Hi everyone, Tyler Franke here again with another troubleshooting tip for you. When you’re in the System Center Configuration Manager 2007 administrative console and trying to download software updates to an update list, it may fail with an error stating the following:
The requested header could not be found
Furthermore, if you leverage the PatchDownloader.log you will find an entry similar to the following:
Downloading content for ContentID = 27377, FileName = windowsserver2003.windowsxp-kb2621440-x64-enu.exe. Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1337928 (0x146A48)
HttpQueryInfo HTTP_QUERY_CONTENT_LENGTH failed 12150 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1335744 (0x1461C0)
Download http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe to C:\Users\SJSIMM~1\AppData\Local\Temp\2\CAB161.tmp returns 12150 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1335744 (0x1461C0)
ERROR: DownloadContentFiles() failed with hr=0x80072f76 Software Updates Patch Downloader 3/22/2012 3:34:37 PM 1337928 (0x146A48)
Cause
A content filtering device was closing the session. Notice in the Netmon frames below that the connection is initiated by the site server with IPv4 address 192.168.1.100, however the device with IPv4 address 192.168.1.200 is where the traffic is being sent first to try to actually go out and initiate the download. You’ll notice that as part of the HTTP connection initiated by the site server we have to keep the session alive (i.e. ProxyConnection: Keep-Alive) however the device with IPv4 address 192.168.1.200 essentially deconstructs the packet and then closes the connection (i.e. ProxyConnection: close) therefore ending any chances the site server had of downloading the software updates.
The items/lines that I've bolded in the Netmon frames below are the most noteworthy and demonstrate the content filtering device closing the connection.
Frame: Number = 28900, Captured Frame Length = 361, MediaType = ETHERNET
- Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[06-7A-8B-9C-10-11],SourceAddress:[00-1A-2B-3C-04-05]
- DestinationAddress: BROADCOM CORPORATION BCE088 [06-7A-8B-9C-10-11]
Rsv: (000000..)
UL: (......0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
+ SourceAddress: Hewlett Packard D89A3B [00-1A-2B-3C-04-05]
EthernetType: Internet IP (IPv4), 2048(0x800)
- Ipv4: Src = 192.168.1.100, Dest = 192.168.1.200, Next Protocol = TCP, Packet ID = 17864, Total IP Length = 347
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 347 (0x15B)
Identification: 17864 (0x45C8)
+ FragmentFlags: 16384 (0x4000)
TimeToLive: 128 (0x80)
NextProtocol: TCP, 6(0x6)
Checksum: 0 (0x0)
SourceAddress: 192.168.1.100
DestinationAddress: 192.168.1.200
- Tcp: Flags=...AP..., SrcPort=50355, DstPort=HTTP Alternate(8080), PayloadLen=307, Seq=1611337238 - 1611337545, Ack=2596688289, Win=16425 (scale factor 0x2) = 65700
SrcPort: 50355
DstPort: HTTP Alternate(8080)
SequenceNumber: 1611337238 (0x600B0E16)
AcknowledgementNumber: 2596688289 (0x9AC651A1)
+ DataOffset: 80 (0x50)
+ Flags: ...AP...
Window: 16425 (scale factor 0x2) = 65700
Checksum: 0x2251, Disregarded
UrgentPointer: 0 (0x0)
TCPPayload: SourcePort = 50355, DestinationPort = 8080
- Http: Request, GET http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsx
Command: GET
- URI: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe
Location: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsxp-kb2621440-x64-enu_337d75494557b29c69230ca182054ad65489847b.exe
ProtocolVersion: HTTP/1.1
Accept: */*
UserAgent: Download Progress
Host: download.windowsupdate.com
ProxyConnection: Keep-Alive
Pragma: no-cache
HeaderEnd: CRLF
Frame: Number = 28969, Captured Frame Length = 364, MediaType = ETHERNET
- Ethernet: Etype = Internet IP (IPv4),DestinationAddress:[00-1A-2B-3C-04-05],SourceAddress:[06-7A-8B-9C-10-11]
- DestinationAddress: Hewlett Packard D89A3B [00-1A-2B-3C-04-05]
Rsv: (000000..)
