TCP/IP stack ran out of memory

I have been working on this stupid issue for past 7 days now but nothing seems to be working so any help will be appriciated.

Here is the situation

1. Our Enviorment Cisco switches and routers.
2. Workstations all Win2k al of them Service pack 2 or higher.
3. Norton Enterprise 7.5 (these are the users with this problem but i did upgrade some of them to 8.0 to see if this solves the issue but did not work)
4. Lotus Notes 5.0

Here is wot happens. users log in and they may or may not get this error. Not all the users are gettign this message either. But who ever gets it once will get it again most probably the same time again tommorw. We can not duplicate or brake the machine at will either. But after you get this message once all the outbound traffic except ping stops from that computer. Like telnet,internet,lotus etc.

any help will be greatly appriciated.

 

Could you post the entire error from your event log? Just open an event, click on the icon below the up/down arrows, and paste that into a post here.

 

you see that is the funny/strange part there is no event in the event log that points to this error message. All the events in there point to stuff that the computer wants to do after this has happened. Like it has an error about Domain controller not found, not able to sync the clock of the system and as such. I will post them first thing tommorw morning.

Error message is " TCP/IP stack ran out of memory" then after this there is a explnation of some kind from wot eva application you were in to suggest some generic fixes but they dont't work. Like if you arfe in notes it says MAX_SESSIONS limit has reached go edit Notes.ini and change the number of sessions and even after that it does not work.

i did find one piece of info on Notes forum that said to change my config.sys file and change the value of stacks=65,210. I changed it but i am not sure if this will work we are on win2k envoirment.

The other strange thing is that this error message occured only at win95, 98 and early versions of Lotus notes 4.6, R5.1 and stuff. We are using windows 2k with service pack 3 or higher.

One more thing i forgot to mention is this thing is replicating to more and more computers every day. In a week it has effected 35 users.

 

strange indeed, havn't seen stack errors since 9x

some random troubleshooting thoughts;

didnt competetly understand last post; only 9x clients having the stack errors? win2k/XP clients not having problem?

any chages to the switchs/routers before these symptoms began?

 

Naaa nothing has been changed. But if it was changed it should effect all computers at once not some at a time right. Two computers with the same configurtion on the same switch and the same blade one may have the problem and one may not.

and we do not have any 9x machines on our network only win2k. I was just saying that after doing some research on the web i found that the error we are getting is linked with 9x machines and no one has seen it on win2k.

oh well if you thought the above message was strange wait till i add a little more detail.

We have a VPN setup and also a DCN for dialup. Now the same win2k laptop that gets the error while it is on our LAn when the user is home connected via VPN gets this message randomly as well and the strange part is if user is using a home router (Linksys, Netgear etc) it will freeze the router so that users other computer on his home network will not be able to surf or telnet and stuff. But if the users resets the router and does nothing to the win2k laptop he can use the latptop again and his other comptuers on the home lan start working as well this thing is getting stranger by the minute.
Now if the same user using the same laptop connects to our network via DIALUP he does not get this error.

 

Are you using static IP's on the stations, if DHCP, is it coming from a Router or a PC dishing out IP's.

Do you have Server on this Network or is it peer to peer? If so what kind of server, 2K or Novell?

Do you have a Domain controller?

How many stations?

While we wait for these answers try the below in the interim.

Two possible work arounds.

1. If you are using DHCP switch to static IP. Especially if a small number of stations.

2. Install the Netbeui protocol

Mike

 

We have a pure windows 2k domain.

We have one parent domain controller there are no workstations on that domain just one server. Then we have a child domain where all the workstations are. WE have multiple sites and it is happening on one other site that i know of. So it is happening at Arlington (My current site) and Greenbelt (anohter site).

1. We are all static.
2. Network is not peer to peer it is server based we have file/print services.
3.Over all we have around a 1000 clients. In Arlington site we have about 250 clients and in green belt about 150. In Arlington only 36 are effected so far.

As we are already on Static so i cant try the first solution.
Why NetBeui though? I will try it but i am not sure why would that effect anything?

 

Ok since your original message gave no indication of the size and span of you system it sure helps.

