Monitor unlimited number of servers
Filter log events
Create email and web-based reports

Direct access to Microsoft articles
Customized keywords for major search engines
Access to premium content

Event ID: 30022 Source: IPBOOTP

IPBOOTP was unable to receive an incoming message on the local interface with ip adress <ip address>. The data is the error code.
I received this error on an ISA 2006 server. After digging through EventID, I found that the problem appears to be related to RRAS. After checking RRAS on the ISA box, I noticed that it was configured for an IP address that was no longer in existence. I did not need the "relay" anyway, so I disabled it. However, I am sure that this problem would have been resolved if a proper DHCP server IP address would have been used.
I received this error when connecting to RRAS on a Small Business Server 2003. I was using Vista Business and created a VPN Client through "Set up a connection or Network". I was able to connect to the server through the VPN Connection, I could ping the server, I could even type in the IP address of the router and access the router through the VPN, but I could not access the shared folders.
The solution was to Enable NetBIOS on the server (TCP/IP Properties -> Advanced -> WINS Tab -> Enable NetBIOS over TCP/IP).

There is also a VPN Patch for Vista (no relation to NetBIOS), see ME930163.
Various newsgroup postings:
- "This problem is caused by misconfigured or corrupted network card drivers. Installing the latest driver fixed the problem."

- "Double-check the configuration of your DHCP Relay Agent (if it's installed). You might have it on the wrong interface. Also, when there is data in the error code, it sometimes helps to have the data."

- "Unless you are routing DHCP traffic from one subnet to another through the RRAS Router, then you probably don't really need the relay agent. Typically, this error appears in relationship to the use/misconfiguration of the DHCP Relay Agent. If all you are using the RRAS server for is a RAS server
for remote clients, or Dial-up connectivity for internal clients, then you don't need the DHCP Relay agent."

- "This error is related to DHCP Relay Agent, and normally not being configured
properly. Are you aware that you are running the Relay Agent, and if so do
you have it set up properly. Normally on a Router, broadcasts are not forwarded ( routers separate broadcast domains ) The Relay Agent puts a twist on this.  it will listen for a DHCP Discover broadcast on the interface specified, and unicast it to the server that is specified. The Relay Agent is in RRASMgmt.msc  If you are not using it, then you can go ahead and delete it."

Windows Event Log Analysis Splunk App

Build a great reporting interface using Splunk, one of the leaders in the Security Information and Event Management (SIEM) field, linking the collected Windows events to



Cisco ASA Log Analyzer Splunk App

Obtain enhanced visibility into Cisco ASA firewall logs using the free Firegen for Cisco ASA Splunk App. Take advantage of dashboards built to optimize the threat analysis process.