Alpha 11 - notifier.exe starting 100 dreds of notifier processes

Feb 23 at 3:55 PM
Hey there,
Thanks for keeping this project alive...
I have been using wfn for a couple of years now and the issue I'm having with wfn ever after 1.9.2.9 is that Windows 7, 8, 10 hangs after a while due to notifier.exe starting 100 dreds of notifier processes. Just tried Alpha 11 for a couple of days and it happened again. Getting Errors that the System has not enough memory installed having to force shutdown!
The other problem I am experiencing is that certain rules regarding system processes seem to get ignored but yet created. e.g. blocking any IP for svchost.exe but the notification still pops up constantly!

Any thoughts on this?
Developer
Feb 23 at 4:27 PM
DaniOnCodePlex wrote:
Thanks for keeping this project alive...
No problem. :)

DaniOnCodePlex wrote:
I have been using wfn for a couple of years now and the issue I'm having with wfn ever after 1.9.2.9 is that Windows 7, 8, 10 hangs after a while due to notifier.exe starting 100 dreds of notifier processes. Just tried Alpha 11 for a couple of days and it happened again. Getting Errors that the System has not enough memory installed having to force shutdown!
Do you maybe have a log-file so I can see what's triggering this? Can you check if you're seeing a lot of WerFault.exe's in task manager as well when this happens?

DaniOnCodePlex wrote:
The other problem I am experiencing is that certain rules regarding system processes seem to get ignored but yet created. e.g. blocking any IP for svchost.exe but the notification still pops up constantly!
There's a few issues with how the rules are handled in WFN, but this one might be unrelated. Have you tried creating the rules with (or without) the Service-checkbox (in the Advanced panel) set?
Feb 23 at 6:00 PM
Hey there,
I will fetch the information within the next days ;-) !
Thanks for now ...
Feb 24 at 7:34 AM
Hey there,
The log contains many repeating entries (see below).
I am not aware of any WerFault.exe's in task manager. (I have disabled Windows ErrorReporting)
I usually do not touch the Service-checkbox, so rules are safed with default settings.
I tried to force wfn into reproducing my problem ... of course I did not succeed!! But I got close. I triggered many calls to public IPs very quickly and wfn opened a lot more threads then I triggered. This forced Windows into critical resource conditions but after a while all the threads where closed again. So for some reason I guess wfn keeps opening new threads. May be wfn should wait after a certain amount of tries for the same destination or the same aplication / service trying to establish a connection !?

Feature request: Would it be possible to have an option within the WFN.config to show the 'Skip all' button by default (just like AlwaysShowDetails)?

Quote of different entries of the log that repeat all the time, followed by an EXAMPLE FOR A TYPICAL SEQUENCE happening at the exact same timecode:

``` 2017.02.18 20:41:18 - xyz [True] - [WARNING] Unknown protocol type: 0
2017.02.18 20:45:26 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)

...

2017.02.18 21:02:38 - xyz [False] - [ERROR] Unable to initialize WFN
System.Exception: Repeated failure to connect to previous instance. Aborting.
bei Wokhan.WindowsFirewallNotifier.Notifier.Program.Main(String[] argv)

...

4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:30:40 - xyz [False] - [ERROR] Error in NextInstance
System.InvalidOperationException: "ShutdownMode" kann nicht festgelegt werden, wenn die Anwendung heruntergefahren wird oder bereits heruntergefahren wurde.
bei System.Windows.Application.set_ShutdownMode(ShutdownMode value)
bei Wokhan.WindowsFirewallNotifier.Notifier.App.NextInstance(ReadOnlyCollection`1 argv)
2017.02.24 07:30:40 - xyz [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)

...

EXAMPLE FOR A TYPICAL SEQUENCE OF AN LOG ENTRY FOR ONLY ONE TIMECODE --> 2017.02.24 07:28:59

2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [WARNING] Unable to retrieve the target process SessionID. Process may have already exited.
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
2017.02.24 07:28:59 - SYSTEM [False] - [INIT] OS: Microsoft Windows NT 10.0.14393.0 (64 bit) / .Net CLR: 4.0.30319.42000 / Path: C:\1_MEINS\1Anwendungen\Windows Firewall Notivier\ALPHA11\ / Version: 2.0.6258.20587 (32 bit)
...
this last line repeats about 40 times!!
Feb 24 at 7:52 AM
Oh and I did not mention, while TaskManager shows many Wokhan.WindowsFirewallNotifier.Notifier (32 Bit) entries I don't get any Notifier PopUp Message / Window as I usually do when this task is triggered !!
Developer
Feb 24 at 3:59 PM
DaniOnCodePlex wrote:
I tried to force wfn into reproducing my problem ... of course I did not succeed!! But I got close. I triggered many calls to public IPs very quickly and wfn opened a lot more threads then I triggered. This forced Windows into critical resource conditions but after a while all the threads where closed again. So for some reason I guess wfn keeps opening new threads.
This is by design (a limitation of the Windows Firewall).
May be wfn should wait after a certain amount of tries for the same destination or the same aplication / service trying to establish a connection !?
By the time WFN would be able to do such a check, Windows has already started a new Notifier.exe, so this wouldn't solve the problem.
Feature request: Would it be possible to have an option within the WFN.config to show the 'Skip all' button by default (just like AlwaysShowDetails)?
I'll add it to the list!
2017.02.18 20:41:18 - xyz [True] - [WARNING] Unknown protocol type: 0
Weird, protocol 0 shouldn't be valid? I'll see what's going on.
2017.02.18 21:02:38 - xyz [False] - [ERROR] Unable to initialize WFN
System.Exception: Repeated failure to connect to previous instance. Aborting.
bei Wokhan.WindowsFirewallNotifier.Notifier.Program.Main(String[] argv)
This is a bug in the .NET framework. I'll have to workaround it someday.
2017.02.24 07:30:40 - xyz [False] - [ERROR] Error in NextInstance
System.InvalidOperationException: "ShutdownMode" kann nicht festgelegt werden, wenn die Anwendung heruntergefahren wird oder bereits heruntergefahren wurde.
bei System.Windows.Application.set_ShutdownMode(ShutdownMode value)
bei Wokhan.WindowsFirewallNotifier.Notifier.App.NextInstance(ReadOnlyCollection`1 argv)
Caused by the same bug as I mentioned above.
Oh and I did not mention, while TaskManager shows many Wokhan.WindowsFirewallNotifier.Notifier (32 Bit) entries I don't get any Notifier PopUp Message / Window as I usually do when this task is triggered !!
This is possible, if there's a blocking rule. Windows Firewall doesn't tell WFN whether a blocked packet was blocked by a rule, or whether there was no rule (and blocking those is the default with WFN). So a new Notifier.exe has to start up for every blocked connection. They merge into one as soon as possible, but that's where that .NET bug comes in: that code in the .NET framework is very buggy and slow... :(
Feb 28 at 6:59 AM
Hey there,
I simply can not use any other version than 1.9.2.9 !!
There are too many instances of 'Wokhan.WindowsFirewallNotifier.Notifier (32 Bit)' being opened till the machine runs out of memory.
Maybe we could have a 'debug' option to always show the Notifier window also for already existing blocking rule events to make all those attempts visible in my case and to be able to manually handle them. Or just for verifying proper functionality!
Developer
Feb 28 at 4:15 PM
DaniOnCodePlex wrote:
Maybe we could have a 'debug' option to always show the Notifier window also for already existing blocking rule events to make all those attempts visible in my case and to be able to manually handle them. Or just for verifying proper functionality!
Now that's a good idea! I'll see what I can make to help debugging these kinds of issues more easily.