Potential Black Hole Routers

[This topic is intended to address a specific issue called out by the Exchange Server Analyzer Tool. You should apply it only to systems that have had the Exchange Server Analyzer Tool run against them and are experiencing that specific issue. The Exchange Server Analyzer Tool, available as a free download, remotely collects configuration data from each server in the topology and automatically analyzes the data. The resulting report details important configuration issues, potential problems, and nondefault product settings. By following these recommendations, you can achieve better performance, scalability, reliability, and uptime. For more information about the tool or to download the latest versions, see "Microsoft Exchange Analyzers" at https://go.microsoft.com/fwlink/?linkid=34707.]  

Topic Last Modified: 2006-05-17

The Microsoft® Exchange Server Analyzer Tool queries the Win32_PingStatus Microsoft Windows® Management Instrumentation (WMI) class using various, specific BufferSize and NoFragmentation setting values to determine whether black hole routers might be present in the WAN environment.

The Exchange Server Analyzer displays an error, if the following conditions are true:

• PING with a smaller BufferSize and NoFragmentation = True is successful

• PING with a larger BufferSize and NoFragmentation = True times out

• PING with a larger BufferSize and NoFragmentation = False is successful but the reply BufferSize size differs from the sent BufferSize.

This error indicates the possible presence of one or more black hole routers on the wide area network (WAN).

On a TCP/IP WAN, communication over some routes may fail if the following conditions are true:

• Intermediate network segments have packet sizes smaller than the communicating hosts

• Routers do not send appropriate ICMP responses to this condition.

Alternatively, the firewall on the path may drop such responses. A router that causes this condition is sometimes known as a black hole router.

The presence of a black hole router can cause a variety of errors that do not occur if a program connects to a computer on a local subnet. The behavior may seem intermittent, but you will find that the behavior can be reproduced, for example, by having a client read a large file that is sent from a remote host.

For more information, follow the guidance in Microsoft Knowledge Base article 314825, "How to Troubleshoot Black Hole Router Issues" (https://go.microsoft.com/fwlink/?linkid=3052&kbid=314825).