Hi, I'm using UE 2.1 under XP Pro SP3 (5512). I have one NG server and two tasks. Even when idle, UE continually creates sockets which are abandoned in a half-open state before the program is terminated. When the number reaches around 110, my ISP blocks further access. Terminating the program and waiting as long as 48 hours does not destroy the sockets; I have to restart Windows (every 5 or 6 days). I have set HKLM...TimedWaitDelay to 120, which helps with TIME_WAIT, but not FIN_WAIT_2. Why does UE accumulate connections while doing nothing but getting new headers, and whose responsibility is it to close them?
This is what it looks like after the program is started and left alone for 15 hours:
C:\>netstat -o
Active Connections
Proto Local Address Foreign Address State PID
TCP xpp:1246 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:1247 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:1488 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:1751 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:1985 nnrp-virt.nntp.sonic.net:nntp ESTABLISHED 5152
TCP xpp:2776 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:2777 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:2819 nnrp-virt.nntp.sonic.net:nntp TIME_WAIT 0
TCP xpp:2892 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:3086 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:3412 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:3510 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:3511 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
TCP xpp:4496 nnrp-virt.nntp.sonic.net:nntp FIN_WAIT_2 5152
C:\>tasklist /fi "PID eq 5152"
Image Name PID Session Name Session# Mem Usage
========================= ====== ================ ======== ============
UE.exe 5152 Console 0 118,336 K
C:\>
Thanks for any suggestions!
-Steve
FIN_WAIT_2 problem
"Terminating the program and waiting as long as 48 hours does not destroy the sockets"
so it is not the program.
it might be firewall or router.
does it happen only when you cancel tasks yourself or you exit the program with sockets open?
if you don't cancel any tasks and if when you before you exit the program you set number of total tasks to zero (edit menu->properties->tasks) and wait until all tasks are finished, you don't see any sockets?
if restarting windows clears those sockets then it is more likely firewall than router.
UE issues closesocket command on every socket, but also every socket is closed when you exit the application (naturally, if not it would be very strange to have any application even without drivers to be able to have some undeletable traces left in the system, it is not logical).
so it is not the program.
it might be firewall or router.
does it happen only when you cancel tasks yourself or you exit the program with sockets open?
if you don't cancel any tasks and if when you before you exit the program you set number of total tasks to zero (edit menu->properties->tasks) and wait until all tasks are finished, you don't see any sockets?
if restarting windows clears those sockets then it is more likely firewall than router.
UE issues closesocket command on every socket, but also every socket is closed when you exit the application (naturally, if not it would be very strange to have any application even without drivers to be able to have some undeletable traces left in the system, it is not logical).
Alex, many thanks for your speedy reply.
I dug further and have made some progress. It seemed odd that my firewall was logging packets to & from a port UE had used -- after UE was closed with File>Exit. I then disabled my ethernet adapter and all the orphaned sockets immediately disappeared. Then when I reenabled it, my firewall reported what it thought was a port scan: 6 or more connections to closed ports -- from my news server -- while UE was not running. I will take the issue up with my ISP. At least I have found an easy workaround, thanks to your comments.
-Steve
================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\system.log:
.
.
.
2008/07/02 18:30:00 [ue.exe:5152] process terminated 0001021E/5152
2008/07/02 18:31:01 [cmd.exe:4608] start process 00028EF7/5260 "C:\WINXPP\SYSTEM32\NETSTAT.EXE"
2008/07/02 18:31:01 process info 00028EF7/5260 <- 00003858/4608 [C:\WINXPP\SYSTEM32\NETSTAT.EXE] "netstat -o"
2008/07/02 18:31:02 [netstat.exe:5260] process terminated 00028EF7/5260
=====================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\mac.log:
.
.
.
2008/07/02 18:41:45 recv TCP 199.245.68.61:119 -> 69.12.134.113:3086 (53) [ ACK ] allow by 000001E2
2008/07/02 18:41:45 send TCP 69.12.134.113:3086 -> 199.245.68.61:119 (52) [ ACK ] allow by 000001E2
=====================
C:\>time
The current time is: 22:31:08.03
Enter the new time:
C:\>netstat -on | find ":119"
TCP 69.12.134.113:1067 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1068 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1246 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1247 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1389 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1488 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1751 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2661 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2776 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2777 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2892 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3086 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3412 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3510 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3511 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:4496 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:4808 199.245.68.61:119 FIN_WAIT_2 5152
C:\>
=====================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\context.log:
.
.
.
2008/07/01 20:11:06 [000001E2] "*Allow Outbound TCP to NNTP for UE.EXE"
=====================
=====================
I dug further and have made some progress. It seemed odd that my firewall was logging packets to & from a port UE had used -- after UE was closed with File>Exit. I then disabled my ethernet adapter and all the orphaned sockets immediately disappeared. Then when I reenabled it, my firewall reported what it thought was a port scan: 6 or more connections to closed ports -- from my news server -- while UE was not running. I will take the issue up with my ISP. At least I have found an easy workaround, thanks to your comments.
-Steve
================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\system.log:
.
.
.
2008/07/02 18:30:00 [ue.exe:5152] process terminated 0001021E/5152
2008/07/02 18:31:01 [cmd.exe:4608] start process 00028EF7/5260 "C:\WINXPP\SYSTEM32\NETSTAT.EXE"
2008/07/02 18:31:01 process info 00028EF7/5260 <- 00003858/4608 [C:\WINXPP\SYSTEM32\NETSTAT.EXE] "netstat -o"
2008/07/02 18:31:02 [netstat.exe:5260] process terminated 00028EF7/5260
=====================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\mac.log:
.
.
.
2008/07/02 18:41:45 recv TCP 199.245.68.61:119 -> 69.12.134.113:3086 (53) [ ACK ] allow by 000001E2
2008/07/02 18:41:45 send TCP 69.12.134.113:3086 -> 199.245.68.61:119 (52) [ ACK ] allow by 000001E2
=====================
C:\>time
The current time is: 22:31:08.03
Enter the new time:
C:\>netstat -on | find ":119"
TCP 69.12.134.113:1067 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1068 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1246 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1247 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1389 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1488 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:1751 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2661 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2776 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2777 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:2892 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3086 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3412 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3510 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:3511 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:4496 199.245.68.61:119 FIN_WAIT_2 5152
TCP 69.12.134.113:4808 199.245.68.61:119 FIN_WAIT_2 5152
C:\>
=====================
C:\Program Files\Agnitum\Outpost Firewall Pro\log\context.log:
.
.
.
2008/07/01 20:11:06 [000001E2] "*Allow Outbound TCP to NNTP for UE.EXE"
=====================
=====================