Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have uploaded the full debug output here.

I've got a Windows 7 RTM 64 bit machine that is crashing intermittently and I managed to load the correct symbols and get what seems to be a proper analysis. I don't know where to go from here or go about fixing the problem since it seems to be blaming it on tcpip.sys. Although I don't really know how to read this output, the following excerpts from the WinDBG seem relevant:


EXCEPTION_RECORD:  fffff80000b9c058 -- (.exr

0xfffff80000b9c058) ExceptionAddress: fffff80002abb2b6 (nt!RtlEnumerateEntryHashTable+0x0000000000000080) ExceptionCode: c0000005 (Access violation) ExceptionFlags: 00000000 NumberParameters: 2 Parameter[0]: 0000000000000000 Parameter[1]: ffffffffffffffff Attempt to read from address ffffffffffffffff

FOLLOWUP_IP: tcpip!IppFlushNeighborSet+ba fffff880`0186e22a 4885c0 test rax,rax


SYMBOL_NAME: tcpip!IppFlushNeighborSet+ba



IMAGE_NAME: tcpip.sys


FAILURE_BUCKET_ID: X64_0x1E_tcpip!IppFlushNeighborSet+ba

BUCKET_ID: X64_0x1E_tcpip!IppFlushNeighborSet+ba

share|improve this question

Your 'tcpip.sys' can be using a buggy network driver. Try to uninstall it (or them) and see what happens.

Also it can be buggy itself: with proprietary software you never know what is really happening :) But at the first glance Attempt to read from address ffffffffffffffff is very strange: looks like pointer arithmetics error.

To read the output, you need to know WinAPI. Try to Google for the functions you meet: like IppFlushNeighborSet(). This can help you to understand what's happening, and maybe it'll point on something.

share|improve this answer

For a really quick high level information set try:

!analyze -v

This will give you a bunch of related information, including a detailed stack trace.

The windows team blogs are pretty useful resources, the article at the link below goes into some good detail on what this particular command does:

Also check the NTDebugging blog for extremely detailed articles.

share|improve this answer

Actually, the windbg help file (.chm) is a very helpful tool for figuring out how to approach debugging a kernel dump. is another helpful place to look.

You are going to want to look at the stack (at a minimum) and see if you can walk the tcpip.sys image back.

share|improve this answer

Read this blog for some excellent tutorials by a WinDBG expert.

WinDbg / SOS Cheat Sheet

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.