When running SharePoint on Server 2008 and using a Network Load Balancing (NLB) cluster, the following warning messages may sporadically appear in the System event log:
Event ID: 105
NLB cluster : Timer starvation has been detected. This might be due to a denial of service attack or a very high server load. During this period some connections might fail. If this problem recurs frequently, analyze the threat and take appropriate measures and/or add more servers to the cluster. An informational message event log entry will be logged when the attack has subsided.
Shortly after the warning message, the informational event will get logged:
Event ID: 106
NLB cluster : Timer starvation has subsided
Information regarding this problem is discussed in Microsoft Support Knowledge Base article 951037. Basically, Server 2008 introduces a TCP Chimney Offload feature and it's incompatible with NLB. To turn off the TCP Chimney feature:
Offload properties will vary by NIC. Look for things like: