I am hoping this is in the right spot.

We have an issue that I have not been able to track down for some time, hoping someone can give me an idea or point me in the right direction.

To summarize: Occasionally, a computer in our network will cause our web server to become unresponsive. The only error messages we see are in the HTTPErr log. We see hundreds of Connection Dropped errors for the computer in question about the same time the servers stop responding. It appears it is dropping every port sequentially. For example, lets say computer has an issue with the website hanging, within a few seconds the server has stopped serving web requests, in the HTTPErr log there are Connection Dropped entries for and :2501, :2502, :2503 for several hundred entries all at moment the user first noticed the issue. One iisreset later, everything is back to normal.

For some background, these computers (Windows XP, IE8) are part of our call center that uses our web servers all day long. This issue rears its ugly head only once every month or so on seemingly random computers. This makes it very hard to track down. The only error that appears on the XP machine as Event ID 4226 "TCP Connection Limit: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts". I am at a loss.

Windows Server 2003
ASP.NET application/website written in C#

Windows XP sp3
These computers don't have access to anything but our webserver and our mail server. I highly doubt it's any kind of malware issue, as they have AV with nightly scans.

Also, every other log file I can think of has been checked (Event viewer, W3SVC, nothing extraordinary on load or memory usage during the issue, etc). I really hope someone out there has an idea of what I can look for since I haven't been able to find anything on this particular issue. It's the first time I'm seeing it as well.

Thanks everyone!

Not really an ASP.NET problem, but my first troubleshooting step would be to do a ping machinename -t on it and wait for it to fail again.

If ICMP requests stop around the same time as the web server, you know that it's not ISS itself but some kind of network or resource issue.

Otherwise, no idea!