I was tracing a .NET 4.0 Application under ntsd.exe using sos extensions. When I launched the “!DumpHeap” command (right exactly after “.loadby sos clr”), I noticed a long delay. I just traced the ntsd.exe using another tool and I found out that it downloaded some files from the “65.55.10.11” IP Address for a total of 3.9MB.
Do you have any idea what are those files?
PS: This doesn’t seem to happen again…
I’m not much of a .NET programmer, but I know this behavior from C++: WinDbg is downloading symbols from Microsoft’s symbol server (the IP you mention does indeed belong to MS). This explains the delay, as downloading takes time, and it explains why it doesn’t happen again – there’s a local cache that reuses previously downloaded symbols.
In C++, the symbols come in the form of .pdb files. IIRC, they are used in .NET too (not sure, though). What they let you is a better view of the debugged process’ content – methods names etc.