XP SP2: TCP/IP has reached the security limit

[Vittorio Pavesi]

Hello,
I'm getting EventID 4226 many times after installing SP2, after googling it
seems to be a security feature that limit the number of connection number
which are in the process of being opened, is there any MS documentation
about it ?

Anybody know if the following parameter affect ?

System Key:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters]
Value Name: TcpNumConnections

Thanks a lot !

Vittorio

 

[Ron Lowe]

Hello,
I'm getting EventID 4226 many times after installing SP2, after googling
it
seems to be a security feature that limit the number of connection number
which are in the process of being opened, is there any MS documentation
about it ?

Anybody know if the following parameter affect ?

System Key:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters]
Value Name: TcpNumConnections

Thanks a lot !

Vittorio

Here's some documentation on it:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx

===========

Limited number of simultaneous incomplete outbound TCP connection attempts
Detailed description

The TCP/IP stack now limits the number of simultaneous incomplete outbound
TCP connection attempts. After the limit has been reached, subsequent
connection attempts are put in a queue and will be resolved at a fixed rate.
Under normal operation, when applications are connecting to available hosts
at valid IP addresses, no connection rate-limiting will occur. When it does
occur, a new event, with ID 4226, appears in the system's event log.

Why is this change important? What threats does it help mitigate?

This change helps to limit the speed at which malicious programs, such as
viruses and worms, spread to uninfected computers. Malicious programs often
attempt to reach uninfected computers by opening simultaneous connections to
random IP addresses. Most of these random addresses result in a failed
connection, so a burst of such activity on a computer is a signal that it
may have been infected by a malicious program.

What works differently?

This change may cause certain security tools, such as port scanners, to run
more slowly.

How do I resolve these issues?

Stop the application that is responsible for the failing connection
attempts.

===========

Some P-2-P apps may fall foul of this, too.

THeres nothing you can do.
Either ignore the error, or stop using the app.

There's a hacked DLL on the internet, which your googling probably pulled
up, which I wouldnt touch myself.

 

[Vittorio Pavesi]

Really thanks, your explanation is perfect !

Hello,
I'm getting EventID 4226 many times after installing SP2, after googling
it
seems to be a security feature that limit the number of connection number
which are in the process of being opened, is there any MS documentation
about it ?

Anybody know if the following parameter affect ?

System Key:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters]
Value Name: TcpNumConnections

Thanks a lot !

Vittorio

Here's some documentation on it:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx

===========

Limited number of simultaneous incomplete outbound TCP connection attempts
Detailed description

The TCP/IP stack now limits the number of simultaneous incomplete outbound
TCP connection attempts. After the limit has been reached, subsequent
connection attempts are put in a queue and will be resolved at a fixed rate.
Under normal operation, when applications are connecting to available hosts
at valid IP addresses, no connection rate-limiting will occur. When it does
occur, a new event, with ID 4226, appears in the system's event log.

Why is this change important? What threats does it help mitigate?

This change helps to limit the speed at which malicious programs, such as
viruses and worms, spread to uninfected computers. Malicious programs often
attempt to reach uninfected computers by opening simultaneous connections to
random IP addresses. Most of these random addresses result in a failed
connection, so a burst of such activity on a computer is a signal that it
may have been infected by a malicious program.

What works differently?

This change may cause certain security tools, such as port scanners, to run
more slowly.

How do I resolve these issues?

Stop the application that is responsible for the failing connection
attempts.

===========

Some P-2-P apps may fall foul of this, too.

THeres nothing you can do.
Either ignore the error, or stop using the app.

There's a hacked DLL on the internet, which your googling probably pulled
up, which I wouldnt touch myself.

 

[Quaoar]

Hello,
I'm getting EventID 4226 many times after installing SP2, after
googling it
seems to be a security feature that limit the number of connection
number
which are in the process of being opened, is there any MS
documentation
about it ?

Anybody know if the following parameter affect ?

System Key:
[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters]
Value Name: TcpNumConnections

Thanks a lot !

Vittorio

Here's some documentation on it:

http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/sp2netwk.mspx

===========

Limited number of simultaneous incomplete outbound TCP connection
attempts
Detailed description

The TCP/IP stack now limits the number of simultaneous incomplete
outbound TCP connection attempts. After the limit has been reached,
subsequent connection attempts are put in a queue and will be resolved
at a fixed rate. Under normal operation, when applications are
connecting to available hosts at valid IP addresses, no connection
rate-limiting will occur. When it does occur, a new event, with ID
4226, appears in the system's event log.

Why is this change important? What threats does it help mitigate?

This change helps to limit the speed at which malicious programs, such
as viruses and worms, spread to uninfected computers. Malicious
programs often attempt to reach uninfected computers by opening
simultaneous connections to random IP addresses. Most of these random
addresses result in a failed connection, so a burst of such activity
on a computer is a signal that it may have been infected by a
malicious program.

What works differently?

This change may cause certain security tools, such as port scanners,
to run more slowly.

How do I resolve these issues?

Stop the application that is responsible for the failing connection
attempts.

===========

Some P-2-P apps may fall foul of this, too.

THeres nothing you can do.
Either ignore the error, or stop using the app.

There's a hacked DLL on the internet, which your googling probably
pulled up, which I wouldnt touch myself.

I've "touched" it and it appears to work just fine. SFC takes care of
it if something goes bad from my testing. It should only be installed
in safe mode.

Q

 

[Ron Lowe]

There's a hacked DLL on the internet, which your googling probably

I've "touched" it and it appears to work just fine. SFC takes care of
it if something goes bad from my testing. It should only be installed
in safe mode.

Yes, I know.

But I'm reluctant to generally recomend something which
may work in individual cases, but I've no real confidence
is kosher and will not break something else.

Especially when the something is a hacked file which the
hacker does not have full ownership or knowledge of.

Of course, postitve posts like yours add weight to the opinion
that it's OK, and I guess weight of opinion can gather over time.

I'm happy to stop short at mentioning it's existence,
and letting the OP make the judgement call.