How to fix Error 8407 on Windows Server 2025 / Windows 11

by

Troubleshooting Guide: SQL Server Error 8407 – Invalid Header Fields in Service Broker Message

Why This Error Happens

Error 8407 occurs when the Service Broker endpoint receives a TDS (Tabular Data Stream) message whose header does not conform to the expected Service Broker protocol structure. This typically happens because a non-Service Broker application or process (such as a port scanner, load balancer health check, or misconfigured client) is connecting directly to the Service Broker TCP endpoint. It can also result from network-level packet corruption, a mismatched SQL Server version handshake, or a firewall/proxy altering packet contents in transit.

Step-by-Step Resolution Guide

Step 1: Identify What Is Connecting to the Service Broker Port

  • Open SQL Server Configuration Manager and note the configured Service Broker endpoint port (commonly 4022).
  • Run netstat -ano | findstr <port> in an elevated Command Prompt on the Windows Server 2025 host to list active connections.
  • Cross-reference the PIDs returned against Task Manager or tasklist /FI "PID eq <pid>" to identify the offending process.
  • Check SQL Server error logs (Program Files\Microsoft SQL Server\MSSQL17.MSSQLSERVER\MSSQL\Log\ERRORLOG) for repeated 8407 entries and timestamps to correlate with the connection attempts.

Step 2: Restrict and Validate Endpoint Access

  • Open SQL Server Management Studio (SSMS) and run SELECT * FROM sys.service_broker_endpoints; to confirm the endpoint state is STARTED and the port matches expectations.
  • Use SELECT * FROM sys.dm_broker_connections; to view active Broker connections and spot any unexpected source IP addresses.
  • Create or update a Windows Firewall rule to restrict inbound traffic on the Service Broker port to only trusted SQL Server instances:
  • New-NetFirewallRule -DisplayName "SQLBroker-Restricted" -Direction Inbound -LocalPort 4022 -Protocol TCP -RemoteAddress <TrustedServerIP> -Action Allow
  • Remove any overly permissive “Any-Any” firewall rules previously applied to port 4022.

Step 3: Rebuild or Reset the Service Broker Endpoint

  • In SSMS, drop and recreate the endpoint if corruption is suspected:
  • DROP ENDPOINT [ServiceBrokerEndpoint];
  • CREATE ENDPOINT [ServiceBrokerEndpoint] STATE = STARTED AS TCP (LISTENER_PORT = 4022) FOR SERVICE_BROKER (AUTHENTICATION = WINDOWS, ENCRYPTION = REQUIRED);
  • Restart the SQL Server service via services.msc or Restart-Service MSSQLSERVER to apply the new endpoint configuration cleanly.
  • Confirm no legacy load balancer or proxy (e.g., HAProxy, F5) is health-checking port 4022 with plain TCP pings instead of actual TDS packets.

Step 4: Check for Network-Level Interference

  • Verify Jumbo Frames, MTU settings, and NIC offloading features on the Windows Server 2025 host are not fragmenting or corrupting TDS packets:
  • Get-NetAdapterAdvancedProperty -Name "Ethernet" | Where-Object {$_.DisplayName -like "*Offload*"}
  • Temporarily disable TCP Chimney Offload or Receive Side Scaling (RSS) if packet corruption is suspected at the NIC driver level.
  • If using a VPN or VLAN tunnel between distributed Broker instances, confirm MTU consistency end-to-end to prevent silent packet truncation.

Alternative or Verification Steps

  • After applying fixes, run SELECT * FROM sys.transmission_queue; on both sending and receiving databases to confirm no messages are stuck with transmission errors referencing 8407.
  • If the error persists, enable Service Broker trace flags (such as 9950) temporarily and capture a network trace with Wireshark filtered on the Broker port to pinpoint the exact malformed packet source before re-engaging application or network teams.