JSI Tip 1489. Many DNS Events 5501, 5000, and 9999?

If DNS is installed on your Windows NT Server and you receive:

Event 5501
Source: DNS
Description: DNS Server encountered bad packet from IP Address. Packet processing leads beyond packet length.

Event 5000
Source: DNS
Description: DNS Server is logging numerous run-time events. This is usually caused by the reception of bad or unexpected packets, or from problems with or excessive replication traffic. See previous event log entries for information about bad packet source. Now suppressing event logging for these events.

Event 9999
Source: DNS
Description: DNS Server has encountered numerous run-time events. These are usually caused by the reception of bad or unexpected packets, or from problems with or excessive replication traffic. The data is the number of suppressed events encountered in the last 15-minute interval.

you may or may not have a problem.

Event 5501 indicates that after sending a recursive query on behalf of a client, DNS received a response with a fragmented flat set indicating that the answer did not fit in one packet and that there is more data to follow. In versions of Windows NT 4.0 earlier than Service Pack 4 (SP4), DNS incorrectly discards the packet.

Event 5000 indicates that DNS is not going to continue logging the warning events that are filling up the event log.

Event 9999 indicates the number of events DNS blocked from being logged in Event Viewer, and then logging starts again.

To resolve the problem, install SP4 or latter. Then adjust the DNS logging level, using Regedt32 to navigate to:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesDNSParameters

Edit or Add Value name EventLogLevel, a type REG_DWORD, and set the data value per the following table:

Shutdown and Restart Windows NT.