Windows 2000 Non-Paged Pool Is Exhausted by Afd.sys (296265)


The information in this article applies to:

  • Microsoft Windows 2000 Server SP1
  • Microsoft Windows 2000 Server SP2
  • Microsoft Windows 2000 Advanced Server SP1
  • Microsoft Windows 2000 Advanced Server SP2
  • Microsoft Windows 2000 Professional SP1
  • Microsoft Windows 2000 Professional SP2
This article was previously published under Q296265

SYMPTOMS

Under certain circumstances, heavy usage of Winsock programs can cause non-paged pool memory to become exhausted. This behavior is likely to occur if the Winsock program is dealing with both Out-of-Band (MSG_OOB) and normal TCP traffic. This situation can cause various error messages and poor performance, and can cause the computer to stop responding (hang). Examples of possible error messages include:
Event ID: 2019
Source: Srv
Description: The server was unable to allocate from the system nonpaged pool because the pool was empty.

Event ID: 2000
Source: Srv
Description: The server's call to a system service failed unexpectedly.
Other events may not work and may generate status code 1450 ("Insufficient System Resources").

CAUSE

A non-paged pool memory leak occurs in Afd.sys if a Winsock program does not correctly post a Receive to collect the incoming data from Winsock. Afd.sys may endlessly buffer the data and use up all non-paged memory. Afd.sys should check the MaxBufferredReceiveBytes value for the socket and then not buffer more than this value.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows 2000. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

260910 How to Obtain the Latest Windows 2000 Service Pack

The English version of this fix should have the following file attributes or later: 
   Date        Time        Version       Size     File name
   -----------------------------------------------------------
   4/16/2001   04:40p   5.0.2195.3503   118,800   Afd.sys
   4/16/2001   04:42p   5.0.2195.3417   104,720   Msafd.dll
   4/9/2001    03:25p   5.0.2195.3475   311,472   Tcpip.sys
   4/6/2001    05:55p   5.0.2195.3474    16,208   Tdi.sys
   4/16/2001   04:42p   5.0.2195.2104    17,680   Wshtcpip.dll

STATUS

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article. This problem was first corrected in Windows 2000 Service Pack 3.

MORE INFORMATION

For additional information about how to obtain a hotfix for Windows 2000 Datacenter Server, click the article number below to view the article in the Microsoft Knowledge Base:

265173 The Datacenter Program and Windows 2000 Datacenter Server Product

For additional information about how to install multiple hotfixes with only one reboot, click the article number below to view the article in the Microsoft Knowledge Base:

296861 Use QChain.exe to Install Multiple Hotfixes with One Reboot

You can identify this problem by following the instructions in the following Microsoft Knowledge Base article:

177415 How to Use Poolmon to Troubleshoot Kernel Mode Memory Leaks

The results show AfdB leaking non-paged pool over time: 

Memory:  523816K Avail:  274204K  PageFlts:   971   InRam Krnl: 1396K P:17256
 Commit: 208392K Limit:1278740K Peak: 227040K            Pool N:20284K P:17416
 Tag  Type     Allocs            Frees            Diff   Bytes      Per Alloc

 
 AfdB Nonp     288886 (  17)    285160 (  21)     3726 6887776 (  2080)   1848
 MmCm Nonp         26 (   0)         3 (   0)       23 1286432 (     0)  55931
 File Nonp    1521215 ( 546)   1513387 ( 467)     7828 1255584 ( 12640)    160
 Irp  Nonp   15969583 (6156)  15966363 (6211)     3220 1225088 (-11232)    380
 TCPT Nonp       2010 (   0)         0 (   0)     2010  900480 (     0)    448

The same problem exists in Microsoft Windows NT 4.0. For additional information, click the article number below to view the article in the Microsoft Knowledge Base:

293841 Non-Paged Pool Is Exhausted by Afd

For additional information about how to install Windows 2000 and Windows 2000 hotfixes at the same time, click the article number below to view the article in the Microsoft Knowledge Base:

249149 Installing Microsoft Windows 2000 and Windows 2000 Hotfixes

Modification Type:MinorLast Reviewed:9/26/2005
Keywords:kbHotfixServer kbQFE kbbug kbfix kbnetwork kbWin2000PreSP3Fix kbWin2000sp3fix KB296265
©2004 Microsoft Corporation. All rights reserved.