Recommended Posts

I wonder if anyone else has come across this: When copying all my flacs from Win8 to my Win7, I notice my Win8 computer memory usage spiked to 97% and slowed to a crawl. The Win7 is ok. Both have 16GB of ram.

poolmon.exe shows the tag wfpn is the culprit. Doing a findstr shows that netio.sys is causing the problem. I restarted all the network services but the ram usage is still 97%. Only a reboot will solve this problem.

The Realtek driver is update for Win8. It's consistently reproducible.

Link to comment
https://www.neowin.net/forum/topic/1117499-windows-8-high-memory-usage/
Share on other sites

  On 07/11/2012 at 02:19, ArialBlue said:

I found W8 to be unstable, especially the networking code which takes about 100x longer to connect.

Welcome to W8 is buggy club. :)

Just to check...is it the networking code, or the way the drivers work on Windows 8 for your device?

I ask since one of the things they really focused on was making the network connections come on faster. It's actually one of their huge talking points.

I know on my older machine my connection is always on the instant I bring my machine out of sleep. In Windows 7 slow resume of networks was why I never left sleep on. I just set the monitor to turn off...now I can save power and be ready within about 3 seconds from hitting my spacebar.

  On 06/11/2012 at 05:17, sspj said:

I wonder if anyone else has come across this: When copying all my flacs from Win8 to my Win7, I notice my Win8 computer memory usage spiked to 97% and slowed to a crawl. The Win7 is ok. Both have 16GB of ram.

poolmon.exe shows the tag wfpn is the culprit. Doing a findstr shows that netio.sys is causing the problem. I restarted all the network services but the ram usage is still 97%. Only a reboot will solve this problem.

The Realtek driver is update for Win8. It's consistently reproducible.

Hi sspj,

I have exact the same issue - when copying big files around LAN, torrents,.. Win8 memory usage constantly grows to 3.8GB (total ram is 4GB) and machine starts to crawl. Only restart helps. I used the same technique with poolmon.exe (http://msdn.microsoft.com/en-us/library/windows/hardware/ff560135%28v=vs.85%29.aspx). The problem is with non-paged pool that grows all the time. The driver tag find by poolmon is "Wfpn", findstr finds "netio.sys"... this is the part of Win8 core (MS actually wrote the [bad] code..) :cry:

My machine is HP Pavilion dv7 laptop. With Win7 it worked like a charm..no memory leaks. I'll probably switch back to Win7...Win8 disappointed me.. :s

Anyone knows how to inform MS about that issue?

  On 08/11/2012 at 14:55, damkov said:

Hi sspj,

I have exact the same issue - when copying big files around LAN, torrents,.. Win8 memory usage constantly grows to 3.8GB (total ram is 4GB) and machine starts to crawl. Only restart helps. I used the same technique with poolmon.exe (http://msdn.microsof...v=vs.85%29.aspx). The problem is with non-paged pool that grows all the time. The driver tag find by poolmon is "Wfpn", findstr finds "netio.sys"... this is the part of Win8 core (MS actually wrote the [bad] code..) :cry:

My machine is HP Pavilion dv7 laptop. With Win7 it worked like a charm..no memory leaks. I'll probably switch back to Win7...Win8 disappointed me.. :s

Anyone knows how to inform MS about that issue?

Might be better to get HP to push out decently coded Win8 drivers, because in all likeliness it will be your driver, not Windows

  On 08/11/2012 at 15:20, z0phi3l said:

Might be better to get HP to push out decently coded Win8 drivers, because in all likeliness it will be your driver, not Windows

I've tried two options with updating Realtek Gigabit Ethernet LAN drivers:

1. install Win7 drivers (Win8 still not supported) from HP official support site --> memory leak remains

2. install Win8 Realtek latest drivers --> memory leak remains

I've also disabled LAN interface and tried Wlan only --> still memory leak :(

What else can I do?

  On 07/11/2012 at 02:19, ArialBlue said:

I found W8 to be unstable, especially the networking code which takes about 100x longer to connect.

Welcome to W8 is buggy club. :)

really? On my pc im connected before I even log in.

  On 09/11/2012 at 15:00, damkov said:
I've tried two options with updating Realtek Gigabit Ethernet LAN drivers:

1. install Win7 drivers (Win8 still not supported) from HP official support site --> memory leak remains

2. install Win8 Realtek latest drivers --> memory leak remains

I've also disabled LAN interface and tried Wlan only --> still memory leak :(

What else can I do?

Who makes your wireless card? did you do a clean install? what additional drivers did you install? the reason why I ask it might have something to do with something unrelated with the network card driver itself.

I'd agree it's driver related.

I moved a couple of very large ISOs (my dev environment, office etc etc) in a single hit and didn't have any issues whatsoever.

Try running robocopy to move the files and see if the leak persists. It might give you a functioning work around (although it seems unlikely).

I made a fresh Win8 install on HP Pavilion DV7 (not upgrade), it has integrated Realtek gigabit NIC (RTL8168).

After a lot of investigation I think I found the real culprint of my memory leaks. I booted up machine in "safe mode with networking" - and suddenly memory leak has gone :) So I made a list of loaded network drivers (using DriverView from NirSoft) and compared it with the list of drivers in normal boot. Safe mode did not load the following kernel drivers: lltdio.sys, mslldp.sys, Ndu.sys, rspndr.sys, srv.sys, srv2.sys, srvnet.sys, wanarp.sys.

After disabling Ndu.sys (Windows Network Data Usage Monitoring Driver) with Autoruns and normal boot - voila no more memory leaks!!!! :D

Ndu driver was introduced with Win8 (http://batcmd.com/windows/8/services/ndu/) and is actually quite buggy in combination with Realtek NIC. Microsoft should fix that...let's hope soon. :cool:

  • Like 2
  • 1 month later...

