WFP Issues after Windows update

Technical Support
#1

After an Windows update my WFP started having issues, right now when i try to open FFXIV the launcher gives me an connection error, if mudfish is disabled then the launcher connect as normal, I could run it without WFP but I would prefer not and actually fix this issue.

My first test was pinging one of the servers using CMD and it shows that the connection is being routed thru Mudfish and it is pinging without any issues, I then checked the process logs and in the WFP it shows some timeouts errors.

Things I tried:

  • Reinstalling Mudfish.
  • Disabling WFP, restarting Mudfish and enabling it again.
  • Disabling Kaspersky (Anti-Virus).

Do you have any idea of what could be causing this issue ?

WFP Proxy Log:

[STDOUT]
Fri, 18 Aug 2023 13:25:40 GMT [0.000000] mudwfp_proxy [INFO]  Trying to execute the cmd: NET STOP mudwfp
Fri, 18 Aug 2023 13:25:40 GMT [0.149000] mudwfp_proxy [INFO]  Executed the cmd: NET STOP mudwfp (error_code 2)
Fri, 18 Aug 2023 13:25:40 GMT [0.150000] mudwfp_proxy [INFO]  mudwfp_proxy started.
Fri, 18 Aug 2023 13:25:43 GMT [3.281409] mudwfp_proxy [INFO]  vsl| FLOW   624 MUDWFP_filter_add - ffxiv.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.285407] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxiv.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.285407] mudwfp_proxy [INFO]  vsl| FLOW   626 MUDWFP_filter_add - ffxivboot.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.286409] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxivboot.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.286409] mudwfp_proxy [INFO]  vsl| FLOW   628 MUDWFP_filter_add - ffxivboot64.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.287408] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxivboot64.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.288407] mudwfp_proxy [INFO]  vsl| FLOW   630 MUDWFP_filter_add - ffxivlauncher.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.288407] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxivlauncher.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.289409] mudwfp_proxy [INFO]  vsl| FLOW   632 MUDWFP_filter_add - ffxivlauncher64.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.290408] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxivlauncher64.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.290408] mudwfp_proxy [INFO]  vsl| FLOW   634 MUDWFP_filter_add - ffxiv_dx11.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.291409] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process ffxiv_dx11.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.291409] mudwfp_proxy [INFO]  vsl| FLOW   636 MUDWFP_filter_add - xivlauncher.exe|B|10.235.224.1
Fri, 18 Aug 2023 13:25:43 GMT [3.292409] mudwfp_proxy [INFO]  Backend 10.235.224.1 added for process xivlauncher.exe
Fri, 18 Aug 2023 13:25:43 GMT [3.402409] mudwfp_proxy [INFO]  MUDWFP driver stopped so let's start it.
Fri, 18 Aug 2023 13:25:44 GMT [3.475410] mudwfp_proxy [INFO]  Connected to the driver.
Fri, 18 Aug 2023 13:25:44 GMT [3.476408] mudwfp_proxy [INFO]  Pushed the filter changes (count 7 filter_all 0) into the MUDWFP driver.
Fri, 18 Aug 2023 13:26:10 GMT [30.176096] tcp_proxy [INFO]  new tcp session created from xivlauncher.exe to 124.150.157.190:443
Fri, 18 Aug 2023 13:26:10 GMT [30.245102] tcp_proxy [INFO]  new tcp session created from xivlauncher.exe to 2.19.10.60:80
Fri, 18 Aug 2023 13:26:40 GMT [60.239645] mudwfp_proxy [INFO]  n_buffer_list_too_big 0 n_buffer_list_contbuf 0 n_buffer_list_zero_length 0 n_buffer_list_copy_failed 0 n_nonpagepool_alloc 102 n_nonpagepool_free 0 n_nonpagepool_udp_classify_alloc 0 n_nonpagepool_udp_classify_free 0 n_nonpagepool_flow_context_alloc 701 n_nonpagepool_flow_context_free 701
Fri, 18 Aug 2023 13:26:41 GMT [60.474973] tcp_proxy [INFO]  tcp_proxy stat: n_eps 5 n_sess 2 n_c_connaborted 0 n_c_connreset 0 n_b_connaborted 0 n_b_connreset 0 n_hit_fdsetsize 0
Fri, 18 Aug 2023 13:26:41 GMT [60.474973] tcp_proxy [INFO]  [0] backend timeout to 124.150.157.190:443 (step 0)
Fri, 18 Aug 2023 13:26:41 GMT [60.476971] tcp_proxy [INFO]  [1] backend timeout to 2.19.10.60:80 (step 0)
Fri, 18 Aug 2023 13:26:41 GMT [60.478967] tcp_proxy [INFO]  new tcp session created from xivlauncher.exe to 2.19.10.60:80
