TCPAckFrequency does not take effect.

Posted 2020-09-04

This happened when TCPIP started to add a network interface based on its TCPIP registry, and TCPAckFrequency could not apply because the TCPIP configuration was incorrect.

 

First of all, when tcpip.sys driver starts, it reads followings from the registry,

 

TcpAckFrequency default:2 max:255, min:1

TcpDelAckTicks default:2 max:60 [min:1 (2012 and later OS) | min:20 (2008 and 2008 R2)]

TcpDisableWindowScaling default:false

 

Here is how Windows processing the keys,

 

3/14/2017 3:23:37 PM        3:23:37.9329717 PM        0.0000093        System        4        236        RegQueryValue        HKLM\\System\\CurrentControlSet\\services\\Tcpip\\Parameters\\Interfaces\\{DB24AA04-F46C-43B7-9783-F0A822B741BF}\\TcpAckFrequency        SUCCESS        Type: REG_DWORD, Length: 4, Data: 1

0        ntoskrnl.exe        CmpCallCallBacks + 0x1c0        0xfffff80002a7e100        C:\\Windows\\system32\\ntoskrnl.exe

1        ntoskrnl.exe        NtQueryValueKey + 0x6e2a6        0xfffff80002a17776        C:\\Windows\\system32\\ntoskrnl.exe

2        ntoskrnl.exe        KiSystemServiceCopyEnd + 0x13        0xfffff800026d78d3        C:\\Windows\\system32\\ntoskrnl.exe

3        ntoskrnl.exe        KiServiceLinkage        0xfffff800026d3e70        C:\\Windows\\system32\\ntoskrnl.exe

4        NETIO.SYS        NetioRegSyncQueryAndUpdateKeyValue + 0x7a        0xfffff8800152e3ba        C:\\Windows\\system32\\drivers\\NETIO.SYS

5        NETIO.SYS        NetioRegSyncInterface + 0x135        0xfffff8800152dfa5        C:\\Windows\\system32\\drivers\\NETIO.SYS

6        tcpip.sys        OlmQueryNsiForTcpInterfaceParameters + 0x71        0xfffff880016b8f71        C:\\Windows\\System32\\drivers\\tcpip.sys

7        tcpip.sys        OlmNotifyAddInterface + 0x35        0xfffff880016ba165        C:\\Windows\\System32\\drivers\\tcpip.sys

8        tcpip.sys        IppNotifyInterfaceChangeToNlClients + 0x15f        0xfffff880016e3fcf        C:\\Windows\\System32\\drivers\\tcpip.sys

9        tcpip.sys        IpFlcAddInterface + 0x4f2        0xfffff880016b6812        C:\\Windows\\System32\\drivers\\tcpip.sys

10        tcpip.sys        FlpOpenAdapterComplete + 0x19a        0xfffff880016b932a        C:\\Windows\\System32\\drivers\\tcpip.sys

11        tcpip.sys        FlBindAdapter + 0x2aa        0xfffff880016c26ca        C:\\Windows\\System32\\drivers\\tcpip.sys

12        ndis.sys        ndisInitializeBindingEx + 0x716        0xfffff880014c8d46        C:\\Windows\\system32\\drivers\\ndis.sys

13        ndis.sys        ndisInitializeBinding + 0x4d        0xfffff880014c90fd        C:\\Windows\\system32\\drivers\\ndis.sys

14        ndis.sys        ndisCheckAdapterBindings + 0x278        0xfffff880014c6f58        C:\\Windows\\system32\\drivers\\ndis.sys

15        ndis.sys        ndisQueuedCheckAdapterBindings + 0xd9        0xfffff880014d34e9        C:\\Windows\\system32\\drivers\\ndis.sys

16        ndis.sys        ndisWorkerThread + 0xba        0xfffff88001438a2a        C:\\Windows\\system32\\drivers\\ndis.sys

17        ntoskrnl.exe        PspSystemThreadStartup + 0x5a        0xfffff80002975cce        C:\\Windows\\system32\\ntoskrnl.exe

18        ntoskrnl.exe        KxStartSystemThread + 0x16        0xfffff800026c9fe6        C:\\Windows\\system32\\ntoskrnl.exe

 

 

3/14/2017 3:23:37 PM        3:23:37.9507527 PM        0.0000058        System        4        236        RegQueryValue        HKLM\\System\\CurrentControlSet\\Control\\Nsi\\{eb004a03-9b1a-11d4-9123-0050047759bc}\\1\\0000000600000600        SUCCESS        Type: REG_BINARY, Length: 4, Data: 01 00 FF FF

