Microsoft support have a response that I try to translate to you:
First of all they don't find any problem on LDAP traffic.
They found a different response from SQL query, coming from a different software configuration or from a compatibility problem.
On Windows 2003 server (the one that go properly) we can found follow frame:
Frame: Number = 743, Captured Frame Length = 256, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-19-99-73-0E-44],SourceAddress:[00-15-5D-28-D6-00]
+ Ipv4: Src = 10.bbb.ccc.ddd, Dest = 10.bbb.ccc.eee, Next Protocol = TCP, Packet ID = 23927, Total IP Length = 242
+ Tcp: Flags=...AP..., SrcPort=1322, DstPort=1433, PayloadLen=202, Seq=4229982682 - 4229982884, Ack=4200885472, Win=64990 (scale factor 0x0) = 64990
- Tds: SQLBatch, Version = 7.3 (0x730a0003), SPID = 0, PacketID = 1, Flags=...AP..., SrcPort=1322, DstPort=1433, PayloadLen=202, Seq=4229982682 - 4229982884, Ack=4200885472, Win=64990
+ PacketHeader: SPID = 0, Size = 202, PacketID = 1, Window = 0
- SqlBatchData:
+ AllHeadersData: Head Type = MARS Header
SQLText: update tblComputers set lastknownip = '10.bbb.ccc.ddd' where computername = 'BBBBB'while on Windows 2008 server (the other going bad) we found:
Frame: Number = 21424, Captured Frame Length = 238, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-19-99-73-0E-44],SourceAddress:[00-19-99-73-0E-20]
+ Ipv4: Src = 10.bbb.ccc.fff, Dest = 10.bbb.ccc.eee, Next Protocol = TCP, Packet ID = 6236, Total IP Length = 224
+ Tcp: [Bad CheckSum]Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=184, Seq=3200425111 - 3200425295, Ack=291988679, Win=511 (scale factor 0x8) = 130816
- Tds: SQLBatch, Version = 7.3 (0x730a0003), SPID = 0, PacketID = 1, Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=184, Seq=3200425111 - 3200425295, Ack=291988679, Win=130816
+ PacketHeader: SPID = 0, Size = 184, PacketID = 1, Window = 0
- SqlBatchData:
+ AllHeadersData: Head Type = MARS Header
SQLText: update tblComputers set lastknownip = '::1' where computername = 'AAAAA'probably because the SQL update function has IPv6 as default but
IPv6 is disable and this must remain disable because my network is on IPv4, yet.
Because it doesn't find any IP, it try with a proxy query
Frame: Number = 24345, Captured Frame Length = 148, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-19-99-73-0E-44],SourceAddress:[00-19-99-73-0E-20]
+ Ipv4: Src = 10.bbb.ccc.fff, Dest = 10.bbb.ccc.eee, Next Protocol = TCP, Packet ID = 6321, Total IP Length = 134
+ Tcp: [Bad CheckSum]Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=94, Seq=3200429043 - 3200429137, Ack=291992828, Win=513 (scale factor 0x8) = 131328
- Tds: SQLBatch, Version = 7.3 (0x730a0003), SPID = 0, PacketID = 1, Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=94, Seq=3200429043 - 3200429137, Ack=291992828, Win=131328
+ PacketHeader: SPID = 0, Size = 94, PacketID = 1, Window = 0
- SqlBatchData:
+ AllHeadersData: Head Type = MARS Header
SQLText: select * from tblProxy where 1=0
Frame: Number = 25594, Captured Frame Length = 238, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-19-99-73-0E-44],SourceAddress:[00-19-99-73-0E-20]
+ Ipv4: Src = 10.bbb.ccc.fff, Dest = 10.bbb.ccc.eee, Next Protocol = TCP, Packet ID = 6327, Total IP Length = 224
+ Tcp: [Bad CheckSum]Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=184, Seq=3200429137 - 3200429321, Ack=291993028, Win=512 (scale factor 0x8) = 131072
- Tds: SQLBatch, Version = 7.3 (0x730a0003), SPID = 0, PacketID = 1, Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=184, Seq=3200429137 - 3200429321, Ack=291993028, Win=131072
+ PacketHeader: SPID = 0, Size = 184, PacketID = 1, Window = 0
- SqlBatchData:
+ AllHeadersData: Head Type = MARS Header
SQLText: delete from tblerrors where computername = 'AAAAA' and cfgname = 'PROXY'It find nothing and report follow error
Frame: Number = 25637, Captured Frame Length = 384, MediaType = ETHERNET
+ Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-19-99-73-0E-44],SourceAddress:[00-19-99-73-0E-20]
+ Ipv4: Src = 10.bbb.ccc.fff, Dest = 10.bbb.ccc.eee, Next Protocol = TCP, Packet ID = 6328, Total IP Length = 370
+ Tcp: [Bad CheckSum]Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=330, Seq=3200429321 - 3200429651, Ack=291993049, Win=512 (scale factor 0x8) = 131072
- Tds: SQLBatch, Version = 7.3 (0x730a0003), SPID = 0, PacketID = 1, Flags=...AP..., SrcPort=53598, DstPort=1433, PayloadLen=330, Seq=3200429321 - 3200429651, Ack=291993049, Win=131072
+ PacketHeader: SPID = 0, Size = 330, PacketID = 1, Window = 0
- SqlBatchData:
+ AllHeadersData: Head Type = MARS Header
SQLText: INSERT INTO tblerrors (Computername, CFGname, Errortext) SELECT 'AAAAA' AS thecomputer, 'PROXY' AS thesection, 'Classe non valida ' as themessageNow application is in error and it ask LDAP to close by Abandon Request option
121506 11:01:48.5108990 206.5418990 Lansweeperservice.exe 10.bbb.ccc.fff CCCCC.DDDDD.EEEEE.FF LDAP LDAP: Abandon Request, MessageID: 375, AbandonMessageID: 352 {LDAP:554, TCP:553, IPv4:552}RFC link6.9. Abandon Operation
The function of the Abandon Operation is to allow a client to request
that the server abandon an outstanding operation. The Abandon
Request is defined as follows:
AbandonRequest ::= [APPLICATION 16] MessageID
There is no response defined in the Abandon Operation. Upon
transmission of an Abandon Operation, a client may expect that the
operation identityfied by the Message ID in the Abandon Request has
been abandoned. In the event that a server receives an Abandon
Request on a Search Operation in the midst of transmitting responses
to that search, that server should cease transmitting responses to
the abandoned search immediately.Microsoft says that they can't do anything else but, probably, you can.
Just remember that my network is a Windows 2003 network (all DC are Windows 2003).
I hope you can find a solution.