What does NTSTATUS 0xC0130031 (STATUS_CLUSTER_CAM_TICKET_REPLAY_DETECTED) mean?

 
Previous Next
STATUS_CLUSTER_CSV_SUPPORTED_ONLY_ON_COORDINATOR STATUS_ACPI_INVALID_OPCODE

STATUS_CLUSTER_CAM_TICKET_REPLAY_DETECTED

A cluster security ticket appears to have been replayed

STATUS_CLUSTER_CAM_TICKET_REPLAY_DETECTED means Cluster CAM rejected a ticket because it matched or conflicted with a ticket already seen. Replay protection prevents an old authenticated request from being accepted again.

Possible causes

  • A legitimate request was retransmitted after its completion state was lost.
  • Cluster nodes disagree about ticket state after failover or restoration.
  • Clock, sequence, or nonce handling is inconsistent between participants.
  • An unauthorized party attempted to reuse captured authentication material.

Response

Do not bypass replay checks. Correlate node logs, ticket identifiers, failover events, and time synchronization. Rotate credentials or session material when compromise is plausible, and investigate why the sender reused a ticket instead of obtaining a fresh one.

References


Looking for a different code? Search another status or error code.