Why does my XP system lose TCP/IP connectivity every night around 3 AM?

Question

Every night around 3 AM from the eventlog (Outlook complains it can't get to the exchange server) I lose all TCP/IP connectivity from my desktop. Other systems on the network still function, as well as the IP phone system plugged into the same hub, but not me.

And ipconfig /release and /renew gets me working again, so I'm able to handle DHCP broadcasts, but why would my IP get knocked out?

I'm an XP SP 3 32-bit system. Latest patches - EXCEPT that the latest SQLServer 2005 SP2 security patch is failing installing (for what its worth).

The only thing in the logs at the time related to networks is:

Event Type: Warning
Event Source:   Tcpip
Event Category: None
Event ID:   4226
Date:       11/6/2009
Time:       9:53:43 AM
User:       N/A
Computer:   HEIMDALL
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00   ......T.
0008: 00 00 00 00 82 10 00 80   ......
0010: 01 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

but that happens even when I'm working.

Ideas on how to diagnose this? Is there an "enhanced" TCP/IP diagnosis mode on the stack?

Answer 1

Since XP SP2, there are limits set on the number of concurrent and incomplete outbound TCP connection attempts. You can change the limit with this patch, but I'd recommend finding which programs are making all of these incomplete connections and fixing that instead. You can use the netstat command or Sysinternals TCPView to see what is making the connections.

Answer 2

Sounds like a possible issue with DHCP lease renewal. Windows machines often 'hiccup' if they've got open connections during a lease renew operation. Try increasing the default lease time from 1440 mins (24 hours) to something longer and see if the problem moves. I've had machines which seemed to just mysteriously disconnect from the network, and traced it down to my router's lease time. Even static DHCP leases didn't help, as they still expire and renew, although with the same IP each time. And recently, when using static leases, my router gives a 32bit 'infinite lease', 0xFFFFFFFF (ie, -1), which is proper by RFC-2131, and Windows thought the lease expired 1 second ago. Totally confused the Windows machines in the network.

Answer 3

Try adding a DHCP reservation on your router, or using a fixed IP. If that fails (and you're SURE the other computers aren't failing), try a newer network card driver, a different network cable, or a different network card. If you're still stuck, use wireshark to log all the packets in and out, and see if a certain packet is crashing the card driver or anything like that. Then use a power saving monitor to check if the card (or your whole computer) is going to sleep etc.

Answer 4

There is a setting on the network card which when checked allows Windows to turn off the NIC. Getting to the setting depends on the OS being used. On some XP machines (my experience is mainly with dell) there is a seperate icon in the control panel while in Vista it is in network and sharing..., network connections properties, advanced.

hope this helps

Answer 5

Do you have a fixed IP address?

In my case, when the ISP changes my IP address, all sort of side-effects can arrive, and connectivity may be lost for a period until the router and Windows come to a new agreement.

Answer 6

I guess the easy solution would to be to create a batch file containing the "ipconfig /release" and "ipconfig /renew" commands and put it into the Windows Task Scheduler to run every day just after 3 a.m.