2
My Windows box has recently begun behaving strangely.
After being up for approximately 3-4 days, I am unable to make any outgoing TCP connections. Most applications without specific error handling will simply say "connection failed". Some investigation shows that the error is "No buffer space available."
An Event Log entry tells more of the story:
TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available local ports to be used and forcing TCP/IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP/IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to a given remote endpoint.
I ran netstat -qno
at an admin command prompt and saw the following:
Active Connections
Proto Local Address Foreign Address State PID
TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 972
TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:3389 0.0.0.0:0 LISTENING 592
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:6160 0.0.0.0:0 LISTENING 2808
... some more random TCP connections ...
TCP 0.0.0.0:49152 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49153 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49154 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49155 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49156 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49157 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49158 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49159 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49160 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:49161 0.0.0.0:0 BOUND 4
... 16,383 entries, all the way up to ...
TCP 0.0.0.0:65531 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:65532 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:65533 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:65534 0.0.0.0:0 BOUND 4
TCP 0.0.0.0:65535 0.0.0.0:0 BOUND 4
... some UDP stuff, nothing out of the ordinary ...
As you can see, it is indeed the case that every single TCP outbound port is in the BOUND
state, and the owning PID is 4
, which represents the System
process. (The same process is listening on e.g. port 445 for SMB connections.)
TCPView does not show any of these BOUND
connections, only otherwise active connections that were open prior to the issue beginning.
Full malware scan with Defender reports no issues.
I have already tried stopping any unnecessary services and closing any unused applications. Even logging out and back in does not resolve the problem. The only resolution is to reboot the system, and even then, it only resolves the problem for a few more days.
I do note that when typical user applications (e.g. Chrome) use outbound TCP ports, they do show up in the BOUND
state but they have the correct PID associated with them in Netstat. This seems to indicate either some serious malware or some kind of major bug in Windows.
Windows 10 1607.
What would be my next step in troubleshooting this issue?
I see you that you found your problem, but to answer "What would be my next step in troubleshooting this issue" you could've done some combination of packet capturing (e.g. WireShark) and process monitoring (e.g. SysInternals Process Monitor) to help narrow it down. â BrianC â 2017-05-12T05:02:10.600