Symptoms
Under certain circumstances, heavy usage of Winsock programs can cause non-paged pool memory to become exhausted. This behavior is likely to occur if the Winsock program is dealing with both Out-of-Band (MSG_OOB) and normal TCP traffic. This situation can cause various error messages and poor performance, and can cause the computer to stop responding (hang). Examples of possible error messages include:
Event ID: 2019
Source: Srv
Description: The server was unable to allocate from the system nonpaged pool because the pool was empty.
Event ID: 2000
Source: Srv
Description: The server's call to a system service failed unexpectedly.
Other events may not work and may generate status code 1450 ("Insufficient System Resources").
Cause
A non-paged pool memory leak occurs in Afd.sys if a Winsock program does not correctly post a Receive to collect the incoming data from Winsock. Afd.sys may endlessly buffer the data and use up all non-paged memory. Afd.sys should check the MaxBufferredReceiveBytes value for the socket and then not buffer more than this value.
Resolution
To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:
260910 How to Obtain the Latest Windows 2000 Service Pack
The English version of this fix should have the following file attributes or later:
Date Time Version Size File name
-----------------------------------------------------------
4/16/2001 04:40p 5.0.2195.3503 118,800 Afd.sys
4/16/2001 04:42p 5.0.2195.3417 104,720 Msafd.dll
4/9/2001 03:25p 5.0.2195.3475 311,472 Tcpip.sys
4/6/2001 05:55p 5.0.2195.3474 16,208 Tdi.sys
4/16/2001 04:42p 5.0.2195.2104 17,680 Wshtcpip.dll
Status
Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.
More Information
For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:
265173 The Datacenter Program and Windows 2000 Datacenter Server Product
For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:
296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot
You can identify this problem by following the instructions in the following Microsoft Knowledge Base article:
177415 How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks
The results show AfdB leaking non-paged pool over time:
Memory: 523816K Avail: 274204K PageFlts: 971 InRam Krnl: 1396K P:17256
Commit: 208392K Limit:1278740K Peak: 227040K Pool N:20284K P:17416
Tag Type Allocs Frees Diff Bytes Per Alloc
AfdB Nonp 288886 ( 17) 285160 ( 21) 3726 6887776 ( 2080) 1848
MmCm Nonp 26 ( 0) 3 ( 0) 23 1286432 ( 0) 55931
File Nonp 1521215 ( 546) 1513387 ( 467) 7828 1255584 ( 12640) 160
Irp Nonp 15969583 (6156) 15966363 (6211) 3220 1225088 (-11232) 380
TCPT Nonp 2010 ( 0) 0 ( 0) 2010 900480 ( 0) 448
The same problem exists in Microsoft Windows NT 4.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:
293841 Non-Paged Pool Is Exhausted by Afd
For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:
249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes
