SQL SERVER – FIX: Error 17836: Length Specified in Network Packet Payload Did Not Match Number of Bytes Read; the Connection has been Closed

One of my clients reported that they are seeing below error in SQL Server ERRORLOG. He noticed a strange error of the network packet.

2018-08-06 07:09:41.363 Logon Error: 17836, Severity: 20, State: 17.
2018-08-06 07:09:41.363 Logon Length specified in network packet payload did not match number of bytes read; the connection has been closed. Please contact the vendor of the client library. [CLIENT: xx.xx.xx.xx]

Based on my understanding the error message means that there is some process trying to connect at SQL port but it’s not a valid SQL related activity.

WORKAROUND/SOLUTION

You can easily reproduce this error by doing Telnet on SQL Server IP and Port locally on the SQL Server machine. This also means that if SQL receives an invalid packet/data on the port where SQL is listening and then SQL would say –

Hey! This is not a login request or a query request and I don’t know how to process it. Let me report it to ERRORLOG.

Here are few more causes based on my search on the internet:

1. Network team doing Port Scanning
2. Sometimes Antivirus programs do check the port.
3. MSSQL server is under a DDoS

You may want to look at the error message and check the IP of the machine and see what that is.

Have you encountered such messages in ERRORLOG? What was the cause which you found? If its very frequent error, then you may want to restrict that IP.

Reference: Pinal Dave (https://blog.SQLAuthority.com)

First appeared on SQL SERVER – FIX: Error 17836: Length Specified in Network Packet Payload Did Not Match Number of Bytes Read; the Connection has been Closed