Multiprocessor Computer May Hang Because of Tcpip.sys

• Microsoft Windows NT Workstation version 4.0
• Microsoft Windows NT Server version 4.0

SYMPTOMS

A multiprocessor computer running Microsoft Windows NT version 4.0 may appear to stop responding (hang) when subjected to heavy TCP/IP stress. The system will continue to respond to PINGs, but higher level TCP/IP activity will be blocked. If other network protocols are installed, the system may continue to function normally except for activities that depend on TCP/IP.

CAUSE

For this problem to occur, a process must have an open handle to an address and an open handle to a connection and must try to close both simultaneously (as, for example, might happen at process termination). Under very specific and timing-dependent situations, Tcpip.sys can become deadlocked, blocking further work by the driver. When this happens, other parts of the system will typically continue running for a period of minutes or longer until higher level services that depend on Tcpip.sys also become blocked, waiting for the driver.

RESOLUTION

Obtain the following fix or wait for the next Windows NT service pack.

This fix should have the following timestamp:

   11/21/97  03:45 PM               143,408 Tcpip.sys  (Intel)
   11/21/97  03:42 PM               263,248 Tcpip.sys  (Alpha)

NOTE: This hotfix is superseded by the fix referred to in the following article in the Microsoft Knowledge Base:

   ARTICLE-ID: Q179129
   TITLE     : STOP 0x0000000A or 0x00000019 Due to Modified Teardrop
               Attack

STATUS

Microsoft has confirmed this to be a problem in Windows NT version 4.0. A supported fix is now available, but has not been fully regression tested and should be applied only to systems experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft recommends that you wait for the next Service Pack that contains this fix. Contact Microsoft Technical Support for more information.