ICS (Internet Connection Sharing) hung on starting. XP SP1.

[nikos]

Hi,

This is a tough one. I have been at it most of the day without finding any help. I would like to avoid repairing or formatting my installation, so I am looking for some guru who may shed some light on me

This is not critical, but it is risky and an inconvenience. I first noticed it a couple of days ago, when my network would come up without any firewall after each reboot. BootVis shows that the whole sequence basically ends in 18". However, it takes another 2' during which the PC is very sluggish and I have no network. After that period network will come up but without firewall. I can restart the firewall succesfully at that point, manually within 5".

System events show that ICQ hung on starting. Using sc during that period, it shows that SharedAccess service is PENDING_START propably waiting for ipnat service to start. Unfortunately ipnat has exited in a stopped state with exit code 1077. During this period I can neither stop SharedAccess nor start ipnat. My impression is that SharedAccess depends on ipnat.

Any help would be great!

Thanks,
Nikos

P.S. Here is my sc output:

C:\Documents and Settings\nikos>sc queryex sharedaccess

SERVICE_NAME: sharedaccess
TYPE : 20 WIN32_SHARE_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x1
WAIT_HINT : 0x0
PID : 848
FLAGS :

C:\Documents and Settings\nikos>sc queryex ipnat

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
STATE : 1 STOPPED
(NOT_STOPPABLE,NOT_PAUSABLE,IGNORES_SHUTDOWN)
WIN32_EXIT_CODE : 1077 (0x435)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0
PID : 0
FLAGS :

C:\Documents and Settings\nikos>sc qc ipnat
[SC] GetServiceConfig SUCCESS

SERVICE_NAME: ipnat
TYPE : 1 KERNEL_DRIVER
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : System32\DRIVERS\ipnat.sys
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : IP Network Address Translator
DEPENDENCIES : Tcpip
SERVICE_START_NAME :
DISPLAY_NAME : IP Network Address Translator
DEPENDENCIES : Tcpip
SERVICE_START_NAME :

[j79zlr]

Never been a big fan of ICS. It just doesn't seem to really work all that well in any situation.

Since you seem to have widdled it down to ICQ as the culprit, what happens if you disable it from startup?

Why haven't you updated to SP2.

[nikos]

I am sorry. My typo. It should have read ICS not ICQ.

If I disable ICS from the beginning, I boot within 18" and then I can manually start it. Or I could reduce the timeout retries on the ICS, since it runs in parallel during boot it should timeout by the end of the boot sequence.

I don't like SP2. It adds a lot of features that I don't need and as a result it ends up being slower than SP1.

I guess I am happy with ICS at home. I don't keep any servers, so it is pretty acceptable in blocking all incoming traffic to the problem Windows ports (rpc, netbt, etc.). I haven't had any problems with it till now.

[nikos]

Dear j79zlr,

After a few tries and my trusty linux box i was able to solve this one. Quite helpful was also the ipnat tracing enabled by HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\IPNATHLP\EnableFileTracing. It was all along a registry problem, modified by an unknown application sometime in the past month. All changes affected the SharedAccess key in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess.

1) The "DisplayName" was changed from "Internet Connection Firewall (ICF) / Internet Connection Sharing (ICF)" to "Windows Firewall / Internet Connection Sharing (ICF)"
2) The "DependOnService" was changed from "Netman NLA RasMan ALG" to "Netman Winmgmt"

Undoing these changes reduced firewall (network) boot time from 2' to 20". Still I was getting errors in the System Event logs from IPNATHLP "NAT was unable to request an operation of the kernel-mode translation module...". The IPNATHLP logs also indicated 2 failed "NatpProcessConnectionNotify: MapGuidToAdapter failed". After 20" delay MapGuidToAdapter would succeed. Clearly more was to be done.

I was fortunate to have a month old backup of my registry before the problems appeared. I uploaded a current one with the backup and diff'ed them in my linux box. Many changes during that month to be sure. But of more importance were the changes in the SharedAccess key. 2 new keys were added (Epoch and Setup) with their subkeys, and one old "Security" was deleted. Deleting those keys and copying "Security" from my backup I was able to reduce firewall and network boot to 1"

Problem solved,
Nikos

[j79zlr]

Nice work and thanks for posting the solution back here.

[johnmicy]

thanks for sharing

network consulting services