Server 2k8 r2: UDP traffic from over 30K IPs causing tcpip.sys to contend on spinlocks resulting in 1/2 second DPCs. Works fine in Win2k3.

We have a UDP server that accepts many connections.  In Win2k3 it can talk to anywhere from 90K to 120K IP addresses with no problem.
On Win2k8R2 it throttles and often tips over at 30K users.
I have xperf logs showing the problems.  DPCs start out taking reasonable amounts of time, but eventually grow to take half a second upwards of 3/4 of a second; at that point the network stack seems to tip over and start again.
I've appended some of the xperf data.  I don't see a way to provide an attachment.
The nic is the Intel 82576 with only one link active.  Again - same code same hardware runs fine on win2k3.
There are various routes to it, but huge swaths of code always end up in: NDIS.SYS!NdisAcquireReadWriteLock.
I would assume on the same lock, and I would guess it's a spin lock since it spends all its time in ntkrnlmp.exe!KeAcquireSpinLockAtDpcLevel.
In our sample the process had a weight of 540,714 units.  Of that at least 210,597 ended up trying to acquire that lock via WSASendTo.  Gory details appended.
From the DPC view, you can see the calls that were taking 1/2 a second or longer.  There are 110 of them in a 37 second sample.  The time to process varies randomly and there are many thousands in between.  This is appended as the second set
of voluminous data.
OS is Win2k R2 SP1
The Intel 82576 NIC has the latest available drivers
I've already tried altering just about every network parameter to observe the results.  RSS enabled/disabled. RSS NIC configured for 1 or more CPUs.  Various timings for Interrupt deferral, etc...
The net effect of all this was that I could move the shape of the curves, and even stop the network from tipping over entirely; however the DPC times are still awful; the spinlocks are still spinning and the net throughput is still 1/4 of Win2k3.
Any suggestions?  What's the next step?
Joe
Stack
Weight
% Weight
Count
| | | | | |- ws2_32.dll!WSASendTo
210597.1896
5.33
210735
| | | | | | |- mswsock.dll!WSPSendTo
210222.4585
5.32
210356
| | | | | | | |- ntdll.dll!ZwDeviceIoControlFile
209948.2971
5.31
210079
| | | | | | | | ntdll.dll!LdrInitializeThunk
209948.2971
5.31
210079
| | | | | | | | ntdll.dll! ?? ::FNODOBFM::`string'
209948.2971
5.31
210079
| | | | | | | | wow64.dll!Wow64LdrpInitialize
209948.2971
5.31
210079
| | | | | | | | wow64.dll!RunCpuSimulation
209948.2971
5.31
210079
| | | | | | | | wow64cpu.dll!DeviceIoctlFileFault
209948.2971
5.31
210079
| | | | | | | | wow64cpu.dll!CpupSyscallStub
209948.2971
5.31
210079
| | | | | | | | |- ntkrnlmp.exe!KiSystemServiceCopyEnd
209865.9437
5.31
209996
| | | | | | | | | |- ntkrnlmp.exe!NtDeviceIoControlFile
209861.9414
5.31
209992
| | | | | | | | | | |- ntkrnlmp.exe!IopXxxControlFile
209856.0089
5.31
209986
| | | | | | | | | | | |- afd.sys!AfdFastIoDeviceControl
209456.9132
5.3
209583
| | | | | | | | | | | | |- afd.sys!AfdFastDatagramSend
209323.6618
5.3
209448
| | | | | | | | | | | | | |- afd.sys!AfdTLFastDgramSend
208405.7464
5.27
208521
| | | | | | | | | | | | | | |- tcpip.sys!UdpTlProviderSendMessages
208270.0504
5.27
208384
| | | | | | | | | | | | | | | |- ntkrnlmp.exe!KeExpandKernelStackAndCalloutEx
208216.8802
5.27
208330
| | | | | | | | | | | | | | | | |- tcpip.sys!UdpTlProviderSendMessagesCalloutRoutine
208164.7757
5.27
208277
| | | | | | | | | | | | | | | | | |- tcpip.sys!UdpSendMessages
208158.8001
5.27
208271
| | | | | | | | | | | | | | | | | | |- tcpip.sys!UdpSendMessagesOnPathCreation
204713.1138
5.18
204823
| | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleFastUdpInspection
127845.6429
3.23
127912
| | | | | | | | | | | | | | | | | | | | |- NDIS.SYS!NdisAcquireReadWriteLock
127041.047
3.21
127099
| | | | | | | | | | | | | | | | | | | | |- ntkrnlmp.exe!RtlLookupEntryHashTable
264.272245
0.01
267
| | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleFastUdpInspection<itself>
171.42808
0
173
| | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAlepIsSameEndpoint
131.641229
0
133
| | | | | | | | | | | | | | | | | | | | |- netio.sys!WfpRefreshEntryLru
125.181435
0
126
| | | | | | | | | | | | | | | | | | | | |- tcpip.sys!memset
39.508324
0
40
| | | | | | | | | | | | | | | | | | | | |- netio.sys!KfdIsLayerEmpty
30.500205
0
31
| | | | | | | | | | | | | | | | | | | | |- netio.sys!KfdGetLayerCacheEpoch
18.334937
0
19
| | | | | | | | | | | | | | | | | | | | |- NDIS.SYS!NdisReleaseReadWriteLock
15.799406
0
16
| | | | | | | | | | | | | | | | | | | | |- ntkrnlmp.exe! ?? ::FNODOBFM::`string'
3.992942
0
4
| | | | | | | | | | | | | | | | | | | | |- tcpip.sys!KfdIsLayerEmpty
3.937052
0
4
| | | | | | | | | | | | | | | | | | | |- tcpip.sys!IpNlpFastSendDatagram
63245.49252
1.6
63271
| | | | | | | | | | | | | | | | | | | | |- tcpip.sys!IppSendDatagramsCommon
62205.09904
1.57
62216
| | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpProcessOutTransportStackIndication
61667.95687
1.56
61676
| | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!ProcessALEForTransportPacket
61615.13818
1.56
61623
| | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleMatchStatefulEndpoint
50338.28726
1.27
50346
| | | | | | | | | | | | | | | | | | | | | | | | |- NDIS.SYS!NdisAcquireReadWriteLock
50260.6444
1.27
50268
| | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleMatchStatefulEndpoint<itself>
31.797626
0
32
| | | | | | | | | | | | | | | | | | | | | | | | |- ntkrnlmp.exe!RtlLookupEntryHashTable
20.90588
0
21
| | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAlepIsSameEndpoint
8.997452
0
9
| | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!memset
8.940707
0
9
| | | | | | | | | | | | | | | | | | | | | | | | |- netio.sys!WfpRefreshEntryLru
2.999293
0
3
| | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!_security_check_cookie
2.001804
0
2
| | | | | | | | | | | | | | | | | | | | | | | | |- NDIS.SYS!NdisReleaseReadWriteLock
2.000098
0
2
| | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleConnectAcceptIndicate
11225.06641
0.28
11225
| | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleAuthorizeSend
11219.07252
0.28
11219
| | | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAlepAuthorizeSend
11208.09459
0.28
11208
| | | | | | | | | | | | | | | | | | | | | | | | | | |- tcpip.sys!WfpAleInsertRemoteEndpoint
11035.14208
0.28
11035
| | | | | | | | | | | | | | | | | | | | | | | | | | | |- NDIS.SYS!NdisAcquireReadWriteLock
10873.02754
0.28
10873
DPC Raw Info:
Function
Count
Max Actual Duration (ms)
ndisInterruptDpc
554751
713.847
1
713.847
1
708.4239
1
677.1281
1
672.813
1
672.2575
1
660.812
1
660.0321
1
655.2213
1
647.1885
1
641.3311
1
632.4002
1
622.6813
1
621.7657
1
620.5844
1
617.5036
1
615.4015
1
610.9474
1
606.8938
1
604.7577
1
594.5486
1
587.6109
1
581.5086
1
580.0222
1
579.7739
1
576.6219
1
576.4333
1
575.1572
1
574.4537
1
574.1743
1
573.7621
1
560.8745
1
559.7798
1
557.8415
1
557.8143
1
557.5373
1
553.3025
1
553.172
1
550.6415
1
549.8416
1
549.612
1
549.5203
1
548.3752
1
548.0821
1
547.8116
1
547.4588
1
547.2672
1
545.9869
1
544.6088
1
544.3772
1
542.6019
1
542.4782
1
542.2717
1
542.2666
1
542.2051
1
540.3364
1
538.9678
1
538.8142
1
538.3009
1
537.85
1
535.7837
1
534.7581
1
534.7572
1
532.4798
1
532.2034
1
532.0741
1
531.8791
1
530.7899
1
529.894
1
528.7522
1
527.006
1
526.6041
1
526.3972
1
525.4709
1
525.351
1
524.2444
1
522.7439
1
521.5258
1
520.562
1
520.4451
1
518.5009
1
517.4765
1
517.375
1
517.282
1
512.0087
1
511.5543
1
511.5373
1
510.6021
1
509.3328
1
508.7159
1
507.1279
1
505.7661
1
505.1325
1
504.612
1
501.9754
1
501.9476
1
501.94
1
500.7436
1
500.625
1
500.5376
1
499.567
1
499.5614
1
499.36
1
499.2837
1
499.0861
1
499.0537
1
498.7743
1
498.4466
1
498.3967
1
496.5591
1
495.4409
Joe Rohde

