# SAP GUI Connection Error Codes: 88, 10054, 10061, NI and SNC Errors > Source: https://netray.co/tools/sap-gui-connection-error-codes-reference > Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems. > Section: Free Tools ## Short answer Reference for SAP GUI connection errors by layer: Windows socket codes, SAP NI layer codes, message server and logon group errors and SNC errors, with checks and fixes. ## Category sap ## Erp SAP NetWeaver / Basis ## Audience - SAP Basis administrator - Desktop support - Network engineer ## Tool **Kind:** worksheet **Mode:** reference **Columns:** #### Error text or code **Key:** error **Type:** text #### Layer **Key:** layer **Type:** select **Options:** - Windows socket - NI layer - Message server - SAProuter - SNC - Configuration #### Likely cause **Key:** cause **Type:** text #### What to check **Key:** check **Type:** text #### Fix **Key:** fix **Type:** text **Rows:** #### Host reached but nothing listens on the port, or a firewall actively rejects: instance or message server down, wrong instance number **Error:** WSAECONNREFUSED: 10061 **Layer:** Windows socket **Check:** niping -c -H -S 32; is the dispatcher (32NN) or message server (36NN default) running on the server **Fix:** Start the instance or correct the instance number or port in the SAP Logon entry; open the port in the firewall #### Connection reset by peer: firewall or proxy idle timeout dropped the session, network device reset, or the server process ended **Error:** WSAECONNRESET: 10054 **Layer:** Windows socket **Check:** Does it happen after idle time? Firewall session timeout, SAProuter log, dev_disp on the server **Fix:** Raise the firewall idle timeout for SAP ports or enable keepalive; investigate server-side restarts #### No answer at all from the host: routing, VPN or firewall silently dropping packets **Error:** WSAETIMEDOUT: 10060 **Layer:** Windows socket **Check:** ping and niping to the host; traceroute; VPN status **Fix:** Fix routing or firewall rules; confirm the client network can reach the SAP subnet #### Non-blocking socket operation could not complete immediately; usually a symptom logged with another error, not the root cause **Error:** WSAEWOULDBLOCK: 10035 **Layer:** Windows socket **Check:** The error that follows it in the trace **Fix:** Troubleshoot the accompanying error #### Generic NI message for a failed connect to host and service; the details line shows the NI code and Windows error **Error:** partner not reached **Layer:** NI layer **Check:** Read the full error details window (NI code, host, service, errno) **Fix:** Use the NI code and errno rows in this table #### The client cannot resolve the host name (DNS or hosts file); in traces NiHLGetNodeAddr fails **Error:** NIEHOST_UNKNOWN (-2), hostname unknown **Layer:** NI layer **Check:** nslookup ; C:\Windows\System32\drivers\etc\hosts; the host in SAPUILandscape.xml or saplogon.ini **Fix:** Fix DNS or add a hosts entry, or use the fully qualified name or IP #### Group (load balanced) logon needs the service name sapms, which is missing from the local services file **Error:** NIESERV_UNKNOWN (-3), service sapms unknown **Layer:** Configuration **Check:** C:\Windows\System32\drivers\etc\services for a line like sapmsPRD 3600/tcp **Fix:** Add sapms <36NN>/tcp at the end of the services file (with a final line break), or use the port number in the entry #### Connect or read timed out at the NI layer **Error:** NIETIMEOUT (-5) **Layer:** NI layer **Check:** niping with loops (-L) to measure stability; network latency **Fix:** Fix the network path; for slow WAN links check SAProuter and firewall #### An established connection was broken, often by a firewall timeout or server-side process end **Error:** NIECONN_BROKEN (-6), connection to partner broken **Layer:** NI layer **Check:** Correlate with 10054 in the details; dev_disp and SM21 on the server **Fix:** Same as 10054: idle timeouts or server restarts #### NI form of connection refused (paired with 10061) **Error:** NIECONN_REFUSED (-10) **Layer:** NI layer **Check:** Instance number, port and whether the instance is up **Fix:** Start the instance or correct the port #### SAP Logon cannot get a server from the message server: message server unreachable, wrong message server host or port, or the logon group does not exist or has no available server **Error:** Logon balancing error 88 **Layer:** Message server **Check:** niping -c -H -S 36; SMLG logon groups in the system; the group name in the logon entry **Fix:** Correct message server host, port or sapms entry; create or fix the logon group in SMLG; check the message server is running (SMMS) #### The SAProuter permission table (saprouttab) does not allow this client to this target host and port **Error:** Route permission denied (NIEROUT_PERM_DENIED, -94) **Layer:** SAProuter **Check:** saprouttab entries on the router host; the route string in the logon entry **Fix:** Add a permit line for the source, target and port, and reload the router table #### Wrong route string; format is /H//S/3299/H/, with /S/ optional for the default **Error:** Router string syntax **Layer:** SAProuter **Check:** Router string in the SAP Logon entry; SAProuter listens on 3299 by default **Fix:** Correct the route string; test with niping -c -H /H//H/ -S 32 #### The SNC library on the client has no valid credentials: no Kerberos ticket, Secure Login Client not logged on, or missing certificate **Error:** SNCERR_GSSAPI, GSS-API(maj): No credentials were supplied **Layer:** SNC **Check:** Secure Login Client status or Kerberos ticket (klist); the SNC library configured for SAP GUI **Fix:** Log on to Secure Login Client or renew the ticket; install the right SNC