Computer leaks nonpaged pool memory when IPSEC traffic is configured to use AuthIP without encryption in Windows

Symptoms

Assume that a Windows-based computer is configured by using a specific IP Security (IPsec) rule (AuthNoEncap - AuthIP with NULL Encryption). When the computer receives User Datagram Protocol (UDP) traffic, a nonpaged pool leak occurs. If there is a large volume of traffic, the computer may become unresponsive.For example, you may encounter this issue in the following scenario:

You configure the computers in a domain to use Authenticated IP (AuthIP) only for IPsec and without encryption.
In the domain, a computer sends a large volume of UDP traffic to a remote computer.

In this scenario, nonpaged pool memory usage increases on the remote computer. High UDP network traffic can completely exhaust the nonpaged pool memory. This causes the remote computer to become unresponsive until it is restarted.

Note Windows-based computers that host the DNS Server role are an example of a workload susceptible to this memory leak, because they service UDP-formatted DNS queries from a large collection of unique clients. However, the issue can apply to any remote computer that receives sufficient UDP traffic.

Resolution

To resolve this problem, install the hotfix that is described in this article.

Note To resolve this problem in Windows 8.1 and Windows Server 2012 R2, install update rollup 2928680.

KB2928680을 설치해본다.

Memory leak in Windows 8.1 with Killer E2200 and Windows Network Data Usage Monitoring

Recently upgraded to a new computer with Intel’s latest Haswell generation and Microsoft Windows 8.1. Although its performance has been stellar, a few days ago unexpectedly ran into severely degraded performance.

Saw in the Task Manager that all available memory was taken up by the Non-Paged Pool. After a system reboot the memory used by the Non-Paged Pool quickly started to increase until all memory was taken.

Looked up what information could fine online about memory leaks in Windows 8.1 and came upon this forum post in which others detailed similar experiences when using Windows 8 on hardware equipped with Qualcomm’s Killer ethernet networking products.

The actual cause of the memory leak seems to be the Windows Network Data Usage Monitoring Driver service which in combination with a Killer network driver starts to fill up the Non-Paged Pool memory.

Considering that my MSI H87-G43 Gaming motherboard is equipped with the Killer Ethernet E2200 and am using the Killer Network Manager driver, knew it had to be the same cause.

Applied the suggested fix of altering the registry key value of the “Start” entry to 4 in HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu\ to disable the Windows Network Data Usage Monitor Driver from starting and after a reboot the issue seems properly solved!

저작자표시