Windows 10 loss of TCP connectivity

Question

I'm running Windows 10 professional with a Realtek PCIe GBE Family controller integrated on my MSI 170A-Pro mainboard. Usually everything is fine. The network works fine and interruption free on Linux and Windows. So the hardware seems to be okay.

However, I experience a loss of connectivity about once a day using Windows 10. The symptoms are a bit weird though:

• I cannot connect to any website in either Chrome or Internet Explorer (Chrome says ERR_CONNECTION_FAILED)
• except that Google usually works (probably because a connection to it is maintained by chrome)
• my Google Talk connection continues to work (it seems only to affect new connections)
• nslookup works fine for any domain
• I can ping the sites I want to browse
• I have a valid IPv4 and IPv6 address
• I can ping the default gateway on IPv4 and IPv6
• Windows Network diagnostics can not find any problems
• Windows says I'm successfully connected to the Internet
• other devices on the network continue to have no problems (it's not router related)

However the only solution is to either reset the network through the control panel option and reboot or by calling netsh winsock reset in an admin console and reboot. Rebooting alone does not solve the problem.

So far I did

• disable power management for the network card
• upgrade to the most recent driver from Realtek

I'm completely at loss what exactly is wrong. Because the network obviously works. There seems just to be certain part of it not working.

If anyone has any idea how to debug this further I'm all ears!

Please note this is a wired network

ipconfig output follows (it looks exactly the same when the connection works)

Windows IP Configuration


Ethernet adapter Ethernet:

   Connection-specific DNS Suffix  . : w00t
   IPv6 Address. . . . . . . . . . . : 2a02:2450:1024:442:808:aa56:5c13:9413
   Temporary IPv6 Address. . . . . . : 2a02:2450:1024:442:a5e3:4f74:fb29:5d13
   Link-local IPv6 Address . . . . . : fe80::808:aa56:5c13:9413%3
   IPv4 Address. . . . . . . . . . . : 192.168.1.165
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::1e87:2cff:fe6a:b6b0%3
                                       192.168.1.1

Tunnel adapter isatap.w00t:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . : w00t

Tunnel adapter Teredo Tunneling Pseudo-Interface:

   Connection-specific DNS Suffix  . : 
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:2cd7:1e65:3f57:fe5a
   Link-local IPv6 Address . . . . . : fe80::2cd7:1e65:3f57:fe5a%12
   Default Gateway . . . . . . . . . : 

Some additional information:

• when rebooting to Linux, the network connection works flawless there, rebooting back to Windows and the problem is still there
• completely powering off the machine does not solve the problem
• HTTP sites on my local network are not reachable as well
• the problem is DNS independent, sites are not reachable via IP address either
• SMB connections to a Windows-Share do not work either

To me it looks like the TCP-Stack of the Operation-System somehow "gets stuck". Ping (ICMP) and DNS (UDP) work, HTTP and SMB (TCP) don't.

This got me to try another thing: I tried to use PuTTY to ssh (TCP) to another machine and it brings up the error: Network error: No buffer space available

Above error pointed me to https://serverfault.com/questions/131935/network-error-no-buffer-space-available which in turn led me to check the Event Viewer which shows Error 4227:

TCP/IP failed to establish an outgoing connection because the selected local endpoint was recently used to connect to the same remote endpoint. This error typically occurs when outgoing connections are opened and closed at a high rate, causing all available local ports to be used and forcing TCP/IP to reuse a local port for an outgoing connection. To minimize the risk of data corruption, the TCP/IP standard requires a minimum time period to elapse between successive connections from a given local endpoint to a given remote endpoint.

When disabling and re-enabling the device (which the knowledge base entry suggests) the error simply reoccurs in the log.

It seems like some program is exhausting the available outgoing TCP ports. So the questions become:

• how to figure out which program is the culprit?
• why wouldn't a reboot solve this problem?

Answer 1

EventID 4227 seems related to too many outstanding TCP connections.

Not an answer, but the following first steps are too long for a comment:

1. Run sfc /scannow
2. In Device Manager delete the network adapter and reboot
3. Use TCPView to see outgoing connections when this happens
4. Increase maximum of outgoing connections by setting TcpNumConnections and see also the other parameters described in this article
5. Disable IPv6
6. Restart Chrome
7. Start Windows in Safe mode with network and if this stops happening then some installed application is to blame
8. Use Chrome in incognito mode to temporarily disable extensions
9. Try Firefox
10. Do you have many tabs open? Or when this is happening do you always have one particular website open?

