RNDIS device gets randomly disconnected every few days

[Petteri Aimonen]

We have a custom USB Remote NDIS based network device using IPv6 communication. It works mostly very reliably on both Windows 10 and Windows 7 test machines. However, on some machines the network connection gets dropped after a couple of days of operation.


Symptoms:

• When the problem does occur, it is usually a couple of hours after USB disconnect & reconnect.
• Rebooting device fixes it for a few minutes, but then the connection drops again.
• Rebooting Windows fixes it for a couple of days.
• Disabling USB Selective Suspend fixes the issue on some machines, but not on others.

We have tried to debug this both using hardware USB analyzer, and using Windows ETW tracing.


In both of them we see the same behavior:

1. Traffic works fine

2. Suddenly PC stops sending packets, but continues polling some status information

3. PC puts bus into USB reset state and tries to recover, but apparently fails.


Full logs are available in private if needed.


My questions:

• What state could be persisting between USB disconnect and reconnect in the RNDIS driver, causing it to fail again faster until Windows reboot?
  
• PC is sending packet "74 00 F6 00 6B 00 6F 00 6F 00 64 00" to USB endpoint 0 continuously. Our device always NACKs this. I haven't found any description of this packet in RNDIS documentation, does anyone know what it is? The UTF16 payload decodes to "t*kood".
  
• We are collecting ETW trace with "logman update ndis -p {DD7A21E6-A651-46D4-B7C2-66543067B869} 0x88035f3 5 -ets"
  but it does not show anything useful about why Windows stops sending packets or why it resets the device. Is there some other trace GUID that can provide more details on that?

Continue reading...