Windows 10: Intermittent UDP drops in Windows 10 OS

Hi,
I have a receiver-side NDIS ETL capture. It shows packets in order and all present. I also have an application receiving data off of the socket. The application misses some data, and the data is occasionally in the wrong order.
The application is receiving multicast UDP via a LAN. The loss is apx. 0.01% of data received. While UDP delivery and ordering aren't guaranteed by the protocol and the throughput isn't terrible, I want to understand why the OS would drop the data.
It doesn't need to be lossless, but I want to first identify where the packets are being lost (e.g. in some finite kernel buffer), then find the threshold (e.g. after 64MB of queued data).
Any tips or ideas on steps to take would be greatly appreciated.

:)

 

Netsh event tracing packet capture shows packets; application not getting them

I have many similar Windows 10 machines running a similar set of applications. A number of applications are multicast UDP listeners. They each have massive socket buffers (they could hold 10 sec+
of data). Occasionally, many of the applications on a given machine will report loss around the same time.

When I run an ETL packet capture, the packets that are missing in the application are present in the capture that is running on that same receiving machine. The packets in the capture have the correct checksums
and the correct MAC addresses. Other applications on *other* machines may receive those exact packets, but may drop other packets.

The source sent a retransmission which was received by the application. Comparing the hex dumps in Wireshark, the only differences included the IP identification, the IP checksum, UDP checksum, and the retransmission
bit set in the app-level portion of the message. The latter three are certainly correct, though I can't speak for the IP.Identification (other than it increasing from its previous value and knowing that other consumers handled it properly).

The machine's Windows performance monitor capture shows nothing classically unusual (it shows low CPU usage, low memory usage, no NIC discards/errors, no Winsock BSP drops).

The firewall is disabled. There is no internet connection--just LAN intranet. There are some other apps running on the machine including TCP and unicast UDP listeners.

The packet loss is intermittent, and a very small fraction of packets get lost but can amount to a million over the day. UDP is naturally unreliable. But the question is where and why do these packets get
dropped.

Assuming the ETL capture is at the NIC driver, this leave the NIC driver, the OS, the socket, and the application. I strongly believe the loss is before the socket.

How can I identify where the packets are being lost? How can I find the location of the drop and learn what the limit that I'm exceeding is? How can I narrow the scope of possible issues? Is there a shared
OS buffer for all sockets that does not have a loss counter?

Thanks. Any tips would be appreciated.

 

Windows 10 Enterprise Ethernet Connection Drops?

I just installed and plugged in a new Windows 10 Enterprise HP box into our network and it is intermittently dropping and reconnecting the Ethernet connection. It is not reliable.

Suggestions?

 

Welcome to the forum. Its not very clear what your asking dropped packets are often due to having full duplex set as most domestic router cant handle it. udp doesnt make a connection so there is no real trace

 

Thanks for the welcoming.

So the interesting thing is that the receivers NDIS later processes the packets.

The packets go through the sender, the network including cabling, hit the receivers nic, NDIS, go to the receivers OS, the socket, and finally the appplication.

I’m specifically seeing data at the NDIS layer and not the socket/application. Why would the OS drop the data?

Thanks