Fri, 18 Aug 2023 13:26:41 GMT [60.483970] tcp_proxy [INFO]  new tcp session created from xivlauncher.exe to 124.150.157.190:443
Fri, 18 Aug 2023 13:26:41 GMT [60.707794] udp_proxy [INFO]  udp_proxy stat: n_sess 0 n_invalid_magics 0 n_drop_broadcast 0
Fri, 18 Aug 2023 13:26:41 GMT [60.707794] udp_proxy [INFO]  udp_proxy stat: n_kernel_sent 0 n_kernel_received 0 n_user_sent 0 n_user_received 0
Fri, 18 Aug 2023 13:26:41 GMT [60.707794] udp_proxy [INFO]  udp_proxy stat: kernel_sent_bytes 0 kernel_received_bytes 0 user_sent_bytes 0 user_received_bytes 0
Fri, 18 Aug 2023 13:27:11 GMT [90.716224] tcp_proxy [INFO]  [0] client timeout (step 3)
Fri, 18 Aug 2023 13:27:11 GMT [90.717223] tcp_proxy [INFO]  tcpp_sess done: procname xivlauncher.exe dst 124.150.157.190:443 (client n_received 180 n_sent 0) (backend n_received 0 n_sent 0)
Fri, 18 Aug 2023 13:27:11 GMT [90.719220] tcp_proxy [INFO]  [1] client timeout (step 3)
Fri, 18 Aug 2023 13:27:11 GMT [90.720220] tcp_proxy [INFO]  tcpp_sess done: procname xivlauncher.exe dst 2.19.10.60:80 (client n_received 181 n_sent 0) (backend n_received 0 n_sent 0)
Fri, 18 Aug 2023 13:27:11 GMT [90.721220] tcp_proxy [INFO]  [2] backend timeout to 2.19.10.60:80 (step 0)
Fri, 18 Aug 2023 13:27:11 GMT [90.723220] tcp_proxy [INFO]  [3] backend timeout to 124.150.157.190:443 (step 0)
Fri, 18 Aug 2023 13:27:13 GMT [92.442785] tcp_proxy [INFO]  new tcp session created from xivlauncher.exe to 124.150.157.190:443
Fri, 18 Aug 2023 13:27:40 GMT [120.258387] mudwfp_proxy [INFO]  n_buffer_list_too_big 0 n_buffer_list_contbuf 0 n_buffer_list_zero_length 0 n_buffer_list_copy_failed 0 n_nonpagepool_alloc 102 n_nonpagepool_free 0 n_nonpagepool_udp_classify_alloc 0 n_nonpagepool_udp_classify_free 0 n_nonpagepool_flow_context_alloc 775 n_nonpagepool_flow_context_free 775
Fri, 18 Aug 2023 13:27:41 GMT [120.650630] tcp_proxy [INFO]  tcp_proxy stat: n_eps 5 n_sess 3 n_c_connaborted 0 n_c_connreset 0 n_b_connaborted 0 n_b_connreset 0 n_hit_fdsetsize 0
Fri, 18 Aug 2023 13:27:41 GMT [120.650630] tcp_proxy [INFO]  [2] client timeout (step 3)
Fri, 18 Aug 2023 13:27:41 GMT [120.651619] tcp_proxy [INFO]  tcpp_sess done: procname xivlauncher.exe dst 2.19.10.60:80 (client n_received 181 n_sent 0) (backend n_received 0 n_sent 0)
Fri, 18 Aug 2023 13:27:41 GMT [120.651619] tcp_proxy [INFO]  [3] client timeout (step 3)
Fri, 18 Aug 2023 13:27:41 GMT [120.652617] tcp_proxy [INFO]  tcpp_sess done: procname xivlauncher.exe dst 124.150.157.190:443 (client n_received 180 n_sent 0) (backend n_received 0 n_sent 0)
Fri, 18 Aug 2023 13:27:41 GMT [121.181958] udp_proxy [INFO]  udp_proxy stat: n_sess 0 n_invalid_magics 0 n_drop_broadcast 0
Fri, 18 Aug 2023 13:27:41 GMT [121.181958] udp_proxy [INFO]  udp_proxy stat: n_kernel_sent 0 n_kernel_received 0 n_user_sent 0 n_user_received 0
Fri, 18 Aug 2023 13:27:41 GMT [121.182945] udp_proxy [INFO]  udp_proxy stat: kernel_sent_bytes 0 kernel_received_bytes 0 user_sent_bytes 0 user_received_bytes 0
Fri, 18 Aug 2023 13:27:43 GMT [122.680941] tcp_proxy [INFO]  [4] backend timeout to 124.150.157.190:443 (step 0)
Fri, 18 Aug 2023 13:28:13 GMT [152.956506] tcp_proxy [INFO]  [4] client timeout (step 3)
Fri, 18 Aug 2023 13:28:13 GMT [152.956506] tcp_proxy [INFO]  tcpp_sess done: procname xivlauncher.exe dst 124.150.157.190:443 (client n_received 180 n_sent 0) (backend n_received 0 n_sent 0)
Fri, 18 Aug 2023 13:28:40 GMT [180.271023] mudwfp_proxy [INFO]  n_buffer_list_too_big 0 n_buffer_list_contbuf 0 n_buffer_list_zero_length 0 n_buffer_list_copy_failed 0 n_nonpagepool_alloc 102 n_nonpagepool_free 0 n_nonpagepool_udp_classify_alloc 0 n_nonpagepool_udp_classify_free 0 n_nonpagepool_flow_context_alloc 890 n_nonpagepool_flow_context_free 890
Fri, 18 Aug 2023 13:28:41 GMT [181.248420] tcp_proxy [INFO]  tcp_proxy stat: n_eps 1 n_sess 0 n_c_connaborted 0 n_c_connreset 0 n_b_connaborted 0 n_b_connreset 0 n_hit_fdsetsize 0
Fri, 18 Aug 2023 13:28:42 GMT [181.700037] udp_proxy [INFO]  udp_proxy stat: n_sess 0 n_invalid_magics 0 n_drop_broadcast 0
Fri, 18 Aug 2023 13:28:42 GMT [181.700037] udp_proxy [INFO]  udp_proxy stat: n_kernel_sent 0 n_kernel_received 0 n_user_sent 0 n_user_received 0
Fri, 18 Aug 2023 13:28:42 GMT [181.701037] udp_proxy [INFO]  udp_proxy stat: kernel_sent_bytes 0 kernel_received_bytes 0 user_sent_bytes 0 user_received_bytes 0
#2