Static IP huh in that size operation.

Why Netbeui? Well Netbeui is a non routable protocol. Does not need the TCP/IP Stack and could relieve this for those that do.

You may have things configured that may not allow everything to work properly with Netbeui.

You want to try this in a managable group of course untill you see the results.

So do it only on a local workgroup to confine it to a manageable size to see just what it will do, cure the problem or cause other problems or even cure this problem but still break something else.

And as you probably know in the Diagnostic proceedure just knowing that something can correct a problem even if causing others is a step in understanding the entire problem.

Please don't take this wrong, but you have made sure you are not having excessive Collisions on the Switch/Hubs or Spy/Adware proliferating on the LANS.

Or a network Virus?

Or even users in the habit of keeping multiple windows open to streaming video/audio? Typically this would only degrade performance but along with other factors could be the Straw that broke...


Mike

 

The reason we are static is still a Mystery to me too our Corporate Secuirty decided static is more safe and that was the end of that.

well i can install Netbui but all our users are on diffrent floors and Netbui traffic is not allowed across the gateway routers so enabling Netbui will nto help at all becasue all our servers are on a diffrent subnet then clients.

No collision on the switches we have Cisco 2900 in our closets and 5500 in the main server room.

For Anti Virus we are using Norton Enterprise solution. It did not pick any viruses and we tested those clients with other virus softwares as well and no virus. But are you talking about may be there is a Virus for the Network elements? Like something that works in the IOS of cisco or something? If you are i have never heard of them can you point out any websites or any other knowledge material for that.

Last is the bandwidth usage we have network traffic monitors and they are showing that the max network utilization is still under 50% of the full capacity so we are ok in that regard.


and thanx alot for all the creative thought and help.

 

Oh I agree with the static IP decision. It is just that it takes more work to support etc, but it is for sure the best way to go for control!

OK! I understand about the netbeui.

Got me stumped so far but that is easy! Smile!

I was only refering to a network Virus like Codered or Slammer.

Did you forget to tell me that you have Web Servers running?

Mike

 

well if i start to write what kind of servers we are running on the netwrok we will haev to open another forum but yes we do haev web servers serving our intranet web sites. and also we have a DMZ zone that we have some web servers that have web servers that host internet websites.

we also haev tons of unix servers. But i don't have much info about those.

naaa code red and stuff we have checked for them and we have a very strict virus policy so there are definelty no windows Viruses floating around in our enviorment.

 

Did not want nor should you post specifics about this.

Then if you have Web Servers ( which use bu cu stacks) then you should look into Load balancing, or if you are already using it you should look at the config.

This probably your issue!

EDIT! Do not assume that since you have less than 50% utilization of the LAN that the Web Server can not individually be maxed.

http://www.webtechniques.com/archives/1998/05/engelschall/

http://www.microsoft.com/windows2000/techinfo/howitworks/cluster/nlb.asp

I have been home today with a really really bad cold or the flu, so this is about all I felt like doing. But now I am becoming hungry (maybe a good sign) so off to the shower and then to find a Heiniken and something to eat.

May not be back for a few hours.

Good luck!

Mike

PS if you have time just visit BillyBobs thread in support of our troops! http://windowsbbs.com/showthread.php?s=&threadid=16101

 

we are already doing hardware load balancing on the web servers using the switches.

But wot i did not get is wot load balancing of WEB SERVERS has to do with my problem? Are you thinking the traffic from and to those webservers is causing this? Well our web servers are just normal PHP based web servers no heavy flash no heavy graphics or anythign and especailly no videos either so i doubt it that LB is causing this.

 

ok i found a solution for this issue. We have a Landesk server running that we use for inventory tracking, remote control and distributing software update packages to clients. The client part of the landesk on workstation for some reaon had gone bisarkee and was sending 40 packets per secodn to landesk server although they weere small in size 60 bytes each but still that was alot of traffic so i disabled some featires of landesk on the cleint side and sure enough the errors went away. So i think this TCP/IP stack error does not have one casue in our case it was landesk but in another envoirment it could be some other network application gone mad.