Windows: Dynamic Port Exhausting - disp+work // NW7.5

[tobias_ptz]

Hello,

I have a strange problem, but don't know how to find the evildoer.

One of our SAP systems opens a huge amount of dynamic ports until one day all ports are exhausted and we need to restart the instance to clear all opened connections.

CMD: netstat -abno

The strange thing is, that disp+work opens TCP connection from port e.g. 49304 to 49305 and another connection of the same process does the same as I think like a ping back from 49305 to 49304. And so on ..

There is no hin in the normal work process logs.

Someone saw this before, or have an idea how I can find the part in SAP who starts opening those ports?

Thanks in advance for any help!

Best regards,

Tobias

[mamartins]

If you tested with 2 different versions of the kernel, and this behaviour started suddenly, I would say that the kernel isn't the culprit.

I' had seen strange things with kernel release version upgrades, and now always update the SAPHOSTAGENT to latest version before any update...

[tobias_ptz]

Yeah, that were my thoughts too. Next kernel is coming soon, so next try.

I'll try to find something in the extended trace, if it won't help, I think we need to raise an incident.

Best regards,

Tobias

[mamartins]

So the error started after kernel upgrade, but you couldn't perform the downgrade, is that correct?

You could try to increase the disp+work trace level and see if it helps...

[tobias_ptz]

No both, downgrade and upgrade was already done, but with the same result. Both the new and the old kernel exhausting the dynamic ports. So that's why I'm searching for a tool that helps by finding what's going on.

If a higher trace level is the only way at the moment .. hopefully the needle is somewhere in the haystack 😉

Maybe I'll wait until the weekend due to high workload.

Thank you!

[mamartins]

I never saw this before, sorry...

It's the latest release of that kernel version? If not, I suggest to patch it.

Also, there is any AV/firewall software installed on the machine? If yes, it could beeing blocking communication and force processes to keep opening new ports...

[tobias_ptz]

Hi Manuel,

Thanks for your feedback and yes kernel down- and upgrade was already done, sorry for not mention it.

We didn't mentioned such issues with the old kernel, so that's why we tried a downgrade.

AV/Firewall is installed and active like on every other SAP system too, but that's the only systems with this issue.

But logs looks good. I'll try to disable both for tests, hopefully our admins will say yes.

I thought there is a way to take a look into the disp+work processes what forces the connections, but didn't find any helpful TAC/report.

Thank you!