Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Background: I have a virtual instance of Windows Server 2003 running from a VMware environment (although I only have access to the actual guest OS right now). I have a custom .NET Windows service (full access to source) that is listening on a given port.

Problem: Client communication with this service began to degrade recently. Specifically clients' packets randomly stop making it to the listening service. Once a client's traffic fails to make it to the service it will never work again. The odd thing is that with Wireshark I can see every request for the client. But after that it's as though vmxnet3 drops that clients packets. But only that client's packets. Other clients are totally unaffected. Also the service logs every single byte it receives and is a mature server. Previously all servers and clients worked fine, the network adapter worked fine. Nothing has changed in anything or been updated.

Some people have conjectured that packet drops are occurring because the rx buffers are full. This suggestion was made because we were seeing "TCP ZeroWindowProbe" errors in Wireshark. I doubt the rx buffers are full because the network utilization at that time was only 0.1%, and many other clients had their communications completely unaffected.

Question: How can I debug this adapter to more closely inspect what happens to a packet after it hits the virtual adapter? How can I see which packets are dropped and why (whether it's a full rx buffer or not)?

Thanks in advance.

share|improve this question
did you use wireshark on the server (vm) to be sure packets are coming up to Windows ? – Mathieu Chateau Apr 24 '12 at 17:11
@MathieuChateau Yes. I used Wireshark and can see the packets hit the virtual NIC. After idea. It seems that the .NET runtime doesn't get these bytes. – kmarks2 Apr 24 '12 at 20:06
so: all clients are working except one. Even packets for this specific client reach the network card of the server, but it's failing. Looks like on the issue is at the application level for me. Maybe this user is doing a specific things that hangs it's connection ? – Mathieu Chateau Apr 25 '12 at 6:50

try enabling RSS on the vmxnet3 driver under the adapter properties.

share|improve this answer
Thanks, I wasn't aware of this. I ended up rebuilding the Winsock catalog after seeing some odd hears, which solved the problem. Fearing a compromise I just scrapped that instance altogether and reloaded a known good snapshot. – kmarks2 Feb 18 '14 at 16:00

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.