TCP queries fail - BIND 9.5.0 Windows Server 2003

[Danny Mayer]

Jukka Pakkanen wrote:
> From: "Danny Mayer" <mayer at ntp.isc.org>
>> Jukka Pakkanen wrote:
>>>> Note that based on the error you may have run out of Windows handles. If 
>>>> you can monitor named, check the number of handles that it's using. This 
>>>> is not shown by default in the task manager, you have to add the column 
>>>> handle count in from the View->Select Columns menu. While you are at it 
>>>> add the thread count. This will give an idea of whether there is a 
>>>> handle problem. Also run netstat -aon and count the number of open 
>>>> sockets by named.
>>> Unfortunately Windows netstat don't show the process owner, but looking 
>>> the ports there are only a couple open socket by named.
>>>
>> The -o option shows you the PID of the application using the port. You can 
>> lookup the PID of named.
> 
> Ok, here are the sockets for named, PID 972:
> 
> Active Connections
> 
> Proto Local Address Foreign Address State PID
> 
> TCP 62.142.220.8:53 0.0.0.0:0 LISTENING 972
> 
> TCP 62.142.220.8:953 0.0.0.0:0 LISTENING 972
> 
> TCP 127.0.0.1:53 0.0.0.0:0 LISTENING 972
> 
> TCP 127.0.0.1:953 0.0.0.0:0 LISTENING 972
> 
> UDP 0.0.0.0:1064 *:* 972
> 
> UDP 0.0.0.0:4953 *:* 972
> 
> UDP 0.0.0.0:5106 *:* 972
> 
> UDP 0.0.0.0:6274 *:* 972
> 
> UDP 0.0.0.0:16667 *:* 972
> 
> UDP 0.0.0.0:17948 *:* 972
> 
> UDP 0.0.0.0:18302 *:* 972
> 
> UDP 0.0.0.0:30470 *:* 972
> 
> UDP 0.0.0.0:31069 *:* 972
> 
> UDP 0.0.0.0:33660 *:* 972
> 
> UDP 0.0.0.0:38302 *:* 972
> 
> UDP 0.0.0.0:47613 *:* 972
> 
> UDP 0.0.0.0:48802 *:* 972
> 
> UDP 0.0.0.0:48902 *:* 972
> 
> UDP 0.0.0.0:58667 *:* 972
> 
> UDP 0.0.0.0:61738 *:* 972
> 
> UDP 0.0.0.0:64136 *:* 972
> 
> UDP 62.142.220.8:53 *:* 972
> 
> UDP 127.0.0.1:53 *:* 972
> 
> 

Interesting. That's not a lot at all.

> 
>>> Task manager show for this server (2G of RAM, run 2 days) following 
>>> numbers:
>>>
>>> Mem usage 839 488 K (and rising every cycle)
>>> Handles 3466
> 
> Today, 30 hours later these are 1 259 599 K (so well over a gig already...) 
> and 3545.
> 

This is worrying. Something's eating handles.

> And these are just for the named process.
> 
>> This is likely to be a problem. Once you run out of handles you cannot do 
>> very much including opening new sockets. The only other application that I 
>> know of that uses handles in such wild abandon is Outlook and that's 
>> absolutely absurd. I did once catch it with something like ~700 open 
>> sockets, but that's a different story.
>>
>>> Threads 13
>> How many CPU's on the system? This sounds like it's using quite a few TCP 
>> ports. Are you sure you only have a few open ports? The other tool that I 
>> use is cports, but the version I have doesn't support IPv6 but it's useful 
>> for things like this.
> 
> Two dual-core Xeon processors, so Windows sees 4 "processors". FSC RX300 
> server.

That's 3 threads more than I might expect though maybe that's in the 
task manager. I should check that with my dual-CPU.

Danny