Skype Sessions Abmormally High

[ruffyen]

Skype is opening an abnormal amount of sessions during operation.  What I mean by this is that it is creating several hundred (read 900+) active connections while running in windows.  This is a bit of a problem for me.  When active sessions go above 4000 no new sessions can be made by any user until old sessions are used.  This becomes a problem when one or 2 users take around 900 sessions each.

We were able to keep the entire network from going down by simply limiting the number of active sessions per user to around 256.  This allowed us to circumvent the entire network getting dragged down, but the users that were using the massive amount of sessions still get hosed.

The only way to fix it at this point has been to disable skype auto connect, and then reboot the machine and keep the user from using skype.  Any help with this would be greatly appreciated.  I am pretty sure this only started happening with the latest version of skype 5.5

[rseiler]

I'm curious, by what measure?  Does Tcpview show this on a given machine?  With it, I've never seen more than about a dozen connections. Do you have to be doing something in particular to see it spike?

[ruffyen]

I am on the router. It is an SSG5 Juniper.  I have various scripts that parse the get session output and can tell me the amount of sessions opened on a various IP.  In this case my IP was the culprit and when looking at the port associated with all the connections I used netstat -nao on my local machine to identify the associated PID, then used tasklist to get the exe associated with the PID and all 200+ connections are for skype.  Please note that it is 200 connections right now because we limited the amount of connections an IP address can have to 256.

I shutdown skype and around 3ish mins later the internet is back on and connections have dropped to around 50ish.

[rseiler]

OK, but for a direct comparison, what does Tcpview show?

technet.microsoft.com/en-us/sysinternals/bb897437

[ruffyen]

I am running it now and will run it on any affected systems.  And I will let you know.  This oddly is not something that can be duplicated easily...

[ruffyen]

bit.ly / ofDjvc -- Output of just the skype sessions connected. (add http:// and remove spaces)

10.203.9.123/39428 (myIP/Skype_Port_Used) as you can see 222 connections

TCPView only shows around 20ish connections. So one of two things is happening here.  Either skype is opening connections and then not properly closing those connections or tcpview isnt seeing all the connections.  Any ideas?  At this point I am going to go to an older version of skype.

[rseiler]

Unknown to me, it turns out that TCPView, along with a competing program called CurrPorts, are weak on UDP, at least with P2P programs. This happened to come up in another thread here. See the sample output of another program, SmartSniff, here:

community.skype.com/t5/Windows/Skype-uploading-50-100kbps-constantly/m-p/113426#M12023

Once you narrow things down by filtering on your Skype port, you should see a lot more than with TCPView, but it doesn't break it out (that I can see) like your example, which has repeated lines for some of the same external IP addresses. For comparison, I've had SmartSniff going for about 10 minutes here with Skype, and it shows 56.

Does your router have a UDP timeout setting?  The one in DD-WRT is on a pretty tight leash: 120 seconds.

[ruffyen]

I will have to check with my Firewall provider to see what the UDP session timeout is, but I do know for a fact that even after I killed skype on my local machine I could actively see UPD connections to the port Skype was using at the router open for over 30 mins.

[ruffyen]

They said the timeouts shouldnt be the problem.

[rseiler]

I see that the ScreenOS Cookbook says that "Generic UDP Service" has a timeout of 1 minute, so what you were told would seem to be the case, though I'm not sure what version it's referring to. But maybe this comes down to some quirk of ScreenOS, something else that needs to be tweaked there. I don't know if you're the one who does the router updates, but it looks like it's up to v6.3.0r8.

Did you ever confirm that it doesn't happen with Skype 5.3?  (BTW, does unchecking uPnP in Skype Options buy you anything?)