Event 30803, SMBClient; Windows Server 2016 Nano, Failover Cluster, Storage Spaces Direct; Network Routing Bug?

_{Monday, June 12, 2017 12:09 PM | 1 vote}

We're seeing 32 "30803" events every 10 minutes each on four Windows 2016 Nano servers in a failover cluster with storage spaces direct.

The machines are configured with five 10G NICs (1x management, 2x storage/cluster, 2x Hyper-V). The storage/cluster NICs are running in a dedicated VLAN on different 10.10... subnets, the management NIC is also running in a dedicated VLAN with a dedicated subnet, with no routing between the storage/cluster and management networks. Only the management adapter has a gateway configured. netstat show multiple established connection within the different storage/cluster networks between all servers and in general the cluster works fine.

Every time a "30803" event is logged, I’m seeing multiple corresponding failed connection attempts in a network trace from a management IP to a storage IP.

With other words, failed connection attempts from the management NIC via the gateway to a storage/cluster NIC in a different subnet and VLAN. Is this a Bug? Correctly established connections from storage/cluster NICs to corresponding storage/cluster NICs of different machines can also be observed.

Running "Find-NetRoute -RemoteIPAddress 10.10. …" gives a route that uses the correct storage/cluster adapter. I’ve checked the outputs of "ipconfig /all", "route PRINT" and "arp -a" and all are as expected, so not a trivial network misconfig - I guess. With the exception, that I don’t understand the role of the "Microsoft Failover Cluster Virtual Adapter" with a self-assigned IP address.

Since these connection attempts via the wrong interface are creating 10,000 alerts per day in our central firewall monitoring system, I unfortunately cannot just ignore this error,

If you are getting the "30803" event as well, I would appreciate it if you could run a network trace and lookout for failed connections. For the network trace I’m using:

New-NetEventSession -Name 'foo'

Add-NetEventPacketCaptureProvider -SessionName 'foo' -Level 4 -CaptureType Physical

Start-NetEventSession 'foo'

(Get-NetEventSession).LocalFilePath

Stop-NetEventSession 'foo'

Remove-NetEventSession 'foo'

Use "Microsoft Message Analyzer" to look at the created etl-file.

Im creating this new thread, since a related thread seems stale: https://social.technet.microsoft.com/Forums/de-DE/ef3e9243-5a22-4020-97a0-219595666cd7/smbclient-errors

_{Thursday, June 15, 2017 5:41 AM}

Hi Hauke Hund,

I noticed that someone replied in the other post that this issue may due to SMB multi-channel in Server 2016. And as far as I'm concerned, it may be the case, while if you need to look into the issue deeply, I would suggest you open a case with MS, so that more research will be done on your issue.

https://support.microsoft.com/en-us/gp/support-options-for-business

Best Regards,

Anne

Please remember to mark the replies as answers if they help.
If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com.

_{Monday, June 24, 2019 9:27 PM}

Hi Anne,

Can you paste the solution in this post as the below link is not opening 

https://support.microsoft.com/en-us/gp/support-options-for-business

Regards 

MAhesh

Mahesh P N Consultant