Some combination of an HP Proliant Server, HP integrated ethernet ports, HP network drivers & firmware updates, and Symantec Endpoint Protection can cause a nasty bug for your Windows system network performance. This is somehow related to obscure advanced network features including one or all of: TCP Chimney Offload, Receive Side Scaling (RSS), and Network Direct Memory Access (NetworkDMA).
The basic symptoms can include significantly reduced network performance such as slow file transfers, packet errors, slow remote desktop sessions or failing remote sessions, etc. Here are some articles that may help resolve the issue. Disabling Chimney, RSS, and NetworkDMA followed by a reboot worked for me.
- TCP Chimney Offload, Receive Side Scaling, and Network Direct Memory Access (microsoft.com KB 951037)
- Disable TCP Chimney, TCPIP Offload Engine (TOE) or TCP Segmentation Offload (TSO) – (symantec.com TECH197934)
- Troubleshoot “The Terminal Server security layer detected an error in the protocol stream and has disconnected the client. Client IP:” and “The RDP protocol component X.224 detected an error in the protocol stream and has disconnected the client”error messages (kuskaya.info – same exact problem and solution)
Many thanks to Cengiz Kuskaya, Symantec, and Microsoft for sharing these solutions. Hopefully future firmware, driver, hardware, and software updates from these vendors will include more safe defaults to prevent this type of problem with common system configurations. Until the defaults are safe for this deadly combination, you will need to keep this solution in your IT tool-bag. Cheers! 🙂
7 Dec 2013 update – fix kuskaya.info link.