| Event Id | 706 |
| Source | SNA Server |
| Description | Connection to client xxx.xxx.xxx.xxx:xxxx has been aborted due to too many (100) pending writes. |
| Event Information | According to Microsoft : CAUSE This problem can occur if the computer running Windows NT Server has the TCP/IP transport bound to multiple network interface cards (NICs), which are connected to different (disparate) networks. When trying to send a message, if TCP/IP detects a problem with the route between the server and the client, the transport is designed to use a secondary NIC to send the message. This works fine as long as the secondary NIC is connected to a network with a working route to the client. But if the secondary NIC is on a disparate network, the server message will not reach the client, causing the TCP/IP connection to timeout and drop. RESOLUTION Disable the TCP/IP protocol binding from the adapters where it is not needed. For example, many SNA Servers have one or more Ethernet adapters to support TCP/IP client connections, and one or more Token Ring adapters to support DLC connections between the server and a mainframe or AS/400. In this scenario, because TCP/IP is not needed on the Token Ring adapter, it should be disabled from this adapter. More Information : When Microsoft Network Monitor is installed on the SNA Server, and network traffic is captured on both NICs, you can observe the server receiving client traffic over one card and responding back over the other card. The TCP/IP stack switches to the alternate card when it believes the first card is busy. |
| Reference Links | TCP/IP clients lose connections to multihomed SNA Server, Event 706 logged |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.