Endpoint Protection

I was tracking down a memory leak and seem to have traced it to Windows WFP. Does SEP use the WFP?

Here is how a tracked down the leak:

Running poolmon:

\

Googling the fwpx pool tag I can see some issues people had with the McAfee anti-virus product (but Symantec SEP 12 is installed on this server).

According to this Technet blog post the fwpx pool tag is the related to this driver:
Fwpx - fwpkclnt.sys - WFP NBL tagged context

Then I googled more and found this kb:
https://support.microsoft.com/en-us/kb/2885980

According to the kb the FwpsAllocateCloneNetBufferlist() API leaks memory.

But before I install the hot-fix I'm still curious what program is using the WFP which is causing this error. I can't think of any software other than SEP on this server which might use this, but just want to be sure. Of course its not SEPs fault its the API.

What SEP version and what components are installed?

SEP 12 all components.

Version 12.1.5 (12.1 RU5) build 5337 (12.1.5337.5000)

Hi red888, did you found an answer or solution ?

Cause I'm exactly in the same case of you !  :(

Thank for advise and best regards

Has anyone tried the latest version, 12.1.6 MP2?

I just put the 12.1.6 MP2a with only AV + IPS.

I wait tomorrow for the reboot (prod server)

Jcdignan

Hi did the latest update solve your issue? i have the exact issue also!

any response appreciated

James

Hello,

Did you try with the Latest release of SEP 12.1 RU6 MP3?

Regards,

Hi,

No only the SEP 12.1 RU6 MP2a and alway the same memory leak

Best regards

J-C

We are going to try this https://support.microsoft.com/en-us/kb/2885980

has anyone else tried the LDR versions?

James

LDR's worked! resolved