0        ntoskrnl.exe        CmpCallCallBacks + 0x1c0        0xfffff80002a7e100        C:\\Windows\\system32\\ntoskrnl.exe

1        ntoskrnl.exe        NtQueryValueKey + 0x6e2a6        0xfffff80002a17776        C:\\Windows\\system32\\ntoskrnl.exe

2        ntoskrnl.exe        KiSystemServiceCopyEnd + 0x13        0xfffff800026d78d3        C:\\Windows\\system32\\ntoskrnl.exe

3        ntoskrnl.exe        KiServiceLinkage        0xfffff800026d3e70        C:\\Windows\\system32\\ntoskrnl.exe

4        NETIO.SYS        NsipReadExact + 0xb53        0xfffff88001532a43        C:\\Windows\\system32\\drivers\\NETIO.SYS

5        NETIO.SYS        NsipReadPersistentData + 0xe6        0xfffff8800152e246        C:\\Windows\\system32\\drivers\\NETIO.SYS

6        NETIO.SYS        NsiGetAllParametersEx + 0x322        0xfffff88001520ce2        C:\\Windows\\system32\\drivers\\NETIO.SYS

7        NETIO.SYS        NsiGetAllParameters + 0xbd        0xfffff88001522f5d        C:\\Windows\\system32\\drivers\\NETIO.SYS

8        tcpip.sys        InetGetRwParameters + 0x46        0xfffff880016b9056        C:\\Windows\\System32\\drivers\\tcpip.sys

9        tcpip.sys        OlmQueryNsiForTcpInterfaceParameters + 0x4c        0xfffff880016b8f4c        C:\\Windows\\System32\\drivers\\tcpip.sys

10        tcpip.sys        OlmNotifyAddInterface + 0x35        0xfffff880016ba165        C:\\Windows\\System32\\drivers\\tcpip.sys

11        tcpip.sys        IppNotifyInterfaceChangeToNlClients + 0x15f        0xfffff880016e3fcf        C:\\Windows\\System32\\drivers\\tcpip.sys

12        tcpip.sys        IpFlcAddInterface + 0x4f2        0xfffff880016b6812        C:\\Windows\\System32\\drivers\\tcpip.sys

13        tcpip.sys        FlpOpenAdapterComplete + 0x19a        0xfffff880016b932a        C:\\Windows\\System32\\drivers\\tcpip.sys

14        tcpip.sys        FlBindAdapter + 0x2aa        0xfffff880016c26ca        C:\\Windows\\System32\\drivers\\tcpip.sys

15        ndis.sys        ndisInitializeBindingEx + 0x716        0xfffff880014c8d46        C:\\Windows\\system32\\drivers\\ndis.sys

16        ndis.sys        ndisInitializeBinding + 0x4d        0xfffff880014c90fd        C:\\Windows\\system32\\drivers\\ndis.sys

17        ndis.sys        ndisCheckAdapterBindings + 0x278        0xfffff880014c6f58        C:\\Windows\\system32\\drivers\\ndis.sys

18        ndis.sys        ndisQueuedCheckAdapterBindings + 0xd9        0xfffff880014d34e9        C:\\Windows\\system32\\drivers\\ndis.sys

19        ndis.sys        ndisWorkerThread + 0xba        0xfffff88001438a2a        C:\\Windows\\system32\\drivers\\ndis.sys

20        ntoskrnl.exe        PspSystemThreadStartup + 0x5a        0xfffff80002975cce        C:\\Windows\\system32\\ntoskrnl.exe

21        ntoskrnl.exe        KxStartSystemThread + 0x16        0xfffff800026c9fe6        C:\\Windows\\system32\\ntoskrnl.exe

 

In process monitor log, NSI repository registry was accessed. {eb004a03-9b1a-11d4-9123-0050047759bc}\\1  ==> TCP module \\ Interface Object

 

If validation fails, then default value will be used.

 

For my issue, TcpDelAckTicks was incorrectly set to 0 in 2008 R2 machine, and it would fail the validation because the tick did not hit the range. All the three settings would be set to default, which for end users, they could find TcpAckFrequency did not work as expected.

 

Although, from MS document, it was fine to have TcpDelAckTicks 0 in the OS prior to Windows Server 2003, but that does not apply to later OS. 

 

TcpDelAckTicks

https://technet.microsoft.com/en-us/library/cc938206.aspx

 

BTW: Once OS boots up, the settings can be found from dump,