I have a Windows 2016 server with TCP listener listening on multiple ports. I am running Wireshark 24/7 to determine root cause of three very rare issues that have appeared over the last four months:
Issue one - No data is being passed from OS to TCP listener. OS shows ports are open. Wireshark shows TCP sessions are established and accepting data.
Issue two - No data is being accepted by NIC. Wireshark shows TCP ZeroWindow originating from my server 100% of the time. Server resources (CPU/memory) are 2 to 10% utilized at any point in time. Restarting TCP listener does not fix. Disabling / enabling NIC fixes.
Issue three - This happened today and first time we found a log entry indicating something odd happened that matched timestamp in Wireshark. The server stopped receiving TCP data in Wireshark approximately 10:29 AM. It appeared that connections to remote clients simply terminated. The OS showed TCP ports were listening but nothing was established. I could telnet from another computer to server on TCP listener port. My computer connected to TCP port which normally would show in Wireshark but Wireshark displayed no TCP traffic on same port. I disabled and enabled NIC and Wireshark immediately showed TCP data flowing into my server (approximately 11:19 AM) and my TCP listener starting received data. Windows 2016 Event Viewer shows an event time matching up with Wireshark time when TCP data stopped being received.
1/29/2019 10:29:18 AM
The network interface "Intel(R) Ethernet Connection (2) I219-LM" has begun resetting. There will be a momentary disruption in network connectivity while the hardware resets.
Reason: The network driver requested that it be reset.
This network interface has reset 1 time(s) since it was last initialized.
I have two Intel NUCs (NUC8i7HNK) and both Intel NUCs have experienced issues one and two described above. Issue three happened today for first time.
I have a lab environment with same two Intel NUCs (NUC8i7HNK) that experience less volume than above NUCs and have not experienced any issues. The only configuration difference is that lab system has TCP listener configured on subnet A and TCP client sending data on subnet B. The NUCs experiencing issues are using single NIC on single subnet for both TCP listener and client.
I used SSU utility on NUC in lab and field, then compared. The lab has newer drivers / BIOS. I have attached SSU output from field NUC. If the drivers / BIOS updates could possibly fix issues then I will update. I read through release notes and nothing is specified regarding these issues.