dslreports logo
 
    All Forums Hot Topics Gallery
spc
Search similar:


uniqs
21374

evilpeppard
Always Fight For Freedom
Premium Member
join:2003-08-20
Aurora, CO

evilpeppard

Premium Member

[Windows] TCP/IP Error with Event ID 4227

I did a search here in the networking section of DSLR, but didn't find anything.

I also have responded to this same issue over on the Windows 8 forums: »www.eightforums.com/netw ··· st306663

Here is the issue: About every 4-6 days I start getting the 'error 4227' in my Windows Event log: 'Warning, TCP/IP, Event 4227: TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint'.

I can always tell when the issue starts because I can no longer remote into my home computer from work using LogMeIn. After I found this thread, I decided before I did anything else, to close Chrome, and the ~25 tabs I had open at the time. Within just a few moments, all my internet connections, and other network connections started coming back online. I didn't reboot or anything, I simply closed Chrome and left Chrome closed.

I have been chasing this problem for a while now, trying to narrow down what was using all my TCP/IP ports up. When I would reboot my computer, the first thing I would do was reopen all the windows I previously had open, including all the tabs I was in while using Chrome. I figured this must be when the countdown to all my TCP/IP ports being used up starts, so when I get to 4-6 days in, I start having network/internet port issues. I never realized leaving my internet browser (Chrome) open with several tabs would cause this problem.

Although many of my local network services restored themselves after closing Chrome, it appears my Internet is still not fully functional. It looks like I will still have to either bounce my NIC, or reboot my machine to fully restore functionality. So, although closing Chrome helped, it was not the the only culprit. Something else is still not releasing all my TCP/IP ports.

After I got home I still had to reboot my computer to fully regain Internet connectivity, so all the ports were not released. I still would like to figure out what is doing this, since I run with a ton of stuff open on my work computer, including ~30 open tabs in Chrome, and my computer stays up for a month or more before I reboot it for security updates. My work computer (also Windows 8.1) never has any issues, so the problem on my home computer must be larger than just leaving Chrome open for a few days with a bunch of tabs. My wife's computer (Windows 8.1) is up for weeks at a time with several things open too, yet she never has the issue of running out of TCP/IP ports either.

In all my research I have also read the problem could be attributed to either a bad NIC card, bad network cable, or a need for upgraded NIC drivers on my current NIC. Anyone want to weigh in on this perspective? I don't want to go buy a new NIC arbitrarily without having a better idea of what my issue may be.

To summarize, I am running Windows 8.1 Pro, with all the latest Windows updates. This is my gaming rig, but I also have other things running on it like Steam, Mumble, Trillian Pro, Argus Monitor, Moo0 system monitor, eMClient (email), Chrome, Internet Explorer (Work OWA email), Logitech Gaming Software (keyboard and mouse config software).

I have MalwareBytes Pro loaded with 'real time' protection running. I have run several FULL system scans on my computer, always coming back clean. I have tried three different versions of NIC drivers for my Broadcom NetLink Gigabit Ethernet adapter, and the problem continues to persist.

My next step is to buy a new Intel NIC and install it to see if that stops my issue, unless there is more info I can provide here to assist with a solid diagnosis.

Thanks in advance for any suggestions or feedback.

Nubiatech
soy capitan
join:2007-09-02
Chicago, IL

Nubiatech

Member

On the surface it looks like your computer is running out of outbound tcp endpoints. This is most likely due to a buggy process/application.

The maximum number of outoubnd tcp connection on a Windows machine is controlled -for the most part- by 2 settings:

MaxUserPort: This is the maximum number of availabe ports. Default is 5000.

TcpTimedWaitDelay: Quote: "Determines the time that must elapse before TCP can release a closed connection and reuse its resources.", "Reducing the value of this entry allows TCP to release closed connections faster, providing more resources for new connections. However, if the value is too low, TCP might release connection resources before the connection is complete, requiring the server to use additional resources to reestablish the connection."
The default value is 240 seconds = 4 minutes.

You can start by using this tool: Windows Sysinternals TCPView, which is pretty much an enhanced gui version of netstat.
So when you see the error, just run this tool. The important things to look for are the total number of endpoints used, and second, try to somehow find out if there is a process that is opening and closing endpoints at a very rapid rate. This won't be easy using this tool; you may want to experiment with Wireshark or Microsoft Network Monitoring tools to get proper traffic capture for analysis if you prefer.

Can you please share with us what are the current values of:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\MaxUserPort
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\TcpTimedWaitDelay
if any?

evilpeppard
Always Fight For Freedom
Premium Member
join:2003-08-20
Aurora, CO

evilpeppard

Premium Member

Yes, you are correct in the fact that my machine appears to be running out of TCP ports.

I just downloaded TCPView so I can run that when the problem happens and get a better idea of what processes are using my ports. I have run Netstat, but honestly, I really do not know what I am looking for, so I don't know if something is out of place, or if a program is using ports like it should.

For the values you requested,

MaxUserPort = there is nothing listed. I have no value listed, or even set.

TcpTimedWaitDelay = Again, nothing listed. I have no value listed, or even set.

Please let me know what else I can provide. Thank you again for your assistance.