How to Use Windows Performance Analyzer (WPA) to Diagnose DPC Latency Spikes in Kernel Drivers

When troubleshooting audio dropouts, video stuttering, or severe input lag on a high-performance Windows workstation, the root cause is rarely an overloaded CPU or insufficient RAM. Instead, these micro-stutters are almost exclusively caused by Deferred Procedure Call (DPC) latency spikes. DPCs are high-priority tasks executed by kernel-level device drivers. When a poorly coded driver monopolises the CPU by running a DPC for too long, it blocks the operating system from processing time-sensitive tasks, like rendering the next audio buffer. To accurately diagnose and identify the exact driver causing these spikes, administrators must bypass standard task managers and utilise the Windows Performance Analyzer (WPA).

The Limitations of Traditional Monitoring

Traditional tools like Task Manager or Resource Monitor aggregate CPU usage over one-second intervals. A DPC latency spike occurs in the realm of microseconds. A kernel driver can block the entire system for 50 milliseconds—causing a massive audio crackle—but because the CPU was idle for the remaining 950 milliseconds of that second, Task Manager will report CPU usage near 0%. DPC execution happens beneath the visibility of standard user-space monitoring tools.

Installing the Windows Performance Toolkit

To capture kernel-level execution timings, you must install the Windows Performance Toolkit (WPT), which is bundled within the Windows Assessment and Deployment Kit (Windows ADK). You can download the ADK directly from Microsoft. During the installation process, you only need to select the Windows Performance Toolkit feature; the deployment tools are unnecessary for diagnostics.

The WPT includes two primary components:

1. Windows Performance Recorder (WPR): The utility used to capture the Event Tracing for Windows (ETW) logs.
2. Windows Performance Analyzer (WPA): The graphical interface used to dissect the captured trace files.

Capturing a DPC Latency Trace

To identify the culprit driver, you must capture a trace while the stuttering or audio dropout is actively occurring.

1. Open the Start menu, type Windows Performance Recorder, and launch it as an Administrator.
2. Under the Select additional profiles for performance recording section, expand Resource Analysis and check the box for CPU usage.
3. Expand the System Activity section and ensure no unnecessary profiles are checked, as ETW traces can grow to several gigabytes within minutes.
4. Set the Logging mode to Memory (this prevents disk I/O from interfering with the trace).
5. Click Start.

Immediately reproduce the issue. Play the audio or perform the action that triggers the stutter. Once the stutter occurs, click Save in WPR, name the file, and allow it to compile the .etl (Event Trace Log) file.

Analysing the Trace in WPA

Double-click the generated .etl file. It will automatically open in the Windows Performance Analyzer. The left-hand pane contains the Graph Explorer, which houses various analytical views.

1. Expand the Computation node in the Graph Explorer.
2. Double-click the DPC/ISR graph to add it to the main analysis view.
3. The graph will display DPC execution times across the timeline. Look for massive spikes on the graph that correlate with the exact moment you experienced the stutter.

Identifying the Culprit Driver

To find the specific driver, look at the data table beneath the DPC/ISR graph. You must organise the columns correctly to reveal the latency data.

Drag the yellow vertical bar (the grouping bar) to the right of the Module and Function columns. Then, sort the table descending by the Max Duration (ms) column. Microsoft strictly recommends that no single DPC should ever exceed 1 millisecond (1000 microseconds).

If you see a driver executing a DPC for 5, 10, or 20 milliseconds, you have found your culprit. The Module column will list the exact .sys file responsible. Common offenders include:

• ndis.sys or tcpip.sys: Typically indicates a highly aggressive or outdated Wi-Fi/Ethernet driver.
• nvlddmkm.sys: The Nvidia graphics driver, often struggling with power state transitions.
• storport.sys: Indicates a storage controller issue, often related to aggressive PCIe link state power management (ASPM).

Once identified, you can resolve the issue by updating that specific OEM driver, rolling it back to a previous stable version, or disabling the associated hardware device in Device Manager to confirm the stutter ceases.