UL: (......0.) Universally Administered Address
IG: (.......0) Individual address (unicast)
+ SourceAddress: BROADCOM CORPORATION BCE088 [06-7A-8B-9C-10-11]
EthernetType: Internet IP (IPv4), 2048(0x800)
- Ipv4: Src = 192.168.1.200, Dest = 192.168.1.100, Next Protocol = TCP, Packet ID = 3683, Total IP Length = 350
+ Versions: IPv4, Internet Protocol; Header Length = 20
+ DifferentiatedServicesField: DSCP: 0, ECN: 0
TotalLength: 350 (0x15E)
Identification: 3683 (0xE63)
+ FragmentFlags: 16384 (0x4000)
TimeToLive: 64 (0x40)
NextProtocol: TCP, 6(0x6)
Checksum: 2612 (0xA34)
SourceAddress: 192.168.1.200
DestinationAddress: 192.168.1.100
- Tcp: Flags=...AP..., SrcPort=HTTP Alternate(8080), DstPort=50355, PayloadLen=310, Seq=2596688289 - 2596688599, Ack=1611337545, Win=54 (scale factor 0x7) = 6912
SrcPort: HTTP Alternate(8080)
DstPort: 50355
SequenceNumber: 2596688289 (0x9AC651A1)
AcknowledgementNumber: 1611337545 (0x600B0F49)
+ DataOffset: 80 (0x50)
+ Flags: ...AP...
Window: 54 (scale factor 0x7) = 6912
Checksum: 0xB4CF, Good
UrgentPointer: 0 (0x0)
TCPPayload: SourcePort = 8080, DestinationPort = 50355
- Http: Response, HTTP/1.1, Status: Ok, URL: http://download.windowsupdate.com/msdownload/update/software/secu/2012/02/windowsserver2003.windowsx
ProtocolVersion: HTTP/1.1
StatusCode: 200, Ok
Reason: OK
Date: Fri, 06 Apr 2012 18:56:46 GMT
Last-Modified: Wed, 22 Feb 2012 21:36:04 GMT
+ ContentType: application/octet-stream
ETag: "03a6bfaa9f1cc1:0"
Accept-Ranges: bytes
Server: Microsoft-IIS/7.5
XPoweredBy: ASP.NET
Age: 261162
ProxyConnection: close
Via: 1.1 localhost.localdomain
HeaderEnd: CRLF
NOTE In this particular case the device was a Websense content filtering device but any device that performs similar functions can cause the same issue.
Resolution
To fix this, you’ll need to configure the content filtering device to allow their Configuration Manager site server access to at least the following list of websites as taken from KB885819.
Quite commonly the cache of the web filtering device will also have to be cleared or purged after making the necessary changes to allow the site server access to the required web addresses. Failure to do so can leave the cache intact and not allow for a successful connection.
Websites to allow:
http://download.windowsupdate.com
http://*.download.windowsupdate.com
http://download.microsoft.com
https://*.update.microsoft.com
http://*.update.microsoft.com
https://update.microsoft.com
http://update.microsoft.com
http://*.windowsupdate.com
http://*.windowsupdate.microsoft.com
http://windowsupdate.microsoft.com
https://*.windowsupdate.microsoft.com
http://ntservicepack.microsoft.com
http://wustat.windows.com
More Information
885819 - You experience problems when you access the Windows Update Version 6 Web site through a server that is running ISA Server
(http://support.microsoft.com/default.aspx?scid=kb;EN-US;885819)
Tyler Franke | Senior Support Escalation Engineer
Get the latest System Center news on Facebook and Twitter:
App-V Team blog: http://blogs.technet.com/appv/
ConfigMgr Support Team blog: http://blogs.technet.com/configurationmgr/
DPM Team blog: http://blogs.technet.com/dpm/
MED-V Team blog: http://blogs.technet.com/medv/
Orchestrator Support Team blog: http://blogs.technet.com/b/orchestrator/
Operations Manager Team blog: http://blogs.technet.com/momteam/
SCVMM Team blog: http://blogs.technet.com/scvmm
Server App-V Team blog: http://blogs.technet.com/b/serverappv
Service Manager Team blog: http://blogs.technet.com/b/servicemanager
System Center Essentials Team blog: http://blogs.technet.com/b/systemcenteressentials
WSUS Support Team blog: http://blogs.technet.com/sus/
The Forefront Server Protection blog: http://blogs.technet.com/b/fss/
The Forefront Endpoint Security blog : http://blogs.technet.com/b/clientsecurity/
The Forefront Identity Manager blog : http://blogs.msdn.com/b/ms-identity-support/
The Forefront TMG blog: http://blogs.technet.com/b/isablog/
The Forefront UAG blog: http://blogs.technet.com/b/edgeaccessblog/