locked
iphlpsvc CPU %

    Question

  • Hi

    I’M running Windows 2008 R2 and I notice that "iphlpsvc" is constantly showing in taskmgr consuming between 10 to 15% of CPU resources, this is weird and I don’t see the same behavior in windows 2008, what can be triggering iphlpsvc??!!

    How can I see what is "calling" the iphlpsvc? I already tried Sysinternals but I don’t know how to check what is calling iphlpsvc!!!

    Monday, October 19, 2009 4:03 PM

Answers

All replies

  • Hai,

    iphlpsvc is IP Helper Service. Provides automatic IPv6 connectivity over an IPv4 network. If this service is stopped, the machine will only have IPv6 connectivity if it is connected to a native IPv6 network.

    regards from www.windowsadmin.info


    ManuPhilip
    Monday, October 19, 2009 4:28 PM
  • Hai,

    iphlpsvc is IP Helper Service. Provides automatic IPv6 connectivity over an IPv4 network. If this service is stopped, the machine will only have IPv6 connectivity if it is connected to a native IPv6 network.

    regards from www.windowsadmin.info


    ManuPhilip

    Ok, but it's normal that every second is displaying and consuming 13% of CPU resources?
    Monday, October 19, 2009 4:41 PM
  • First, determine the current Teredo configuration by running the following command:

    netsh interface teredo show state


    If the output includes the message, “Error: client is in a managed network,” Teredo is configured as a standard client, which does not function when connected to a domain controller. To resolve this, run the following command:

    netsh interface ipv6 set teredo enterpriseclient


    Teredo is a tunneling protocol designed to grant IPv6 connectivity. So if there is any issues with Teredo, there will be huge consumption of cpu.

    First, determine the current Teredo configuration by running the command: netsh interface teredo show state. If there is a message like “Error: client is in a managed network,” Teredo is configured as a standard client, which does not function when connected to a domain controller. To resolve this, run the command:
    netsh interface ipv6 set teredo enterpriseclient

    If Teredo still does not work, it’s likely that your network infrastructure blocks the IPv4 UDP traffic that Teredo uses for communications. Work with your network administrators to ensure that routers and firewalls allow incoming UDP traffic.

    You can enable tracing to troubleshoot more complex problems by following these steps:

    1. Set the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHlpSvc\Enable- FileTracing registry key to 1.

    2. Stop the IP Helper service by running the command net stop iphlpsvc.

    3. Delete the contents of the %SystemRoot%\Tracing folder.

    4. Start the IP Helper service by running the command net start iphlpsvc.

    5. Reproduce the problem. For example, you can force Teredo to attempt a connection by running the command netsh interface teredo show state.

    Now you can examine the trace logs in the %SystemRoot%\Tracing folder or submit the logs to technical support.

    6. Set the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IpHl pSvc\Enable- FileTracing registry key to 0.

    7. Stop the IP Helper service by running the command net stop iphlpsvc, and then restart it by running the command net start iphlpsvc

    regards from www.windowsadmin.info


    ManuPhilip
    Monday, October 19, 2009 5:20 PM
  • I did the first 2
    and now I have:

    Type                    : enterpriseclient
    Server Name             : teredo.ipv6.microsoft.com.
    Client Refresh Interval : 30 seconds
    Client Port             : unspecified
    State                   : offline
    Error                   : failed to open tunnel adapter

    UDP is not blocked in our network.


    iphlpsvc still consuming 13% of CPU.
    Monday, October 19, 2009 6:15 PM
  • Anyone? This is driving me crazy!!!

