NLB cluster []: Timer starvation has been detected. This might be due to a denial of service attack or a very high server load. During this period, some connections might fail. If this problem recurs frequently, analyze the threat and take appropriate measures and/or add more servers to the cluster. Event ID 105 on a server running Windows 2008 R2

2017-12-08T11:59:38+00:00 May 6th, 2011|Windows|

On a Windows 2008 R2 server running TMG 2010 and part of a NLB cluster, we began seeing the error below appear in the System Log:

“NLB cluster []: Timer starvation has been detected. This might be due to a denial of service attack or a very high server load. During this period, some connections might fail. If this problem recurs frequently, analyze the threat and take appropriate measures and/or add more servers to the cluster. An informational event log entry will be logged when the attack has subsided.” Event 105, NLB

When researching the event we found the following Microsoft article which states TCP Chimney Offload does not work together with Network Load Balancing:

http://support.microsoft.com/kb/951037

In Windows 2008 R2, TCP Chimney Offload is set to automatic by default. To disable it run the following:

netsh int tcp set global chimney=disabled