Client Shutdown Causes Ghosted TCP/IP Connection

• Microsoft Windows NT operating system version 3.1
• Microsoft Windows NT Advanced Server version 3.1

SYMPTOMS

Even though you turn off a Windows NT TCP/IP client computer, a TCP/IP server continues to show a "ghosted" connection to the client. For example, services such as FTPSVC show users still logged on, even though they have powered off their computers.

CAUSE

If a TCP/IP client application stops accepting data, the TCP/IP stack will buffer a "TCP Windowsize" amount of data on the client before reporting a "zero window" back to the sending computer. The sending computer will then stop and wait before sending more data. Periodically, it will attempt to send 1 more byte as a test to see if the client has recovered. This is called "probing" the window. If the client is turned off while the connection is in this state, Windows NT will not time out the connection until the client comes back up.

WORKAROUND

To work around this problem, manually disconnect sessions that have become ghosted.

NOTE: If the client machine is turned back on (with the same IP address), it will respond to a window probe with a RST (TCP reset) which will cause the connection to be cleaned up. Ghosted or stuck sessions should only occur when the client does not comes back up.

STATUS

Microsoft has confirmed this to be a problem in Windows NT and Windows NT Advanced Server version 3.1. This problem has been corrected in Windows NT Workstation and Windows NT Server version 3.5.