Firewall Service (Wspsrv.exe) Problems with High S-NAT Client Load (290731)

SYMPTOMS

Many S-NAT socket mappings are created under heavy load, which can lead to heap corruption. This is caused by the double deletion of an S-NAT socket mapping because of a race condition in the threads that delete these mappings.

A race condition is a situation in a multiple-threaded environment in which the result of the execution depends on the order of execution among the threads. In such cases, if thread A wins the race it produces one result, but if thread B wins, it produces another result. The speed of each thread depends on the tasks each thread is performing, context-switches, page faults, and so on.

This issue could be caused by a program (or multiple programs) that sends many UDP or TCP packets to multiple destinations, all with ports that are primary UDP or TCP ports.

RESOLUTION

To resolve this problem, obtain the latest service pack for Microsoft Internet Security and Acceleration Server 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

313139 How to Obtain the Latest Internet Security and Acceleration Server 2000 Service Pack

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section of this article. This problem was first corrected in ISA Server Service Pack 1.