NTLM Connection Timeout due to Domain Controller

NTLM Connection Timeout due to Domain Controller

The Players

IP Address	Computer Role
10.10.10.1	DC01
10.10.10.2	DC02
10.10.10.3	Client
10.10.10.4	SQL Server virtual IP address
10.10.10.5	SQL Server physical IP address

Symptom

Intermittently, the client application would get a login timeout error:

[Microsoft][SQL Server Native Client 11.0]Login timeout expired

Data Collection

We captured a network trace and ran it through the SQL Network Analyzer program.

SQLNA Report Analysis

Trace was probably taken on this IP address: 10.10.10.4, MAC Addr 001DD8A7211B, (80%)
Trace was probably taken on this IP address: 10.10.10.5, MAC Addr 001DD8A7211B, (20%)

The network trace was taken on a machine with two IP addresses and the MAC address matches. The first address matches the SQL Servre IP address:

    IP Address   HostName       Port  ServerPipe  Version      Files  Clients  Conversations  Kerb Conv  NTLM Conv  MARS Conv  non-TLS 1.2 Conv  Redirected Conv  Frames       Bytes  Resets  Retransmits  IsClustered
    -----------  -------------  ----  ----------  -----------  -----  -------  -------------  ---------  ---------  ---------  ----------------  ---------------  ------  ----------  ------  -----------  -----------
    10.10.10.4   SQLPROD01\v01  1433              13.0.17.122      0        6             77          0         37          0                 0                0  114366  95,275,362       6          354             

The server is a named instance on port 1433; most likely SQL Server is clustered and 10.10.10.4 is the cluster virtual IP address. Many of the conversations are using NTLM to authenticate the user.

Network Trace Exploration

Conclusion