locked
Memory leaking while using Wireless Hosted Network

    Question

  • I have a laptop with 4 Gb of memory and AMD Athlon X2 Dual-Core QL-65 2.10 GHz processor. Windows 8 CP x64 is installed as a main operating system.

    I share my Internet connection via WiFi virtual router using  Wireless Hosted Network feature. Other users can connect to this WiFi network and access Internet. It's all OK when users just surf the web. But when someone starts downloading files via bittorrent client the memory on my laptop is leaking. The amount of memory in use increases with speed of approx. 1 Mb per second (I can see this in Resource Monitor) and in about an hour all my physical memory is in use. Then the hard drive starts to work violently, the system freezes so I can't even move the mouse cursor and the only I can do is hot reboot. Task Manager doesn't show any process uses more memory than usually, so I don't know where and why the memory is leaking. The only I know - it ALWAYS happens when somebody in WiFi network downloading files via bittorrent client.

    Wednesday, April 11, 2012 4:57 PM

Answers

All replies

  • please run RAMMap (http://blogs.technet.com/b/askperf/archive/2010/08/13/introduction-to-the-new-sysinternals-tool-rammap.aspx ) to see which memory type is used most.

    If a kernel pool (paged or nonpaged) is leaking run poolmon.exe to see which tag uses all memory:

    http://support.microsoft.com/kb/177415

    http://support.microsoft.com/kb/298102


    "A programmer is just a tool which converts caffeine into code"

    Sunday, April 15, 2012 3:41 PM
  • please run RAMMap (http://blogs.technet.com/b/askperf/archive/2010/08/13/introduction-to-the-new-sysinternals-tool-rammap.aspx ) to see which memory type is used most.

    This tool doesn't work. It shows "Error refreshing database" message when I start it.
    Tuesday, April 17, 2012 8:34 PM
  • ok, I'm using a newer version.

    Can you please run the new Taskmanager (The Windows 8 Task Manager ) and look under "Performance" if the paged and non-paged values are high? Can you also make a Picture and add it here?


    "A programmer is just a tool which converts caffeine into code"

    Thursday, April 19, 2012 10:58 AM
  • This is how it looks in Task Manager...

    http://social.technet.microsoft.com/Forums/getfile/96876

    … and in Resource Monitor.

    http://social.technet.microsoft.com/Forums/getfile/96877

    And yeah, the value of non-paged pool usage is too high.
    • Edited by aibomax Monday, April 23, 2012 7:39 PM
    Monday, April 23, 2012 7:37 PM
  • I can't see the pictures and when I open the links I got an ASP.net error. But if a pool is too high use poolmon.exe to see which pool tag is the cause.

    "A programmer is just a tool which converts caffeine into code"

    Tuesday, April 24, 2012 7:46 AM
  • Here's a part of poolmon report. It was made when 95% of memory was in use.

    It is sorted so tags with highest Allocs are on the top. Also I should say that the Allocs amounts for the first 5 tags were rapidly increasing during the experiment. I found here what these 5 tags mean:

    Mdl  - <unknown>    - Io, Mdls

    IPre - tcpip.sys    - IP Reassembly buffers

    Io   - nt!io        - general IO allocations

    Ipng - tcpip.sys    - IP Generic buffers (Address, Interface, Packetize, Route allocations)

    RaPM - tcpip.sys    - Raw Socket Partial Memory Descriptor List Tag

    It looks like there are some network communication buffers that are filling and filling until the memory is over. Is this a kernel bug?

