SqlServer 报错 The login packet used to open the connection is structurally invalid

大早上SqlServer收到一堆告警

The login packet used to open the connection is structurally invalid; the connection has been closed. Please contact the vendor of the client library. [CLIENT: 192.168.7.8]

网上搜索了下报错含义是：发起login请求的客户端 发送的packet不是sqlserver预期的packet。

• 可能packet的结构在网络传输过程中被损坏了
• 可能数据库被扫描或者暴力攻击了

去查报错里client的ip，联系对应服务器的负责人，发现是安全部门在做扫描，不是黑客攻击，虚惊一场。

根据观察如果只是扫描不做别的操作，服务器配置也还行的话，对数据库服务不会有明显影响。

2021.3.5 补充：以下报错也可能是端口扫描导致的报错，建议检查ip用途并与安全同事确认

Length specified in network packet payload did not match number of bytes read; the connection has been closed. Please contact the vendor of the client library. [CLIENT: 192.168.7.8]

2021.5.26补充：以下报错也可能是端口扫描导致的报错，由于扫描的是database mirroring端口，而连接请求又不是合法的镜像连接，SqlServer会记录报错到日志中

eventlog:An error occurred in a Service Broker/Database Mirroring transport connection endpoint, Error: 8474, State: 11. (Near endpoint role: Target, far endpoint address: '')

参考

Error: 17836, Severity: 20, State: 1

MSSQLSERVER_17832 - SQL Server | Microsoft Learn

https://stackoverflow.com/questions/47698134/an-error-occurred-in-a-sql-server-service-broker-database-mirroring-transport-co
https://docs.microsoft.com/en-us/answers/questions/227886/always-on-instance-service-brokerdatabase-mirrorin.html
https://www.sqlservercentral.com/forums/topic/error-8474-state-11