    What could be the cause of this? UDP not bloqued.
    Here's part of the log

    [2036] 16:42:20: Get lock (000000000000013C) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [2112] 16:42:21:: Failed to install (*6to4mp): 2147943850
    [2112] 16:42:21:: ERROR: Cannot create 6to4 interface
    [2112] 16:42:21:: ReferenceService: ++9 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [2112] 16:42:21:: Leaving Start6to4InCompartment
    [2112] 16:42:21:: Leaving: CompartmentRequirementChangeNotification6to4
    [2112] 16:42:21:: Lock (000000000000013C) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [2112] 16:42:21:: DereferenceCompartment: 0x00000000010B12F0 : --9 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [2112] 16:42:21:: DereferenceService: --9 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [2036] 16:42:21:: Lock (000000000000013C) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [2036] 16:42:21:: DeferredStart6to4InCompartment: Woke up
    [2036] 16:42:21:: Entered: CompartmentRequirementChangeNotification6to4
    [2036] 16:42:21:: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [2036] 16:42:21:: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [2036] 16:42:21:: Start6to4InCompartment: Luid unspecified on attempt #1.
    [2036] 16:42:21:: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [2036] 16:42:21:: Creating a 6to4 interface...
    [2036] 16:42:21:: InstallInterface: Installing interface (null)
    [2036] 16:42:21:: Do install about to start (*6to4mp)
    [2036] 16:42:26: Failed to install (*6to4mp): 2147943850
    [2036] 16:42:26: ERROR: Cannot create 6to4 interface
    [2036] 16:42:26: ReferenceService: ++8 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [2036] 16:42:26: Leaving Start6to4InCompartment
    [2036] 16:42:26: Leaving: CompartmentRequirementChangeNotification6to4
    [2036] 16:42:26: Lock (000000000000013C) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [2036] 16:42:26: DereferenceCompartment: 0x00000000010B12F0 : --8 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [2036] 16:42:26: DereferenceService: --8 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [6420] 16:42:30: Get lock (000000000000013C) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [6420] 16:42:30: Lock (000000000000013C) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [6420] 16:42:30: DeferredStart6to4InCompartment: Woke up
    [6420] 16:42:30: Entered: CompartmentRequirementChangeNotification6to4
    [6420] 16:42:30: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [6420] 16:42:30: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [6420] 16:42:30: Start6to4InCompartment: Luid unspecified on attempt #1.
    [6420] 16:42:30: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [6420] 16:42:30: Creating a 6to4 interface...
    [6420] 16:42:30: InstallInterface: Installing interface (null)
    [6420] 16:42:30: Do install about to start (*6to4mp)
    [2092] 16:42:35: Get lock (000000000000013C) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [6420] 16:42:35: Failed to install (*6to4mp): 2147943850
    [6420] 16:42:35: ERROR: Cannot create 6to4 interface
    [6420] 16:42:35: ReferenceService: ++7 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [6420] 16:42:35: Leaving Start6to4InCompartment
    [6420] 16:42:35: Leaving: CompartmentRequirementChangeNotification6to4
    [6420] 16:42:35: Lock (000000000000013C) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [2092] 16:42:35: Lock (000000000000013C) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [6420] 16:42:35: DereferenceCompartment: 0x00000000010B12F0 : --7 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [2092] 16:42:35: DeferredStart6to4InCompartment: Woke up
    [6420] 16:42:35: DereferenceService: --7 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [2092] 16:42:35: Entered: CompartmentRequirementChangeNotification6to4
    [2092] 16:42:35: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [2092] 16:42:35: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [2092] 16:42:35: Start6to4InCompartment: Luid unspecified on attempt #1.
    [2092] 16:42:35: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [2092] 16:42:35: Creating a 6to4 interface...
    [2092] 16:42:35: InstallInterface: Installing interface (null)
    [2092] 16:42:35: Do install about to start (*6to4mp)

     

    Tuesday, October 20, 2009 7:46 PM
  • Anyone?
    Sunday, October 25, 2009 2:29 AM
  • If it makes you feel any better, I'm seeing the same thing, running Windows Server 2008 R2 Standard, Hyper-V. svchost uses 100% (or more) of a CPU at all times, and I've tracked it to ip helper. Also nlasvc consumes 50% of a cpu at all times.
    Tuesday, October 27, 2009 1:14 PM
  • How that makes me feel nay better?
    This is not normal, right?
    Wednesday, October 28, 2009 10:58 AM
  • nrdfeeling, do you have the following driver on your machine? %windir%\system32\drivers\tunnel.sys Thanks,
    Wednesday, November 04, 2009 1:51 AM
  • nrdfeeling, do you have the following driver on your machine? %windir%\system32\drivers\tunnel.sys Thanks,

    No, I ran a search and I didn't find it!!!!
    Wednesday, November 04, 2009 10:37 AM
  • Do I need it? How to correcte that?
    • Proposed as answer by anowak000 Friday, January 08, 2010 4:32 AM
    Friday, November 06, 2009 3:10 PM
  • Affecting my laptop too. Windows 7 32-bit clean install, malware free. Disabling IP Helper service makes CPU usage normal. MS please rewrite this service to fix any problems. I heard there were issues since the beta with this particular service.

    Tuesday, December 22, 2009 4:01 PM
  • Hi,

    I managed to fix this by following the comment above and troubleshooting it using the Trace log.