Hi damkov - you nailed it. Big thanks for you research. I'm surprised that MS hasn't fix this problem yet.

I changed the registry value instead of using Autoruns:

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu

change the Start value to 4 (for disable).

I'm copy over 100GB of data now, memory usage stays at 14%. Normally, it would be 99% by now.

  • 4 months later...
  On 08/11/2012 at 15:20, z0phi3l said:

Might be better to get HP to push out decently coded Win8 drivers, because in all likeliness it will be your driver, not Windows

Now I have to wonder "which" Realtek gigabit adapter you actually have.

There are three known versions of the Realtek gigabit adapter - an OEM/semi-generic version (supplied to several OEMs, including nVidia and HP), the RTL8111D/E (also semi-generic, but supplied to several OEMs and IHVs, including ASUS) and the current RTL8111F. (The RTL8111D, E, and F are supported by Windows 8 directly - they all use the same driver, in fact - the earlier version uses a Windows 7-type driver.)

Also, you may want to grab Realtek's own drivers (yes - they actually DO write drivers themselves) as opposed to HP's drivers. (The rather amusing thing about Realtek's driver is that it is a generic, but WHQL-certified, Windows 7/8 driver for the RTL8111D and later - and it works with at least one NVidia LAN controller that I know of; the one included as part of the 630i nForce chipset.)

That issue is not one I've had (RTL8111E PHY), and I didn't have it with the nForce chipset after switching from nForce LAN drivers to Realtek's own drivers with Windows 7. However, if you are used to Intel PHYs and Intel Ethernet drivers (especially gigabit) you may likely be spoiled - I can admit to feeling that way (Intel PRO1000CT was the precedent to in terms of gigabit to the two Realtek PHYs I referred to).

Old thread but seems like a driver issue as was mentioned... I don't get that with my Thinkpad (Intel 82577LM Gigabit) network card.

I'm guessing this should have been solved by HP/Realtek by now. :)

btw good job figuring out where the problem was occurring,but i wouldn't be so quick to blame this on a windows problem. yes you disabled a windows driver to remedy the problem, but it could have been the network card driver not playing nice with the windows driver. seems SHoTTa35 doesn't have that problem,and countless other people with different cards don't have that problem.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Wow, and here I'm still happily using 1080p...
    • Added an extra filter to Fail2Ban.  I thought about just adding this to my existing aibots filter, but for the time being I'm keeping it separate because it's "possible" real humans may trigger this one so as long as it doesn't start filling my inbox I'd like to get notified about these so I can adjust it as necessary in the future. I'm still holding close to 10k unique IP addresses at any given time that have been banned via the "aibots" filter that looks for certain user agent strings of known AI scrapers.  However, I've been getting an increasing amount of traffic trying to scrape the site with sanitized user agent strings that just look like normal web browsers, however... Because I enabled authentication I can now see that they're racking up lots of 401 (unauthorized) responses in the Apache "access.log" file, but they're not triggering anything in the Apache "error.log" file, which is where failed attempts to log in would appear.  Basically, if an actual human tried to log in with an invalid username and password they don't immediately go into "access.log" as a 401, they go into "error.log" with a status message such as "user FOO not found".  The only way to trigger a 401 simply by visiting the site, as far as I'm aware, is to hit "Cancel" on the login prompt, or otherwise try to access files directly without properly authenticating. So, given the fact I'm getting a few thousand 401 errors a day from sanitized user agent strings that don't show up in "error.log", which means no attempt at logging in properly, I added another jail/filter set to Fail2Ban to immediately ban anybody who triggers a 401.  This feels a bit nuclear so I may need to adjust it in the future, but as far as I'm aware so far no real humans are being inconvenienced so all I'm doing is wasting the time of some AI scraper bots. Example log entry 61.170.149.70 - - [25/Jun/2025:20:01:04 -0400] "GET /content/mdwiki_en_all_maxi_2024-06/A/Neuroregeneration HTTP/1.1" 401 3287 "https://kiwix.marcusadams.me/content/mdwiki_en_all_maxi_2024-06/A/Neuroregeneration" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1823.43" Contents of /etc/fail2ban/filter.d/apache-401repeat.conf #Fail2Ban filter for bots and scrapers that try to access #files directly without entering credentials for apache2-auth #and therefore trigger lots of 401 errors without triggering #the apache-auth jail. # #Marcus Dean Adams [Definition] failregex = ^<HOST> .+\" 401 \d+ .*$ Contents of /etc/fail2ban/jail.d/apache-401repeat.local [apache-401repeat] enabled = true ignoreip = 10.1.1.1 port = 80,443 filter = apache-401repeat maxretry = 1 bantime = 672h findtime = 10m logpath = /var/log/apache2/access.log Oh, and all this traffic is AFTER I explicitly banned Alibaba's IP ranges that were absolutely blowing me up day and night. Observation; two of the IP addresses that have triggered this jail in the 30 or so minutes since I turned it on were owned by Microsoft.  Wonder if they're doing their own AI scraping/probing, or if that's just an Azure VM owned by somebody else.
    • We don't have hardly any 4k HDR content now... ESPN and other sports channels need to get with the program.
    • We hardly have any 4K HDR content now..why in the world is 16K important??? Someone tell ESPN that it's 2025!!!!
    • Imagine paying for Office 365 and getting a crappy web wrapper instead of a native application.
  • Popular Contributors

    1. 1
      +primortal
      552
    2. 2
      ATLien_0
      208
    3. 3
      +FloatingFatMan
      175
    4. 4
      Michael Scrip
      152
    5. 5
      Som
      139
  • Tell a friend

    Love Neowin? Tell a friend!