Register
FaceBook Twitter

NNSNAHSL.SYS causing non-paged memory leak

Find the answers to Adaptive Defense and Endpoint Protection queries in this forum. The experts will help you out!
Registered user
Posts: 11
Joined: Thu, 23 Apr 2015, 17:02

NNSNAHSL.SYS causing non-paged memory leak

Postby lmp » Tue, 15 May 2018, 02:25

I recently started noticing some issues with one of our servers, the OS is Windows Server 2012 R2.
After having to forcibly restart the server after it became virtually unresponsive I started to keep an eye on the memory.
At one point I noticed that 90% of the server's RAM (9GB) was being allocated by two instances tagged as LHAN and YHAN in the non-paged area.

Looking through all the system drivers there was one which contained both strings: NNSNAHSL.SYS
More specifically:
Code: Select all
File description: Network Activity Hook Server LWF
File version: 6.0.0.68
Product name: Nano Network Security
Product version: 4.2.0.404
Legal copyright: © Panda 2017
Original filename: NNSNAHSL.SYS

Now, after a reboot, there is only the LHAN instance and it is only allocating 259KB.
Just an hour ago I logged on to the server through RDP and the non-paged memory started leaking fast to the point that LHAN and YHAN went from less than 1MB to 2GB in under 2 minutes.
I haven't yet figured a way to trigger the memory leaking, it almost seems random. The firewall is not even enabled but somehow that driver is killing the server by leaking all over the memory.

Is this a known issue and if not can this be looked at urgently or get a workaround?

Image
https://i.stack.imgur.com/VnNPs.png

Image
https://i.stack.imgur.com/xgjEA.png

Official moderator
Posts: 956
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Postby Darth Panda » Tue, 15 May 2018, 09:22

Hi,

Could you send us your client number in a private mesage?

Regards

Darth
Technical support – Panda Security
www.pandasecurity.com

Registered user
Posts: 11
Joined: Thu, 23 Apr 2015, 17:02

Re: NNSNAHSL.SYS causing non-paged memory leak

Postby lmp » Tue, 15 May 2018, 20:05

The support ticket is still ongoing but in the meantime I isolated the problem to a conflict between the Network Activity Hook Server LWF driver and WinPcap, the leak happens when both are being used at the same time. If, for example, I use Wireshark (WinPcap driver) while Panda is using some networking analysis of it's own (Network Activity Hook Server LWF driver) then the problem os non-paged memory leaking happens, especially with big data transfers across the network, it will fill the RAM (NP area) with as much data as the data being transfered on the network. On the other hand, uninstalling Panda or stopping the usage of WinPcap driver does away with the issue.

I'm still hoping to be able to sue Panda and WinPcap at the same time without having to worry about filling up teh RAM in less than 2 minutes... we'll see.

Official moderator
Posts: 956
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Postby Darth Panda » Wed, 16 May 2018, 15:05

Hi,

That is a very interesting point, did you tell support about it? Please let them know via email when they reply to you.

Regards

Darth
Technical support – Panda Security
www.pandasecurity.com

Registered user
Posts: 11
Joined: Thu, 23 Apr 2015, 17:02

Re: NNSNAHSL.SYS causing non-paged memory leak

Postby lmp » Thu, 24 May 2018, 13:08

The support staff (higher level, possibly from Spain or US) remotely accessed my system and installed a "newer" or "custom" driver that does not cause the memory leak.

He was not able to specify if this "new" driver will be shipped with the next release, but for now the problem is solved.

EDIT: I forgot to add the description of the new driver:

Code: Select all
File description: Network Activity Hook Server LWF
File version: 6.1.0.72
Product name: Nano Network Security
Product version: 4.2.0.432
Legal copyright: © Panda 2018
Original filename: NNSNAHSL.SYS
Last edited by lmp on Thu, 24 May 2018, 13:24, edited 2 times in total.

Official moderator
Posts: 956
Joined: Tue, 24 Oct 2017, 12:04

Re: NNSNAHSL.SYS causing non-paged memory leak

Postby Darth Panda » Thu, 24 May 2018, 13:18

Perfect!!

thanks for the update.

Regards
Technical support – Panda Security
www.pandasecurity.com

Return to Adaptive Defense and Endpoint Protection - Issues

Who is online

Users browsing this forum: No registered users and 1 guest