Hi Joe,
The issue can be checked only by dump file. In this scenario, we may have to capture the dump file and MPS reports to analysis. I am afraid
that your issue falls into the paid support category which requires a more in-depth level of support.  Please visit the below link to see the various paid support options that are available to better meet your needs.
http://support.microsoft.com/default.aspx?id=fh;en-us;offerprophone
Thanks for your understanding and efforts with the issue.
Annie

Similar Messages

  • I have a macbook pro and I recently installed OS X yosemite 10.10.1. Since then the scanned documents from my canon mx450 appear black, even those that I have scanned before the installation. It works fine on other pc though. I tried reinstalling the

    I have a MacBook Pro and I recently installed OS X Yosemite 10.10.1. Since then the scanned documents from my canon mx450 appear black, even those that I have scanned before the installation. It works fine on other pc though. I tried re-installing the canon drivers but nothing changed. Please help.

    zoiand wrote:
    Since then the scanned documents from my canon mx450 appear black, even those that I have scanned before the installation.
    This is very odd. Were the images that you scanned before installing Yosemite saved as JPEG? If yes, have you tried saving the scanned image as a TIFF?
    Also, if you scan to a USB memory stick from the MX and save this as a JPEG, and then open the file on the Mac, does it also display as black?

  • I have seen all the early responses to how to fix AOL mail issues on Iphones, however no mater how many smpt servers I set up or on .... I can not get AOL mail to send from my Iphone 5, running IOS 6.  I have an Iphone 4 running IOS6 and it works fine...

    I can not get the Iphone 5 to send out aol mail.  I have added the extra smtp server as suggested and it still will not send mail.

    I am having the same problem. Sometimes it works and sometimes it doesn't. I called apple restored my phone to its original and it did not work :-( Now it seems like it worked for a bit than stopped again. Now I have to contact Apple again to set up an appointment at an Apple store because it may be an issue with my phone. I have only had it for a week and half!

  • I had itunes played from my PC to my music system that is connected through a nework.  It use to work fine, but now I get an error message that say "An error occured while connecting to the Airplay Device "Stereo".  An unknown error occured (-15000)".

    When trying to play itunes from my PC to my stereo connected to an Airport Express, I gen an error that says "An error occured while connecting to the Airplay device "Stereo" an unknown error occured (-15000)".  This has happened before and for reasons unknown to me, the problem corrects itself, then it starts again/  Makes me wish I did not have my music on itunes.

    moehadi, Welcome to the discussion area!
    This is typically caused by a firewall or Internet security software running on your PC. Please read the comments in "Error -3256 or -15000 when streaming to AirPort Express base stations using iTunes".
    Also there is "iTunes 8: Unknown error -15000 when attempting to stream music to devices connected to AirPort Express with AirTunes".

  • TS1398 My iPod touch 4 suddenly disconnected from internet and refuses to reconnect, I've tried all troubleshooting and even restoring. Internet router working fine for laptop, already tried restarting.

    It has been working all day long, when suddenly my email told me I wasn't connected to the internet even though I had a solid connection. I tried forgetting the network and re-logging in and it didn't work. I tried restarting the router even though my laptop still has internet, and that didn't change anything. Under general setting I reset all the network information and it still didn't work. Since I had been previously experiencing problems with apps shutting down unexpectedly, I tried backing up and restoring my iPod and it still won't connect to my network.