library #### The SNC name of the server in the logon entry does not match the name the server presents (snc/identity/as) **Error:** SNC name mismatch (p:CN=...) **Layer:** SNC **Check:** SNC name in the SAP Logon entry versus snc/identity/as in RZ11 on the server **Fix:** Copy the exact SNC name, including the p: prefix, into the logon entry #### The entry requests SNC but the server has snc/enable = 0 or SNC failed to start **Error:** SNC not active on server **Layer:** SNC **Check:** snc/enable in RZ11; dev_w0 or dev_disp for SNC start errors **Fix:** Enable and configure SNC on the server, or disable SNC on the logon entry for testing **Notes:** Read the full error details window in SAP GUI: it usually shows the NI code, host, service and the Windows socket error together, which pins the layer. Default ports: dispatcher 32NN, gateway 33NN, message server 36NN (NN is the instance number), SAProuter 3299. niping is shipped in the kernel directory and as a separate download (SAP Note 500235). ## Content **Intro:** This reference decodes the connection errors SAP GUI for Windows shows when it cannot reach or stay connected to an SAP system: Windows socket codes such as 10061 and 10054, SAP NI layer codes, logon balancing error 88, SAProuter and SNC errors. Each row says which layer failed, what to check and the fix. **Sections:** #### Find the layer first **Body:** Connection errors stack: SAP GUI calls the NI (network interface) layer, which calls Windows sockets. The details window shows all of them, for example partner not reached, NIECONN_REFUSED and errno 10061 together. Decide which layer failed before changing anything. Name resolution errors (NIEHOST_UNKNOWN, NIESERV_UNKNOWN) are client configuration. Refused connections (10061) mean the host answered but nothing listens on that port. Timeouts (10060) mean nothing answered. Resets (10054) mean an existing session was cut. Error 88 points to the message server or logon group. SNC errors are about credentials and SNC names, not the network. #### Testing with niping **Body:** niping isolates the network from SAP GUI. On the server you can start a test listener with niping -s -I 0, and on the client run niping -c -H to test against it. To test the real ports, run niping -c -H -S 32 for the dispatcher or -S 36 for the message server; a successful connect proves the port is reachable. Through SAProuter, use a route string as the host, for example niping -c -H /H/router.example.com/H/sapapp01 -S 3200. Add -L with a loop count to see intermittent drops over time. **Bullets:** - niping -s -I 0: start test server on the SAP host - niping -c -H : basic connection and throughput test - niping -c -H -S 3200: test the dispatcher port for instance 00 - niping -c -H -L 100: repeat to catch intermittent drops #### Where SAP GUI keeps the connection settings **Body:** Since SAP GUI 7.40, connection entries are stored in SAPUILandscape.xml (local, and optionally a central global landscape file); older installs used saplogon.ini. A load-balanced entry needs the message server host and either a port or the service name sapms, which must then exist in C:\Windows\System32\drivers\etc\services. If only some users fail, compare their landscape file and services file with a working PC first. On the server side, logon groups are in SMLG, message server status in SMMS, and SNC parameters in RZ11 (snc/enable, snc/identity/as). #### Worked example: error 88 for one plant **Body:** Users at one plant get logon balancing error 88 on their group entry for PRD, while direct server entries work. niping to the message server port 3600 from a plant PC is refused, but works from head office. The plant firewall allows 3200 but not 3600. Opening 3600 (message server) from the plant subnet fixes it. A second plant has the same error with the port open: there, the logon group name in the central landscape file is PUBLIC while SMLG has only SPACE, so the group must be created or the entry corrected. **Cta:** If you want your support desk to describe a connection error in plain English and get the likely cause from your own landscape data, on your own servers, we can set that up. **Faq:** #### What is SAP GUI error 10061? **Answer:** 10061 is the Windows socket error WSAECONNREFUSED: the client reached the host but nothing accepted the connection on that port. Usually the instance or message server is down, the instance number in the entry is wrong, or a firewall actively rejects the port. Test with niping on 32NN or 36NN. #### What causes SAP GUI error 10054? **Answer:** 10054 is WSAECONNRESET: an existing connection was reset by the other side. Typical causes are a firewall or proxy dropping idle sessions, a network device reset or the server process ending. If it happens after a period of inactivity, look at firewall idle timeouts first. #### How do I fix logon balancing error 88 in SAP GUI? **Answer:** Error 88 means SAP Logon could not get a server from the message server. Check the message server host and port (or sapms in the services file), test the port with niping, confirm the message server runs, and make sure the logon group in the entry exists in SMLG. #### What does hostname unknown mean in SAP GUI? **Answer:** The client could not resolve the host name in the logon entry (NIEHOST_UNKNOWN). Check nslookup for the name, the local hosts file and VPN DNS settings. Using the fully qualified domain name or fixing the DNS record usually resolves it. ## Search terms sap gui error 88, sap gui error 10054, sap gui error 10061, error hostname unknown sap gui, sap error logon balancing 88, sap gui error in snc, partner not reached sap gui, niping test --- Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json