    I ended up removing the NIC (easy if using vmware)

    Basically

    Remove the network card using device manager or devcon (make sure you use the correct version usually found on the windows DVD)

    http://support.microsoft.com/kb/269155

    Remove the physical nic or virtual nic completely
    Boot back into Windows
    Add the nic back (Live using VMware) You'll need to shutdown to insert physical nic
    Scan for devices - in 2008 case should do this automatically

    Cheers

    Friday, January 08, 2010 4:36 AM
  • Well after futher testing found this issue comes back after adding a second nic.
    It is happening on two of my production file servers, although I have a test environment with the same setup and it seems fine?

    If anyone can help that would be great


    [1392] 16:35:13: Get lock (0000000000000414) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [1392] 16:35:13: Lock (0000000000000414) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [1392] 16:35:13: DeferredStart6to4InCompartment: Woke up
    [1392] 16:35:13: Entered: CompartmentRequirementChangeNotification6to4
    [1392] 16:35:13: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [1392] 16:35:13: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [1392] 16:35:13: Start6to4InCompartment: Luid unspecified on attempt #1.
    [1392] 16:35:13: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [1392] 16:35:13: Creating a 6to4 interface...
    [1392] 16:35:13: InstallInterface: Installing interface (null)
    [1392] 16:35:13: Do install about to start (*6to4mp)
    [1392] 16:35:16: Failed to install (*6to4mp): 2147943850
    [1392] 16:35:16: ERROR: Cannot create 6to4 interface
    [1392] 16:35:16: ReferenceService: ++11 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [1392] 16:35:16: ReferenceCompartment: 0x0000000001545270: ++3 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3250
    [1392] 16:35:16: Leaving Start6to4InCompartment
    [1392] 16:35:16: Leaving: CompartmentRequirementChangeNotification6to4
    [1392] 16:35:16: Lock (0000000000000414) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [1392] 16:35:16: DereferenceCompartment: 0x0000000001545270 : --4 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [1392] 16:35:16: DereferenceService: --12 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [1392] 16:36:16: Get lock (0000000000000414) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [1392] 16:36:16: Lock (0000000000000414) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [1392] 16:36:16: DeferredStart6to4InCompartment: Woke up
    [1392] 16:36:16: Entered: CompartmentRequirementChangeNotification6to4
    [1392] 16:36:16: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [1392] 16:36:16: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [1392] 16:36:16: Start6to4InCompartment: Luid unspecified on attempt #1.
    [1392] 16:36:16: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [1392] 16:36:16: Creating a 6to4 interface...
    [1392] 16:36:16: InstallInterface: Installing interface (null)
    [1392] 16:36:16: Do install about to start (*6to4mp)
    [1392] 16:36:19: Failed to install (*6to4mp): 2147943850
    [1392] 16:36:19: ERROR: Cannot create 6to4 interface
    [1392] 16:36:19: ReferenceService: ++11 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [1392] 16:36:19: ReferenceCompartment: 0x0000000001545270: ++3 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3250
    [1392] 16:36:19: Leaving Start6to4InCompartment
    [1392] 16:36:19: Leaving: CompartmentRequirementChangeNotification6to4
    [1392] 16:36:19: Lock (0000000000000414) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [1392] 16:36:19: DereferenceCompartment: 0x0000000001545270 : --4 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [1392] 16:36:19: DereferenceService: --12 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [1392] 16:37:19: Get lock (0000000000000414) invoked at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212
    [1392] 16:37:19: Lock (0000000000000414) acquired at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3212. Return 0
    [1392] 16:37:19: DeferredStart6to4InCompartment: Woke up
    [1392] 16:37:19: Entered: CompartmentRequirementChangeNotification6to4
    [1392] 16:37:19: RequirementChangeNotification6to4: CompartmentId = 1, HaveGlobalIpv6Address = 0, ICSEnabled = FALSE, GlobalIpv4AddressCount = 1, Hence Required = TRUE.
    [1392] 16:37:19: Entered Start6to4InCompartment, Compartment 1, 6to4 luid is 0
    [1392] 16:37:19: Start6to4InCompartment: Luid unspecified on attempt #1.
    [1392] 16:37:19: CreateListOfInterfaceKeys: failed to open regkey for protocol type 1: 2
    [1392] 16:37:19: Creating a 6to4 interface...
    [1392] 16:37:19: InstallInterface: Installing interface (null)
    [1392] 16:37:19: Do install about to start (*6to4mp)
    [1392] 16:37:21: Failed to install (*6to4mp): 2147943850
    [1392] 16:37:21: ERROR: Cannot create 6to4 interface
    [1392] 16:37:21: ReferenceService: ++11 (QueueDeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3246
    [1392] 16:37:21: ReferenceCompartment: 0x0000000001545270: ++3 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3250
    [1392] 16:37:21: Leaving Start6to4InCompartment
    [1392] 16:37:21: Leaving: CompartmentRequirementChangeNotification6to4
    [1392] 16:37:21: Lock (0000000000000414) released at d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c : DeferredStart6to4InCompartment : 3223. Return 1
    [1392] 16:37:21: DereferenceCompartment: 0x0000000001545270 : --4 @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3226
    [1392] 16:37:21: DereferenceService: --12 (DeferredStart6to4InCompartment) @ d:\w7rtm\net\netio\iphlpsvc\service\6to4svc.c:3227
    [768] 16:37:30: SetHelperServiceStatus: Setting state to 3
    [768] 16:37:30: ServiceHandler: Got a SERVICE_CONTROL_STOP control
    [892] 16:37:30: Entered: OnStop
    [892] 16:37:30: OnStop: Synchronizing with startup.