    Does the iPod connect to other networks?
    Does the iPod see the network?
    Any error messages?
    Do other devices now connect?
    Did the iPod connect before?
    Try the following to rule out a software problem:                 
    - Reset the iOS device. Nothing will be lost
    Reset iOS device: Hold down the On/Off button and the Home button at the same time for at
    least ten seconds, until the Apple logo appears.
    - Power off and then back on the router
    - Reset network settings: Settings>General>Reset>Reset Network Settings
    - iOS: Troubleshooting Wi-Fi networks and connections
    - iOS: Recommended settings for Wi-Fi routers and access points
    - Restore from backup. See:
    iOS: How to back up
    - Restore to factory settings/new iOS device.
    If still problem make an appointment at the Genius Bar of an Apple store since it appears you have a hardware problem.
    Apple Retail Store - Genius Bar

  • Splitting the app traffic from the cluster and admin traffic

    Hi,
    We currently have a 10.3.2.0 setup where an admin server is behind a firewall and is running on the Administration Port and is connected to two managed servers in front of a first firewall in the DMZ.
    On each managed server there is two network interfaces one for management and one for apps/DB connections.
    So I was wanting to know how to you get the managed server to split the traffic??
    If I set the managed servers listening address to the management interface then it starts up fine as that what the admin server behind the firewall can see, BUT it means app and JDBC Connections dont work and the server goes to ADMIN state first before you have to manually resume it.
    If I set the managed servers listening address to the app interface then it can't start up and the app interfaces address is block from the admin server to the managed server via the firewall.
    If I set the managed server to have no listening address and leave it blank in the interface field, it starts up and listens on all interfaces, BUT can't find a route to the admin server.
    So what is the answer, can you do something with Network Channels?? Or is it the case you just can't do it and just to have one interface and one listening address as the admin traffic is split by the default administration channel anyway.
    Would be get to know.
    Alistair.

    Are you using cellular data? If yes, try to use Wi-Fi and see if the app works better by using a faster data connection. If you have no problem using Wi-Fi and maps, see if you can have a faster cellular connection by switching to 3G, 4G to LTE service in Settings/Cellular.

  • Job server giving error when accessing from other servers and clients

    I am facing one issue at customer site with DS 4.0.
    -     Job Servers are installed on two machines M1 and M2. JS1 on M1 and JS2 on M2.
    -     Both the job servers are in server group
    -     Sitting on machine M1, I am able to run jobs selecting JS1 and JS2 individually
    -     On Machine M2, JS2 is working fine however while running jobs on JS1 it says Job Server is not working
    o     In Designer screen, I can see the job server icon at the bottom without cross mark, which means it is working. However, when I move the cursor on this icon, following text is displayed on the tray
    Job Server: (servername:3500) - notification server error (BODI-1241023)
    I have checked the firewall on both the servers, and port 3500 is open.
    Any idea what the problem can be?

    You may also search for Access help at http://search.microsoft.com/search.aspx?mkt=en-US&setlang=en-US

  • My HP will not print a photo from the computer file. everything else works fine. The memory slot

    My hp office jet pro L7680 suddenly will not print a photo from the computer.  shows in the printer que.  Memory slot light blinks.  Everything else works fine.  N.

    Something to chek, open a document, press CMMAND P, this will bring up the print screen, you can click on the arrow to expand the options
    Then click on the presets and make sure that the preset you want is selected.
    From the preset drop menu you can select Plain paper best or fast draft, which should then be color.
    Hope this helps

  • Network Load Balancing not working with UDP traffic (Server 2012)

    Hi all,
    I manage an application that receives traffic from mobile devices on cellular networks. The traffic is UDP. I have set up two x Server 2012 VMs to form part of a NLB cluster. Each server has a second NIC dedicated to NLB. The traffic is simply NATed from
    our firewalls to the virtual IP. When looking at the traffic using a packet sniffer, I can see the traffic being routed correctly to the virtual IP, but the problem is that the return traffic is sent from the IP address on the actual NIC. My application does
    not like the fact that the return traffic is coming from a different source IP. Is there any way to force the return traffic to also come from the virtual IP address?
    Thanks!

