SAPFree referencePDF, Excel, Word exportSAP NetWeaver / BasisAll SAP HANA and Basis tools

SAP GUI Connection Error Codes: 88, 10054, 10061, NI and SNC Errors

This reference decodes the connection errors SAP GUI for Windows shows when it cannot reach or stay connected to an SAP system: Windows socket codes such as 10061 and 10054, SAP NI layer codes, logon balancing error 88, SAProuter and SNC errors. Each row says which layer failed, what to check and the fix.

Download:

Error text or code	Layer	Likely cause	What to check	Fix
WSAECONNREFUSED: 10061	Windows socket	Host reached but nothing listens on the port, or a firewall actively rejects: instance or message server down, wrong instance number	niping -c -H <host> -S 32<NN>; is the dispatcher (32NN) or message server (36NN default) running on the server	Start the instance or correct the instance number or port in the SAP Logon entry; open the port in the firewall
WSAECONNRESET: 10054	Windows socket	Connection reset by peer: firewall or proxy idle timeout dropped the session, network device reset, or the server process ended	Does it happen after idle time? Firewall session timeout, SAProuter log, dev_disp on the server	Raise the firewall idle timeout for SAP ports or enable keepalive; investigate server-side restarts
WSAETIMEDOUT: 10060	Windows socket	No answer at all from the host: routing, VPN or firewall silently dropping packets	ping and niping to the host; traceroute; VPN status	Fix routing or firewall rules; confirm the client network can reach the SAP subnet
WSAEWOULDBLOCK: 10035	Windows socket	Non-blocking socket operation could not complete immediately; usually a symptom logged with another error, not the root cause	The error that follows it in the trace	Troubleshoot the accompanying error
partner not reached	NI layer	Generic NI message for a failed connect to host and service; the details line shows the NI code and Windows error	Read the full error details window (NI code, host, service, errno)	Use the NI code and errno rows in this table
NIEHOST_UNKNOWN (-2), hostname unknown	NI layer	The client cannot resolve the host name (DNS or hosts file); in traces NiHLGetNodeAddr fails	nslookup <host>; C:\Windows\System32\drivers\etc\hosts; the host in SAPUILandscape.xml or saplogon.ini	Fix DNS or add a hosts entry, or use the fully qualified name or IP
NIESERV_UNKNOWN (-3), service sapms<SID> unknown	Configuration	Group (load balanced) logon needs the service name sapms<SID>, which is missing from the local services file	C:\Windows\System32\drivers\etc\services for a line like sapmsPRD 3600/tcp	Add sapms<SID> <36NN>/tcp at the end of the services file (with a final line break), or use the port number in the entry
NIETIMEOUT (-5)	NI layer	Connect or read timed out at the NI layer	niping with loops (-L) to measure stability; network latency	Fix the network path; for slow WAN links check SAProuter and firewall
NIECONN_BROKEN (-6), connection to partner broken	NI layer	An established connection was broken, often by a firewall timeout or server-side process end	Correlate with 10054 in the details; dev_disp and SM21 on the server	Same as 10054: idle timeouts or server restarts
NIECONN_REFUSED (-10)	NI layer	NI form of connection refused (paired with 10061)	Instance number, port and whether the instance is up	Start the instance or correct the port
Logon balancing error 88	Message server	SAP Logon cannot get a server from the message server: message server unreachable, wrong message server host or port, or the logon group does not exist or has no available server	niping -c -H <ms host> -S 36<NN>; SMLG logon groups in the system; the group name in the logon entry	Correct message server host, port or sapms<SID> entry; create or fix the logon group in SMLG; check the message server is running (SMMS)
Route permission denied (NIEROUT_PERM_DENIED, -94)	SAProuter	The SAProuter permission table (saprouttab) does not allow this client to this target host and port	saprouttab entries on the router host; the route string in the logon entry	Add a permit line for the source, target and port, and reload the router table
Router string syntax	SAProuter	Wrong route string; format is /H/<router host>/S/3299/H/<target host>, with /S/<port> optional for the default	Router string in the SAP Logon entry; SAProuter listens on 3299 by default	Correct the route string; test with niping -c -H /H/<router>/H/<target> -S 32<NN>
SNCERR_GSSAPI, GSS-API(maj): No credentials were supplied	SNC	The SNC library on the client has no valid credentials: no Kerberos ticket, Secure Login Client not logged on, or missing certificate	Secure Login Client status or Kerberos ticket (klist); the SNC library configured for SAP GUI	Log on to Secure Login Client or renew the ticket; install the right SNC library
SNC name mismatch (p:CN=...)	SNC	The SNC name of the server in the logon entry does not match the name the server presents (snc/identity/as)	SNC name in the SAP Logon entry versus snc/identity/as in RZ11 on the server	Copy the exact SNC name, including the p: prefix, into the logon entry
SNC not active on server	SNC	The entry requests SNC but the server has snc/enable = 0 or SNC failed to start	snc/enable in RZ11; dev_w0 or dev_disp for SNC start errors	Enable and configure SNC on the server, or disable SNC on the logon entry for testing

