| Description | FRMR sent (0x03) = invalid or unsupported command/response received |
| Event Information | According to Microsoft: CAUSE: Windows NT Dlc.sys was incorrectly handling acknowledgements for I-frames when the t1 send timer has expired on a DLC connection. In the above trace of LLC frames, SNA Server sends a window of I-frames to the host from frame 1-8, with the N(S) counter incremented from 0x07-0x0E. The host then replies with a N(R) of 0x07, causing SNA Server to reset its N(S) counter and begin resending the I-frames again. However, SNA Server then receives host acknowledgments for later frames (sending N(R) = 0x08 and 0x09 in frame 12 and 13 above). Because the Windows NT DLC driver detects that the N(S) is now 0x07, DLC sends a frame reject (FRMR) to the host, causing the connection to drop. RESOLUTION : It is possible to work around this problem by increasing the DLC t1 timer so that it will never expire. If SNA Server is being used, the t1 timer can be increased to a maximum value of 10 within the connection properties dialog or folder within SNA Server 2.x Admin or SNA Server 3.x Manager. An update to Dlc.sys is available to correct this problem. The Dlc.sys driver now keeps track of a new maximum N(S) counter sent value and validates I-frame acknowledgements based on this value |
| Reference Links | Dlc.sys Sends Frame Reject (FRMR) and Drops Connection |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.