If I understood this log properly, it shows that

  • mudwfp_proxy.exe process (Mudfish WFP proxy program) tried to connect to 124.150.157.190:443 got from xivlauncher.exe process at Fri, 18 Aug 2023 13:26:10 GMT
  • But it failed to connect (or do TCP handshake) for 30 seconds. So mudwfp_proxy.exe process prints backend timeout error message and drop the connection.

So in my opinion, something is blocking the connections from mudwfp_proxy.exe process. If you’re using AV program, please try to uninstall and test too.

#3

I’m having the same issue. This happened after updating Kaspersky application. So, I tried closing it completely, and the mudfish connection works fine. I also contacted Kaspersky about it, and they gave me a long list of bot generated checkings. Anyone know how to fix it, other than not using Kaspersky?

#4

Oh, closing kaspersky really worked, which is weird since pausing it should have worked aswell, im gonna try to narrow down whats causing it.

#5

VPN Split Tunnel not work - Kaspersky: Basic, Standard, Plus, Premium - Kaspersky Support Forum

Might be related

#6

Tried to talk to support but they want a bunch of stuff, they want me to record my screen, to send wireshark logs, imo its not worth my time and i will just not use kaspersky for the time being, i suggest the same for other ppl with the same issue

#7

Not sure sure what’s going on with Kaspersky. However is there any way to exclude the process for the filtering in Kaspersky?

If there’s, I think you can try to exclude the list of Mudfsh processes.

#8

I tried, i gave all mudfish process all the pass i could give, they can literally do anything and kaspersky would not try to stop it, except establishing the connection ‘-’

Its probably some change they made it in the last update tho, it should not behave like this, when you pause kaspersky protection it should pause everything, which its not what its happening, hopefully they will notice it and fix it eventually.

1 Like
#9

This topic was automatically closed 21 days after the last reply. New replies are no longer allowed.