Guardium Windows S-TAP 12.1 might cause Windows OS server instability with non-database traffic using duplicate IPs and ports

Content

Issue description

Due to recent changes, customers who deployed Guardium Windows S-TAP 12.1.0.112 or later might experience server instability. This event is triggered when you use short connections with duplicate IPs and ports. The traffic is coming from non-database sources, but it is picked up by the Guardium Windows Filtering Platform (WFP) driver. (All TCP_IP connections go through WFP.)

Remediation

The IBM Guardium team modified the Guardium WFP driver to properly handle incoming connections with duplicate IPs and ports. You are advised to deploy the new Windows S-TAP 12.1.23.230 (see release note) agent, which is now available on the IBM Support Fix Central website. 

If you already deployed one of the affected Windows S-TAP agents, you can apply the following methods to deploy the fixed Windows S-TAP agent.

Method 1: Using Windows S-TAP upgrade

1. Log in to the database server where the S-TAP agent is installed.
2. Stop all database instances.
3. Use the GUI installer or Guardium Installation Manager (GIM) to upgrade the Windows S-TAP agent to Windows S-TAP 12.1.23.230 (see release note).
4. Reboot your database server immediately after you upgrade Windows S-TAP.
5. Start your database instances.

Method 2: For a large collection of servers

1. Log in to the collector.
2. Navigate to the GIM "Set up by client" page.
3. Stop all database instances.
4. Select the S-TAP clients and upgrade the database server to Windows S-TAP 12.1.19.195 (see release note). 
5. Reboot your database server immediately after you upgrade Windows S-TAP.
6. Start your database instances.