Read the full error details window in SAP GUI: it usually shows the NI code, host, service and the Windows socket error together, which pins the layer. Default ports: dispatcher 32NN, gateway 33NN, message server 36NN (NN is the instance number), SAProuter 3299. niping is shipped in the kernel directory and as a separate download (SAP Note 500235).

Intermittent SAP GUI drops?

Send us the error details window and a niping loop result and we will tell you which layer to fix.

Optional. The tool and every export work without this. No spam.

Was this tool useful?

Find the layer first

Connection errors stack: SAP GUI calls the NI (network interface) layer, which calls Windows sockets. The details window shows all of them, for example partner not reached, NIECONN_REFUSED and errno 10061 together. Decide which layer failed before changing anything. Name resolution errors (NIEHOST_UNKNOWN, NIESERV_UNKNOWN) are client configuration. Refused connections (10061) mean the host answered but nothing listens on that port. Timeouts (10060) mean nothing answered. Resets (10054) mean an existing session was cut. Error 88 points to the message server or logon group. SNC errors are about credentials and SNC names, not the network.

Testing with niping

niping isolates the network from SAP GUI. On the server you can start a test listener with niping -s -I 0, and on the client run niping -c -H <host> to test against it. To test the real ports, run niping -c -H <host> -S 32<NN> for the dispatcher or -S 36<NN> for the message server; a successful connect proves the port is reachable. Through SAProuter, use a route string as the host, for example niping -c -H /H/router.example.com/H/sapapp01 -S 3200. Add -L with a loop count to see intermittent drops over time.

niping -s -I 0: start test server on the SAP host
niping -c -H <host>: basic connection and throughput test
niping -c -H <host> -S 3200: test the dispatcher port for instance 00
niping -c -H <host> -L 100: repeat to catch intermittent drops

Where SAP GUI keeps the connection settings

Since SAP GUI 7.40, connection entries are stored in SAPUILandscape.xml (local, and optionally a central global landscape file); older installs used saplogon.ini. A load-balanced entry needs the message server host and either a port or the service name sapms<SID>, which must then exist in C:\Windows\System32\drivers\etc\services. If only some users fail, compare their landscape file and services file with a working PC first. On the server side, logon groups are in SMLG, message server status in SMMS, and SNC parameters in RZ11 (snc/enable, snc/identity/as).

Worked example: error 88 for one plant

Users at one plant get logon balancing error 88 on their group entry for PRD, while direct server entries work. niping to the message server port 3600 from a plant PC is refused, but works from head office. The plant firewall allows 3200 but not 3600. Opening 3600 (message server) from the plant subnet fixes it. A second plant has the same error with the port open: there, the logon group name in the central landscape file is PUBLIC while SMLG has only SPACE, so the group must be created or the entry corrected.

Frequently Asked Questions

What is SAP GUI error 10061?

10061 is the Windows socket error WSAECONNREFUSED: the client reached the host but nothing accepted the connection on that port. Usually the instance or message server is down, the instance number in the entry is wrong, or a firewall actively rejects the port. Test with niping on 32NN or 36NN.

What causes SAP GUI error 10054?

10054 is WSAECONNRESET: an existing connection was reset by the other side. Typical causes are a firewall or proxy dropping idle sessions, a network device reset or the server process ending. If it happens after a period of inactivity, look at firewall idle timeouts first.

How do I fix logon balancing error 88 in SAP GUI?

Error 88 means SAP Logon could not get a server from the message server. Check the message server host and port (or sapms<SID> in the services file), test the port with niping, confirm the message server runs, and make sure the logon group in the entry exists in SMLG.

What does hostname unknown mean in SAP GUI?

The client could not resolve the host name in the logon entry (NIEHOST_UNKNOWN). Check nslookup for the name, the local hosts file and VPN DNS settings. Using the fully qualified domain name or fixing the DNS record usually resolves it.

If you want your support desk to describe a connection error in plain English and get the likely cause from your own landscape data, on your own servers, we can set that up.

Talk to an Expert Explore More Free Tools