The results of the above may help with localizing the problem.

Answer 2

Try to stop and disable "IP Helper" service and disable(uncheck) in property of adapter IPv6 protocol.

Answer 3

I recently had this problem with a similar set of symptoms:

• PuTTY: Network error: No buffer space available
• Tcpip: Event ID: 4227
• Bitdefender Antivirus: Update Error: -100

In my case rebooting did temporarily fix the problem, for about 6 hours.

I tried the registry/netsh suggestions from this thread without success.

After a week of troubleshooting (CurrPorts and Process Hacker were useful tools), I narrowed down the problem to the monitoring of router traffic with SoftPerfect NetWorx using UPnP. Strangely, I had been using this combination without problem for years.

My solution was to disable UPnP on my router and switch to monitoring traffic with NetWorx using SNMP.

---

UPDATE: With the switch to SNMP the network connection is fine for about 3 days before the problem returns, forcing a reboot.

---

UPDATE: I believe I have now resolved the issue, regularly going two weeks without this problem occurring.

The changes made include:

• Created the registry key:
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters] "StrictTimeWaitSeqCheck"=dword:00000001

  You must set the StrictTimeWaitSeqCheck to 0x1 or the TcpTimedWaitDelay value will have no effect. (source)

• Stopped visiting social networking websites that were using excessive connections or lots of half-open connections (SYN flood?)
• Removed a Firefox extension (Kee - Password Manager) that was creating lots of half-open connections (SYN flood?)
• Monitoring processes for high handle count (Stickies and Desktop Info steadily creep up)
• Disabled services:
  • UPnP Device Host (no longer needed for NetWorx)

    Allows UPnP devices to be hosted on this computer. If this service is stopped, any hosted UPnP devices will stop functioning and no additional hosted devices can be added. If this service is disabled, any services that explicitly depend on it will fail to start.

  • SSDP Discovery (not needed because UPnP Device Host disabled)

    Discovers networked devices and services that use the SSDP discovery protocol, such as UPnP devices. Also announces SSDP devices and services running on the local computer. If this service is stopped, SSDP-based devices will not be discovered. If this service is disabled, any services that explicitly depend on it will fail to start.

  • RIP Listener

    Listens for route updates sent by routers that use the Routing Information Protocol version 1 (RIPv1).

  • IP Helper

    Provides tunnel connectivity using IPv6 transition technologies (6to4, ISATAP, Port Proxy, and Teredo), and IP-HTTPS. If this service is stopped, the computer will not have the enhanced connectivity benefits that these technologies offer.

Of all these changes I think disabling the IP Helper service had the greatest effect. My ISP has limited support for IPv6, but I'm not sure if this is relevant.

---

On a side note, I also discovered changing the following settings for Firefox stopped it from hogging nearly all my RAM (16 GiB, Core i7-2600 CPU):

• dom.ipc.processCount = 2 (default was 8)
• dom.ipc.processCount.web = 1

Having more content processes can improve performance when using multiple tabs but it will also use more memory. (source)

Answer 4

Just in case: do you have any kind of firewall or antivirus which could block https communication? I once had a similar problem with my antivirus, which was blocking all of my https communications, filtering them like it was a man-in-the-middle attack..

I could not understand why, but trying disabling the antivirus for a minute, I noticed I could browse again..

PS: if you have problems only with some https sites, try checking if they are using old or invalid SSL certificated...

[edit] Ok, no antivirus, so let's try other options..

• You say that a simple reboot (without powering off the system) doesn't solve the problem.. but what if you completely power off the system and then switch it on after some seconds? I had headaches with stuff not properly resetting onless completely powered off... you might want to check it.

• If you have other computers on the same local network, try checking if you can connect to them (when you experience the problem you're dealing with)

• you don't say how you connect to internet: I'm supposing a shared connection through a router... are you able to surf the web from other devices on the same conection, when you hit the problem on that pc?

• If you have other connections (wifi, usb-to-ethernet adapter, etc..), you could try using one of those for a while and see if it still happens (In my win10 system I had to give up using my integrated network card because its driver was often triggering blue-screens and there wasn't a win10 version)

• I'm not strong on IPv6, but I had issues in the past with it.. in case you don't use it, you can also try disabling the IPv6 stack and only use IPv4

• When you experience network lock-ups, you can also check open connections with the netstat command and see if you notice something strange..

Hope this helps