Event ID - 352

Event Id352
SourceWMServer
DescriptionThe number of negative acknowledgements (NACKs) received by the Windows Media server exceeded the NACK warning limit. The server received %1 NACK requests in %2 milliseconds.
Event InformationAccording to Microsoft :
Cause :
This event is logged when the number of negative acknowledgements (NACKs) received by the Windows Media server exceeded the NACK warning limit.
Resolution :
Protect against denial-of-service attacks
Ordinarily, negative acknowledgement (NACK) requests occur when the server or network is overloaded and packets cannot be sent through the User Datagram Protocol (UDP) reliably. Clients must request that packets be resent. This NACK warning limit in Windows Media Services is set so that only a very high number of NACK requests, a condition that indicates a denial-of-service attack, cause this issue.
First, confirm that bandwidth bottleneck issues on the network are not causing the problem.
If the network does not appear to be at fault, review the server log files to determine whether clients are instigating a denial-of-service attack by flooding the network with content requests so that the server cannot respond adequately to legitimate client requests for content. If your system is subjected to a denial-of-service attack, the log files can help you determine which clients are being used in the attack.
Note : A streaming media network that has been correctly planned and configured will improve response time, data throughput, content availability, and reduce the data error rate.
Verify :
To verify that the unicast stream can be delivered to clients, test the stream by using Windows Media Player:
  1. If you want to test the stream by using Windows Media Player on the computer that is running Windows Media Services, you must install Desktop Experience.
  2. On the Windows Media server, open Windows Media Services. To open Windows Media Services, click Start, point to Administrative Tools, and then click Windows Media Services.
  3. In the console tree, click the publishing point that hosts the stream that you want to test.
  4. In the details pane, click the Announce tab, and then, in Connect to a unicast stream, note the value of the URL that a client can use to access the content.
  5. Start Windows Media Player on a computer that can access the stream, and enter the URL that you noted in the previous step.
  6. Using the Player controls, test the control functionality of the content stream. Broadcast streams can use the Start and Stop commands. On-demand streams can use the Start, Stop, and Pause commands, and the Seek bar.
  7. Test all the available streaming protocols. A unicast stream will try to connect by using the MMS protocol, but will switch to the RTSP protocol if network conditions or the Player version requires it. The HTTP protocol is not active unless the WMS HTTP Server Control Protocol plug-in is enabled. For more information, see About data transfer protocols.
  8. Allow the stream to play for a representative period of time and check that the stream quality is sufficient for the type of content and the capabilities of the equipment.
Note : If some members of your expected audience will access the stream from outside your network firewall, your testing scenario should include that condition.
Reference LinksEvent ID 352 from Source WMServer

Catch threats immediately

We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.

See what we caught

Did this information help you to resolve the problem?

Yes: My problem was resolved.
No: The information was not helpful / Partially helpful.
 Refresh