qbikhkxp.sys driver tags

[radioalarm]

Hi. I'm currently debugging a Win2003 server system with Wingate 6.2.2, which freezes from time to time because of memory pool depletion. It's an old version, but it was working fine for at least 3 years.

I hope Adrien is familiar with poolmon.exe. It displays drivers which use memory from paged/nonpaged pool. I tracked the problem to a driver tag "new". The thing is that poolmon displays only 'tags', not real driver names. MS method of finding the exact driver is inconclusive (especially with such a keyword). However, this tag is found in qbikhkxp.sys, and this one of the few third party drivers in the system.

The question would be this: is the tag "new" really used in Wingate's driver?

[adrien]

Hi

I had a brief look through our code history for the driver, but since that's such an old version of WinGate, it's harder to find stuff like that due to the volume of changes.

I didn't find any trace of us using that pool tag. As far as I can tell, we used ANEG and BNEG tags mainly.

More recently (about 6 months ago) we re-labelled all the tags, and actually split out all our allocations with different tags so we could track memory issues.

So, we have a later driver you can test if you'd like. You'll need to update to WinGate 6.6.4 first, then we can send you the driver.

Or you can try WinGate 7, which has the latest driver in it.

Regards

Adrien

[radioalarm]

Should the driver reallocate memory after Wingate service restart? Or drivers are "restarted" only on reboot?

[adrien]

Hi

it's a boot load kernel driver, it should release some memory on WinGate stop as it cleans up some things, but most will only be released on restart.

[radioalarm]

OK, we will try the new version. But I still remember the times when Wingate was really flaky (no offense, Qbik), endless upgrades and tests. Version 6.2.2 was the one which was very stable, so I'm a bit afraid to move forward :) I'm also wondering what could cause this memory leak, it was working fine for a few years. The server is pretty static, not much stuff installed/removed. Maybe Windows updates?

[adrien]

Sure

there have been versions of WinGate which unfortunately were quite flaky for some people. It's impossible to test all combinations of hardware and commonly available network software.

6.6.4 dates from 2009. It's pretty solid as far as we know.

And actually we believe 7 (even in beta) is even more solid.

Leaks in the driver can change due to updates as you say, also a change in environment - for instance appearance of certain types of traffic that are then found to cause problems. The network environment WinGate is in is rarely completely static.