During Shazzam phase, port scan from Shazzam can exhaust the default Ephemeral Port size on MID Server host. Which lead to "No buffer space available" errors in the payload and fewer IPs are detected as Alive. - Support and Troubleshooting

During Shazzam phase, port scan from Shazzam can exhaust the default Ephemeral Port size on MID Server host. Which lead to "No buffer space available" errors in the payload and fewer IPs are detected as Alive. Issue During Shazzam phase, port scan from Shazzam can exhaust the default Ephemeral Port size on MID Server host. Which lead to "No buffer space available" errors in the payload and fewer IPs are detected as Alive.

This can happen under combination of the following scenarios:

1. Port scan will use SNMP V1/2 credentials. The instance has several External SNMP V1/2 Credentials stored on CyberArk.

2. IP Ranges has many dead IPs. Many hundred thousands or millions.

3. Multiple MID Servers installed on the same host.

Release Paris, Quebec

Cause When External Credentials is used, ServiceNow do not cache the credentials. For every dead IP in the range that Shazzam is scanning, port scan logic will make 1 request to CyberArk to get the credential. For each request, CyberArk will consume two dynamic ports. Port scan logic will also consume 1 UPD port. This lead to 3 ports used for UDP port scanner.

When CyberArk or ServiceNow terminate a connection, the connection will go to 'TIME_WAIT' state before being released. The 'TIME_WAIT' duration, when not configured, is dynamically handled by the OS and can be tens of minutes long leaving the dynamic port not reusable for extended period of time

Combing with multiple MID Servers installed on the same host, port scan has greater concurrency leading to even more ports used which can eventual surpass the default Ephemeral Port size which is 16384.

Resolution I. Increase the size of Ephemeral Ports. The default size is 16,384 with starting port is 49152. (Run the following command to verify the default setting:

Start Registry Editor. Backup the registry Browse to, and then click the following key in the registry:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters On the Edit menu, click New, DWORD Value, and then add the following registry value to increase the number of ephemeral ports that can by dynamically allocated to clients:

Value name MaxUserPort Value data On the Edit menu, click New, DWORD Value, and then add the following registry value to reduce the length of time that a connection stays in the TIME_WAIT state when the connection is being closed. While a connection is in the TIME_WAIT state, the socket pair cannot be reused:

Value name TcpTimedWaitDelay Value data Close the Registry Editor. Reboot the machine for the changes to take effect Confirm the changes after the restart using this command:

netsh int ipv4 show dynamicportrange tcp

II. Specifically set duration of 'TIME_WAIT':

https://docs.microsoft.com/en-us/biztalk/technical-guides/settings-that-can-be-modified-to-improve-network-performance