    [892] 16:37:30: OnStop: Done synchronizing with startup, continuing...

    [892] 16:37:30: Entering StopHelperService
    [892] 16:37:30: Entered: DeregisterForGlobalConnectivityNotification
    [892] 16:37:30: Leaving: DeregisterForGlobalConnectivityNotification
    [892] 16:37:30: Entered: DeregisterForGlobalConnectivityNotification
    [892] 16:37:30: Leaving: DeregisterForGlobalConnectivityNotification
    [892] 16:37:30: Entering DeregisterNotificationHandlers
    [892] 16:37:30: DeregisterNotificationHandlers: Handler 1
    [892] 16:37:30: DeregisterNotificationHandlers: Disconnecting...
    [892] 16:37:30: Leaving DeregisterNotificationHandlers



    Cheers 

    Friday, January 08, 2010 6:13 AM
  • I had multiple problem with a Windows 2008 R2 (server core) virtual machine that was serving as a file server for other VMs (with pass-though physical disks). (1) After saving the VM in Hyper-V manager and then restoring it, the svchost process would consume almost 100% of a CPU, the nightly server backup would no longer work and eventually the machine would become unresponsive with accessing of file shares taking minute. Only a restart would then fix the problem. (2) Accessing a shared photo folder from another VM would result in strange thumbnail behavior where thumbnails would appear for a second and then most of them would be replaced by generic icons.

    I finally read that you can isolate the problem by sc <servicename> type - own isolation of processes. I then tracked the problem to the iphlpsvc process which would be solely responsible for the 100% CPU consumption.

    I followed the advice in this thread but it didn't fix it. Eventually, I just disabled the process. Now problem (1) went away - and so did problem (2) which I hadn't even connected to this issue.


    Monday, February 01, 2010 7:45 AM
  • Hi to solve this error (assuming that is exactly the same) you need a Fix from Microsoft.

    Read more here:

    http://srvcore.wordpress.com/2010/05/03/ip-helper-service-iphlpsvc-consume-more-than-expected-cpu/

     

     


    I hope that the information above helps you. This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.
    • Marked as answer by nrdfeeling Friday, May 07, 2010 10:12 PM
    Monday, May 03, 2010 4:21 PM
  • Microsoft recently released a public hotfix for this issue:

    IPv6 transition technologies, such as ISATAP, 6to4 and Teredo do not work on a computer that is running Windows Server 2008 R2 Server Core

    http://support.microsoft.com/kb/978309

    • Proposed as answer by Tod Edwards Friday, May 07, 2010 8:01 PM
    • Marked as answer by nrdfeeling Friday, May 07, 2010 10:13 PM
    Friday, May 07, 2010 8:01 PM
  • Hi to solve this error (assuming that is exactly the same) you need a Fix from Microsoft.

    Read more here:

    http://srvcore.wordpress.com/2010/05/03/ip-helper-service-iphlpsvc-consume-more-than-expected-cpu/

     

     


    I hope that the information above helps you. This posting is provided "AS-IS" with no warranties or guarantees and confers no rights.


    Thank you Mr Silva, that worked just fine.

     

    Friday, May 07, 2010 10:12 PM