[German]Within the blog post Windows 11: Optimize network transfer performance and CPU load – part 2 I mentioned, the the exploit protection implemented in Windows 11 may causes a hight CPU load. But there is more, also Windows 11 Phishing protection is responsible for doubling the CPU load during TCP network traffic.
Advertising
This topic has been floating around the blog for a while, but I haven't had time to put it into an article and publish it yet. The topic is a follows up the article Windows 11: Optimize network transfer performance and CPU load – part 2, where I took up Alexander's observation that Windows 11 exploit protection acts as a network brake. Now it's about another security feature in Windows 11 and its CPU load. Even though it's been a few days, the facts of the case probably haven't changed.
Crude observation in network traffic
Alexander had worked more intensively on the optimization of TCP network throughput and came across a strange story during measurements, which he sent to the Microsoft developers. He informed me about the mail exchange, so that I got to know the facts. In an initial mail he described the facts as follows.
I just made several measurements with PsPing (block size 32K "-l 32k") with the following result.
- When I send data from the Windows 11 workstation to the Windows 10 workstation, the Windows 11 workstation "consumes" about 0.23GHz/GBit/s for sending and the Windows 10 workstation "consumes" about 0.44GHz/GBits/s for receiving at the same moment.
- When I send data from the Windows 10 workstation to the Windows 11 workstation, the Windows 10 workstation "consumes" about !!! 0.08GHz/GBit/s !!! for sending and the Windows 11 workstation "consumes" about 0.88GHz/GBits/s for receiving at the same moment.
When sending data over TCP, Windows 11 uses three times the CPU power as Windows 10!!
And when receiving the data via TCP, Windows 11 consumes twice the CPU power compared to Windows 10!
Also, why does a Windows 10 only need 0.08GHz/GBits/s to send and a Windows 11 to receive 0.88GHz/GBits/s?
Both (sending/receiving) are actually +- the same processes just in reverse order.
Seriously, that's a 10x difference!
Why?
I still have screenshots of the measurements, but I will refrain from posting them here in the blog. Alex wrote me: "In summary, even after my optimizations, Windows 11 eats about 2-3 times more CPU load during TCP transfer compared to Windows 10". From the Microsoft contact then came the "tip" to enable RSS after all, to distribute the "load" over several cores of the CPU – why the load is so high, there was no statement. What did Alexander say?
Yes of course, I turn on RSS and through the RSS overhead I burn even more CPU per Gbit/s and that is supposed to make things better then of course.
By the way, the NIC's in the W11 and the W10 workstation are absolutely identical, also the driver version is the same on both sides, and also their settings [are] the same on both sides.
And the TCP stack settings, I have also aligned on both sides as best I could. Still, these sad differences come to light.
If you compare the CPU consumption between sending Windows 10 (0.08GHz/GBits/s) and receiving Windows 11 (0.88GHz/GBits/s), then we are even talking about a CPU consumption difference of 1000%, although both times, i.e. sending and receiving, +- the same should only happen in the opposite order.
The above mentioned "optimization" is described in the articles mentioned at the end of the article. It remains to be said: The Windows 11 machine eats significantly more CPU resource during TCP network transfers than the Windows 10 workstation used for comparison.
Windows 11 phishing protection as the cause
After a few mails, Alexander then came up with a final mail and said that he had now found the reason why Windows 11 generates a much higher CPU load during TCP data transfer than a comparable Windows 10 workstation. His mail to Microsoft contained only little information:
Advertising
I have finally found the reason for the higher resource consumption of my W11 workstation during TCP data transfer.
And the reason was this…
As soon as this is active, my workstation requires +100% CPU resources for incoming data traffic and even +200% for outgoing traffic.
One reason for the high CPU load during TCP data transfer under Windows 11 is simply the phishing protection integrated in the operating system. As soon as he switches off this function in the settings, the CPU load also drops under Windows 11. Alex says to the Microsoft specialists that this is not mentioned with a word as "tribute" on the Microsoft pages and gives the advice to pay some attention in the future during development that Windows 11 itself does not consume too many CPU resources. Some of the CPU power should remain available for applications.
There are still open questions in this context, because Windows 11 22H2 requires twice the amount of CPU resources during TCP transfer compared to sending, when receiving the same workload over the network. The issue is also said to affect Windows 10 and Windows Server 2019/2022. I'll leave that topic aside for this blog post, though. You can test for yourself if enabling/disabling phishing protection changes the CPU load for network traffic on Windows 11.
Similar articles:
Microsoft's TCP mess, how to optimize in Windows 10/11
Windows 10/11: Poor network transfer performance, high Windows 11 CPU load – Part 1
Windows 11: Optimize network transfer performance and CPU load – part 2
Windows 11 network traffic generates twice as much CPU load as Windows 10
Advertising
