| Event Id | 23 |
| Source | SNA Server |
| Description | Connection <name> using Link Service <SNADLCx> failed Qualifier = 00AC |
| Event Information | On Windows NT, when you run an application that uses Dlc.sys to communicate
to a remote system using DLC/802.2 over Token Ring, Ethernet, or FDDI, Windows
NT may erroneously send a frame reject (FRMR) and drop the connection. If SNA Server is being used, this will cause an SNA Server connection failure with the above event in Windows NT application event log, along with event id 228, 238 from the same source. Cause: Windows NT Dlc.sys was incorrectly handling acknowledgements for I-frames when the t1 send timer has expired on a DLC connection. In the above trace of LLC frames, SNA Server sends a window of I-frames to the host from frame 1-8, with the N(S) counter incremented from 0x07-0x0E. The host then replies with a N(R) of 0x07, causing SNA Server to reset its N(S) counter and begin resending the I-frames again. However, SNA Server then receives host acknowledgments for later frames (sending N(R) = 0x08 and 0x09 in frame 12 and 13 above). Because the Windows NT DLC driver detects that the N(S) is now 0x07, DLC sends a frame reject (FRMR) to the host, causing the connection to drop. Resolution: It is possible to work around this problem by increasing the DLC t1 timer so that it will never expire. If SNA Server is being used, the t1 timer can be increased to a maximum value of 10 within the connection properties dialog or folder within SNA Server 2.x Admin or SNA Server 3.x Manager. An update to Dlc.sys is available to correct this problem. The Dlc.sys driver now keeps track of a new maximum N(S) counter sent value and validates I-frame acknowledgements based on this value. |
| Reference Links | Dlc.sys
Sends Frame Reject (FRMR) and Drops Connection External Clocking and Sangoma S514/S508 SDLC PCI Adapter Driver |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.