Lots of event 5504 through any forwarder I select

[Guest]

I am filling my Win2k logs with 5504 events (invalid packet from...)
I switched my forwarders and it didn't change the quantity much.
My web search shows that the event seems to be mostly tied to illegal
characters but my forwarder is my T1 provider so I would think that they
have thier stuff in line!
Next option was that NDR notifications were causing this. I didn't
understand how that was possible.

What is my next step in resolving this?

 

[Ace Fekay [MVP]]

In

I am filling my Win2k logs with 5504 events (invalid packet from...)
I switched my forwarders and it didn't change the quantity much.
My web search shows that the event seems to be mostly tied to illegal
characters but my forwarder is my T1 provider so I would think that
they have thier stuff in line!
Next option was that NDR notifications were causing this. I didn't
understand how that was possible.

What is my next step in resolving this?

Can you post the whole error message and post an ipconfig /all so we can
compare the data please?

My initial thought is your Active Directory DNS domain name or a host has an
illegal character in it that DNS does not accept.

Also, make sure if you have multiple DNS servers that they are not
forwarding to each other. They should forward to an ISP's, or if a child
domain in a delegation scenario, to forward to the parent, then the parent
forwards to the ISP.

If this wasn't helpful, please post additional infrastructure information
please.

--
Ace
Innovative IT Concepts, Inc
Willow Grove, PA

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSE+I, MCT, MVP
Microsoft MVP - Directory Services
Microsoft Certified Trainer

Having difficulty reading or finding responses to your post?
Instead of the website you're using, I suggest to use OEx (Outlook Express
or any other newsreader), and configure a news account, pointing to
news.microsoft.com. This is a direct link to the Microsoft Public
Newsgroups. It is FREE and requires NO ISP's Usenet account. OEx allows you
to easily find, track threads, cross-post, sort by date, poster's name,
watched threads or subject.
It's easy:

How to Configure OEx for Internet News
http://support.microsoft.com/?id=171164

Infinite Diversities in Infinite Combinations
Assimilation Imminent. Resistance is Futile
"Very funny Scotty. Now, beam down my clothes."

The only constant in life is change...

 

[Adrian Grigorof]

See some comments about this event here:


--

Regards,

Altair Technologies
www.altairtech.ca
www.eventid.net

 

[Adrian Grigorof]

See some comments about this event here:

http://www.eventid.net/display.asp?eventid=5504&eventno=642&source=DNS&phase=1

 

[Guest]

Hi Ace,
Working some where else now eh?

Here you are:

Event Type: Warning
Event Source: DNS
Event Category: None
Event ID: 5504
Date: 8/1/2006
Time: 2:10:20 AM
User: N/A
Computer: MYDOMAIN2
Description:
The DNS server encountered an invalid domain name in a packet from
208.53.147.132. The packet is rejected.

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WINNTVC\Profiles\mac>ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : mydomain2
Primary DNS Suffix . . . . . . . : mydomain.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.com

Ethernet adapter Local Lan:

Connection-specific DNS Suffix . : mydomain.com
Description . . . . . . . . . . . : D-Link DFE-530TX+ PCI Adapter
Physical Address. . . . . . . . . : 00-05-5D-CF-70-9F
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : xxx.xxx.xx.27
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : xxx.xxx.xx.19
DNS Servers . . . . . . . . . . . : xxx.xxx.xx.25
xxx.xxx.xx.222
Primary WINS Server . . . . . . . : xxx.xxx.xx.27
Secondary WINS Server . . . . . . : xxx.xxx.xx.222

There is a machine named "mydomain-bdc" in the mix. Perhaps the hyphen is
now illegal?
The IP in the error message changes all the time.

 

[Ace Fekay [MVP]]

In

Hi Ace,
Working some where else now eh?

Here you are:

Event Type: Warning
Event Source: DNS
Event Category: None
Event ID: 5504
Date: 8/1/2006
Time: 2:10:20 AM
User: N/A
Computer: MYDOMAIN2
Description:
The DNS server encountered an invalid domain name in a packet from
208.53.147.132. The packet is rejected.

Microsoft Windows 2000 [Version 5.00.2195]
(C) Copyright 1985-2000 Microsoft Corp.

C:\WINNTVC\Profiles\mac>ipconfig /all

Windows 2000 IP Configuration

Host Name . . . . . . . . . . . . : mydomain2
Primary DNS Suffix . . . . . . . : mydomain.com
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mydomain.com

Ethernet adapter Local Lan:

Connection-specific DNS Suffix . : mydomain.com
Description . . . . . . . . . . . : D-Link DFE-530TX+ PCI
Adapter Physical Address. . . . . . . . . : 00-05-5D-CF-70-9F
DHCP Enabled. . . . . . . . . . . : No
IP Address. . . . . . . . . . . . : xxx.xxx.xx.27
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : xxx.xxx.xx.19
DNS Servers . . . . . . . . . . . : xxx.xxx.xx.25
xxx.xxx.xx.222
Primary WINS Server . . . . . . . : xxx.xxx.xx.27
Secondary WINS Server . . . . . . : xxx.xxx.xx.222

There is a machine named "mydomain-bdc" in the mix. Perhaps the
hyphen is now illegal?
The IP in the error message changes all the time.

Is this Mike? Yep, working for a consulting company, but still training too.

The dash is legal. Underscore is not. What forwarders are you using? How is
your forwarders configured? (not to each other unless there's a child-parent
delegation).

Did you check out eventid.net's link that Adrian posted?

Ace