none
Multicast UDP packet drop since KB2962478 installation? RRS feed

  • General discussion

  • Hi,

    I'am experiencing some udp packet drop in my organization.

    We have several windows sever 2008r2 sp1 with 10G NIC card, alla was wroking fine let say just before deploying some hotfixes recently.

    UDP packet loss begin just after this patch deployment :

    Patch         Impacted Component
    MS14-030  Vulnerability in Remote Desktop Could Allow Tampering (2969259)
    MS14-031  Vulnerability in TCP Protocol Could Allow Denial of Service (2962478)
    MS14-032  Vulnerability in Microsoft Lync Server Could Allow Information Disclosure (2969258)
    MS14-033  Vulnerability in Microsoft XML Core Services Could Allow Information Disclosure (2966061)
    MS14-034  Vulnerability in Microsoft Word Could Allow Remote Code Execution (2969261)
    MS14-035  Cumulative Security Update for Internet Explorer -  IE6 to IE11
    MS14-036  Vulnerabilities in Microsoft Graphics Component Could Allow Remote Code Execution (2967487)

    I suspected this one particularly kb2962478 (tcp DoS) so we rollback all the list of patch above + restart, but this dont solve the issue.

    After some googling I noticed the existence of this KB that solve unicast udp packet drop :

    KB2876284

    I deployed it on several machines, this decrease the number of packet dropped but we are still facing the issue.

    I did some searches about that and find that it could be because of :

    -My NIC that is  not enough fast for processing the flows (normally not, i have a receive buffer = 2048 now and we dont experiment packet drop on all machines !)

    -Application that work only with one thread so when it's busy it cannot process the incomming udp packet (i plan to force the udp buffer by setting registry keys and test)

    -Windows kernel that is too slow for processing the flow ?

    As i dont know really what changes are done by the installation of this KB, i also dont know if when it rolled back i have an initial status or not , its dificult for me to check.

    If some one have any idea I't ll be appreciated

    Regards

    Thursday, August 7, 2014 10:11 AM