    Hi
    NLB return traffic for UDP would come from the node IPs.
    You could use NAT on your firewalls so they come from the same public IP.
    Otherwise you'd be looking at something other than MS NLB.
    Cheers
    GF

  • Doesn't Managed Server's sip channel support udp traffic by default ?

    Hi All,
    I am new to the WebLogic Server. I have tried to set up a Managed Server via an AdminConsole of BEA WebLogic 9.2.
    My configurations in config.xml are as shown below. In the AdminConsole, I could startup the Managed Server successfully. However, when I generated a SIP message (to the listening port of Managed Server, which is 5068) using sipp, the Managed Server could not receive the sip message.
    When, I used "netstat -a" to check listening ports. It showed that the Managed Server (Server-5) listened on tcp port 5068 but NOT on udp port 5068. And, since my sipp generated a sip message to udp port 5068, the Managed Server could not obtain the sip message.
    I read the online document and it states that when a channel is created for a server, it will automatically support both tcp and udp traffic. Therefore, from my understanding, the Managed Server should automatically listen on both udp and tcp port when it starts up. In fact, I have checked that my Admin Server listens on both udp port and tcp port (in this case, port 5060).
    I doubt that I may miss something in the configuration of the Managed Server. I woud be appreciated if someone could enlighten me up.
    Kind Regards,
    Kirati
    <server>
    <name>Server-5</name>
    <machine>Machine-0</machine>
    <listen-port>7007</listen-port>
    <web-server>
    <web-server-log>
    <number-of-files-limited>false</number-of-files-limited>
    </web-server-log>
    </web-server>
    <listen-address>10.252.8.241</listen-address>
    <network-access-point>
    <name>Channel-8</name>
    <protocol>sip</protocol>
    <listen-address>10.252.8.241</listen-address>
    <public-address>10.252.8.241</public-address>
    <listen-port>5068</listen-port>
    <public-port>5068</public-port>
    <http-enabled-for-this-protocol>false</http-enabled-for-this-protocol>
    <tunneling-enabled>false</tunneling-enabled>
    <outbound-enabled>true</outbound-enabled>
    <enabled>true</enabled>
    <two-way-ssl-enabled>false</two-way-ssl-enabled>
    <client-certificate-enforced>false</client-certificate-enforced>
    </network-access-point>
    </server>
    Edited by: user10871458 on Jan 30, 2009 1:17 AM

    I have found an answer to my question.
    I simply forgot to load a sip-container service to my new created server..

  • When uploading my email account it also uploaded over 6,000 emails that are on the aol server from over the years, how can I delete all but recent ones?

    when uploading my email account it also uploaded over 6,000 emails that are on the aol server from over the years, how can I delete all but recent ones?

    Unfortunately, there is no easy way.  Delete just as you would any other message that you don't want.  It's probably just as well that there is no universal deletion capability.  I can see many of us committing a major "oops."

  • How can i configure my iphone to only pass traffic from certain apps over vpn

    I have got a telephony app that connects to a phone system through vpn. when I turn on "send all traffic through vpn" internet and other apps are really slow. is their a way to configure the phone to send only traffic from the app through VPN.

    Now all my new apps as well as several others are gone from the iPhone.
    Look on other screens. The 4.1 update ands Game Center to the home screen. If that screen was full it create a blank screen and moves one app from the home screen to the new screen to make room for Game Center. All the other screens are pushed back one place.
    How can I get my apps back? It cost me a lot of time and money to discover those apps and get them onto the phone. Are they just gone now?
    If they are really gone, you can download them again. You will not be charged again if you use the same iTunes account.

  • How to unblock UDP ports from the firewall of the Time Capsule

    Hello i just bought a time capsule and i am trying am using it as a router. I am trying to use Shakespeer
    that is like a server where you share files within the University,it runs with Dtella. However, when y try to get online a message tells me that the firewall of the router is blocking the UDP ports needed....how do i unblock those UDP ports so i can get online?
    Here is the message:
    In order for Dtella to communicate properly, it needs to receive UDP traffic
    [19:14] <*Dtella> from the Internet. Dtella is currently listening on UDP port 4000, but the
    [19:14] <*Dtella> packets appear to be getting blocked, most likely by a firewall or a router. If
    [19:14] <*Dtella> this is the case, then you will have to configure your firewall or router to
    [19:14] <*Dtella> allow UDP traffic through on this port. You may tell Dtella to use a different
    [19:14] <*Dtella> port from now on by typing !UDP followed by a number.