     Memory: 4193396K Avail:  205276K  PageFlts:   345   InRam Krnl:15764K P:71428K
     Commit:4328456K Limit:8387700K Peak:4347164K            Pool N:3458204K P:17823
     Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc
     Mdl  Nonp   16084305 (6635)      2075 (   0) 16082230 -949833920 (1380080)    2
     IPre Nonp   12583910 (4836)  12583738 (4887)      172  105216 (-32160)    611
     Io   Nonp   10987915 (2122)  10987038 (2200)      877  131056 ( -7488)    149
     Ipng Nonp    2725582 (1268)   2725549 (1268)       33   10016 (     0)    303
     RaPM Nonp    2676989 (1268)   2676989 (1268)        0       0 (     0)      0
     CMNb Paged   1737553 (1750)   1734894 (1750)     2659  196704 (     0)     73
     Key  Paged    921814 ( 430)    918615 ( 431)     3199  553840 (  -192)    173
     CMvn Nonp     570403 (   2)    570403 (   2)        0       0 (     0)      0
     SeSd Paged    444392 (  43)    444378 (  43)       14    2816 (     0)    201
     Even Nonp     382470 (1053)    377353 (1052)     5117  661344 (   128)    129
     Frag Nonp     379715 ( 335)    379528 ( 335)      187    5984 (     0)     32
     NSpg Nonp     314366 (1048)    314366 (1048)        0       0 (     0)      0
     VadS Nonp     296312 (  10)    294543 (  10)     1769  141520 (     0)     80
     usbp Nonp     295988 (1475)    295932 (1475)       56   46400 (     0)    828
     PfPB Nonp     283380 (   0)    283380 (   0)        0       0 (     0)      0
     WfpH Nonp     254857 ( 316)    251831 ( 200)     3026  202784 ( 11728)     67
     ObWm Nonp     252196 (  98)    252169 (  97)       27   18720 (   208)    693
     SeAc Paged    244261 (  28)    244252 (  28)        9    1152 (     0)    128
     File Nonp     232304 (  21)    228314 ( 103)     3990 1322240 (-27552)    331
     IoNm Paged    197050 (   1)    194635 (   2)     2415  401840 (  -144)    166
     MmSe Nonp     159911 (  70)    158182 (  70)     1729  110656 (     0)     64
     SeSc Paged    155995 (  22)    155980 (  22)       15    1344 (     0)     89
     SeAt Paged    121987 (  14)    120697 (  14)     1290   97344 (     0)     75
     SeTd Paged    121022 (  14)    119864 (  14)     1158  256752 (     0)    221
     SeTl Nonp     120726 (  14)    119601 (  14)     1125  144000 (     0)    128
     Toke Paged    120726 (  14)    119601 (  14)     1125 2651952 (     0)   2357
     DxgK Paged    119647 (  75)    118578 (  75)     1069  964688 (     0)    902
     ObNm Paged    101170 (   0)     99784 (   0)     1386  102096 (     0)     73
     Wfpn Nonp      91150 (  47)     90848 (  47)      302  191168 (     0)    633
     Se   Paged     79463 (  13)     79462 (  13)        1     912 (     0)    912
     Vad  Nonp      72508 (   0)     68745 (   0)     3763  541872 (     0)    144
     MmRl Nonp      70701 (   0)     70701 (   0)        0       0 (     0)     
     0
     MmAc Nonp      69315 (  62)     69254 (  58)       61  249856 ( 16384)   4096
     PNPR Paged     66231 (   0)     66204 (   0)       27    4448 (     0)    164
     Irp  Nonp      63902 ( 295)     63343 ( 297)      559  319520 ( -1888)    571
     UHUB Nonp      59234 ( 295)     59206 ( 295)       28   11392 (     0)    406
    Total Nonp   50236545 (22074)  34078882 (16011) 16157663 -913701360 (1234368)
    Total Paged   5568231 (2492)   5461973 (3372)   106258 169123248 (-208400)

    • Edited by aibomax Friday, April 27, 2012 3:42 PM
    Friday, April 27, 2012 3:41 PM
  • this is so horribly to read. How long does it take to repro this leak? You can run a xperf trace to see more details.

    Download the Windows 8 ADK, install the Windows Performance Toolkit, open a CMD Windows with admin rights and run this:

    xperf -on BASE+Pool –stackwalk PoolAlloc+PoolFree -buffersize 1024 -MaxFile 512 -FileMode Circular && timeout -1 && xperf -d trace_pool_alloc.etl

    When you have the high memory usage, go to the CMD windows and press a key to stop it.

    Now compress the generated trace_pool_alloc.etl as 7z or RAR and upload it to your SkyDrive or dropbox and paste a link here.


    "A programmer is just a tool which converts caffeine into code"

    Sunday, April 29, 2012 1:32 PM
  • Here is a link to the folder in which I uploaded previous screenshots of Task Manager, full poolmon report and rar-archive of  trace_pool_alloc.etl file.

    https://skydrive.live.com/redir.aspx?cid=4bea5f39b24dc56b&resid=4BEA5F39B24DC56B!156&parid=4BEA5F39B24DC56B!154&authkey=!AL3DXhWgFNzrdlM


    • Edited by aibomax Wednesday, May 02, 2012 9:02 PM
    Wednesday, May 02, 2012 8:41 PM
  • the IPNAT.SYS driver calls the IPsec FW driver (fwpkclnt.sys!FwppAllocateNetioCloneNetBufferList) which allocates nonpaged pool memory with the MDL tag. But most of the used memory is not traced, it only shows the amount:

    Try to update the Qualcomm Atheros AR9285 Wireless Network Adapter driver. if this doesn#t fix it, it maybe a bug. Go to connect.microsoft.com and apply to the Ecosystem-Betatest (IE10), download the feedback tool and install it on Windows 8. Report the issue and attach the xperf trace and test if it still happens in the release-Preview (RC).


    "A programmer is just a tool which converts caffeine into code"

    Thursday, May 03, 2012 7:14 PM
  • I have the same issue on Windows server 2012 RC. Huge non-paged memory leak with "Mdl" tag. I use Wireless Hosted Network feature, but disabling Qualcomm Atheros AR9002WB-1NG WiFi adapter does not help.
    Sunday, June 17, 2012 2:59 AM