detection.wiki

Microsoft-Windows-DNS-Server-Service › Event 408

Event ID 408 — The DNS server could not open socket for address Name.

Provider
Microsoft-Windows-DNS-Server-Service
Channel
DNS Server
Level
Error

Description

The DNS server could not open socket for address Name.

Message #

The DNS server could not open socket for address %1. 
Verify that this is a valid IP address for the server computer.  If it is NOT valid use the Interfaces dialog under Server Properties in the DNS Manager to remove it from the list of IP interfaces.  Then stop and restart the DNS server. (If this was the only IP interface on this machine and the DNS server may not have started as a result of this error.  In that case remove the DNS\Parameters\ ListenAddress value in the services section of the registry and restart.) 
 
If this is a valid IP address for this machine, make sure that no other application (e.g. another DNS server) is running that would attempt to use the DNS port. 
 
For more information, see "DNS server log reference" in the online Help.

Fields #

NameDescription
Name—
Data—
Binary—

Example Event #

{
  "system": {
    "provider": "Microsoft-Windows-DNS-Server-Service",
    "guid": "71A551F5-C893-4849-886B-B5EC8502641E",
    "event_source_name": "",
    "event_id": 408,
    "version": 0,
    "level": 2,
    "task": 0,
    "opcode": 0,
    "keywords": 9223372036855824384,
    "time_created": "2022-04-07T16:59:58.007504+00:00",
    "event_record_id": 35,
    "correlation": {},
    "execution": {
      "process_id": 2320,
      "thread_id": 4240
    },
    "channel": "DNS Server",
    "computer": "WIN-FPV0DSIC9O6.lab.local",
    "security": {
      "user_id": "S-1-5-18"
    }
  },
  "event_data": {
    "Name": "DNS_EVENT_OPEN_SOCKET_FOR_ADDRESS",
    "Data": {
      "Name": "param1",
      "Value": "169.254.142.31"
    },
    "Binary": ""
  },
  "message": ""
}

References #