    Hello albertoPeralta. Welcome to the Apple Discussions!
    To open ports on the Time Capsule, you would use the AirPort Utility to configure Port Mapping.
    AEBSn - Port Mapping Setup
    To setup port mapping on an 802.11n AirPort Extreme Base Station (AEBSn), either connect to the AEBSn's wireless network or temporarily connect directly, using an Ethernet cable, to one of the LAN port of the AEBSn, and then use the AirPort Utility, in Manual Setup, to make these settings:
    1. Reserve a DHCP-provided IP address for the Shakespeer host device.
    Internet > DHCP tab
    o On the DHCP tab, click the "+" (Add) button to enter DHCP Reservations.
    o Description: <enter the desired description of the host device>
    o Reserve address by: MAC Address
    o Click Continue.
    o MAC Address: <enter the MAC (what Apple calls Ethernet ID if you are using wired or AirPort ID if wireless) hardware address of the host computer>
    o IPv4 Address: <enter the desired IP address>
    o Click Done.
    2. Setup Port Mapping on the AEBSn.
    Advanced > Port Mapping tab
    o Click the "+" (Add) button
    o Public UDP Port(s): 4000
    o Private IP Address: <enter the IP address of the host server>
    o Private UDP Port(s): 4000
    o Click "Continue"

  • Stop DHCP traffic from passing across interfaces

    I'm having an issue with dhcp traffic passing across my cisco ASA 5510 interfaces.
    Example of setup
    Company 1 connected to interface 1 has its own dhcp server
    Company 2 connected to interface 2 has its own dhcp server.
    Some users are getting there ip address from the other companys dhcp server. The 2 companys should pass traffic to each other but not dhcp.
    Is there anyway to stop dhcp traffic from crossing interfaces
    Shane

    usually have to permit DHCP traffic explicitly. Specification of the DHCP client-server protocol describes several cases when packets must have the source address of 0x00000000 or the destination address of 0xffffffff. Anti-spoofing policy rules and tight inclusive firewalls often stop such packets. Multi-homed DHCP servers require special consideration and further complicate configuration.
    To allow DHCP, network administrators need to allow several types of packets through the server-side firewall. All DHCP packets travel as UDP datagrams; all client-sent packets have source port 68 and destination port 67; all server-sent packets have source port 67 and destination port 68. For example, a server-side firewall should allow the following types of packets:
    * Incoming packets from 0.0.0.0 or dhcp-pool to dhcp-ip
    * Incoming packets from any address to 255.255.255.255
    * Outgoing packets from dhcp-ip to dhcp-pool or 255.255.255.255
    where dhcp-ip represents any address configured on a DHCP server host and dhcp-pool stands for the pool from which a DHCP server assigns addresses to clients
    An example in an ASA would similar to the following.
    For blocking client:
    access-list TEST extended deny udp any any eq bootpc
    For blocking server:
    or access-list TEST extended deny udp any any eq bootps
    Hope that helps.

  • Outside-PAT all UDP traffic, but exclude DNS

    8.4(3)
    I need to outside PAT all incoming UDP (SIP/RTP) traffic from outside to an internal IP. The following command makes it work:
    nat (outside,inside) source dynamic any obj-10.0.0.173 service udp udp
    But it breaks DNS resolution from inside. If I add the above command and try to nslookup from inside to an outside DNS server
    64.90.175.90, DNS times out. If I remove the above nat command, it works again. It seems like even though DNS UDP originates from inside which should create a statefull connection, ASA still messes with return DNS responses.
    I then tried to create an "exclusion" for that IP with the following:
    object-group network nat-exclusions
    network-object host 64.90.175.90
    nat (outside,inside) source static nat-exclusions nat-exclusions
    but it's not working.
    I also tried:
    nat (outside,inside) source static nat-exclusions nat-exclusions unidirectional
    Also not working.
    Any suggestions? How can outside-PAT all UDP traffic excluding DNS.

    TAC was able to help. I needed this:
    object network exclusions
    host 64.90.175.90
    nat (inside,outside) source dynamic any interface destination static exclusions exclusions
    nat (outside,inside) source dynamic any obj-10.0.0.173 service udp udp

Maybe you are looking for