Win Xp Service Pack 2 Poised To Destroy Most/all F

[executive]

I looked on the microsoft update site and it looks like SP2 hasn't been officially released yet, which means its probably not a good idea to put it on until it is.
Can anyone else confirm having problems with Kazaa (or its spinoffs) that are DEFINATELY related to SP2 once it is officially released?

[RealitY]

I may have a comparison later today...

[RealitY]

I was running a very populated torrent prior to the fix and noticed even though I was connected to alot users on the file I just couldnt get past 5k for any extended period, although I seem to remember having these issues ever since even sp1, Ive now opened the same torrent which has about the same users on it as just a few hours ago and I am getting a steady 20k - 50k and from what it looks like I am one of the fastest peer on this file.

I was wondering also how someone wouldve even know if tcpip.sys was even screwing down open connections other than the supposed message that has been know to appear in eMule which I never saw, most likely due to the fact I have very few files dling and their mostly rare ones with few sources. I also am wondering if sp1 had was affected in any similar way...

[NeoTheOne]

im feeling the effects 2

[NeoTheOne]

This has cropped up on Warp2Search:

Just found this in my event-log after starting emule: "EventID 4226 TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts"

This is what I get from a MS-Guy when i asked him why XPSP2 slows down programs like emule which open many connections to different destinations:

"Thanks very much for responding. This new feature is one of the stack's "springboards", security features designed to proactively reduce the future threat from attacks like blaster and Sasser that typically spread by opening connections to random addresses. In fact, if this feature had already been deployed, Sasser would have taken much longer to spread.

It's not likely to help stop the spread of spam unless spammers are trying to reach open email relays in the same way, by opening connections on smtp ports of random IP addresses. This is new with XP SP2 and we're trying to get it right so that it does not interfere with normal system operation or performance of normal, legitimate applications, but does slow the spread of viral code. New connection attempts over the limit for half-open connections get queued and worked off at a certain (limited rate)."

There appears to be a registry workaround to this, which can be found here

News source: Warp2Search

[sebastian_insua]

Originally posted by neotheone@8 August 2004 - 01:36
This has cropped up on Warp2Search:

Just found this in my event-log after starting emule: "EventID 4226 TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts"

This is what I get from a MS-Guy when i asked him why XPSP2 slows down programs like emule which open many connections to different destinations:

"Thanks very much for responding. This new feature is one of the stack's "springboards", security features designed to proactively reduce the future threat from attacks like blaster and Sasser that typically spread by opening connections to random addresses. In fact, if this feature had already been deployed, Sasser would have taken much longer to spread.

It's not likely to help stop the spread of spam unless spammers are trying to reach open email relays in the same way, by opening connections on smtp ports of random IP addresses. This is new with XP SP2 and we're trying to get it right so that it does not interfere with normal system operation or performance of normal, legitimate applications, but does slow the spread of viral code. New connection attempts over the limit for half-open connections get queued and worked off at a certain (limited rate)."

There appears to be a registry workaround to this, which can be found here

News source: Warp2Search

I already said ther is no register workaround:

There is a patch which should work at: http://www.lvllord.de/4226fix/4226fix-en.htm

However it is not for the latest version of SP2 yet....

It cannot be changed via the registery as that would cause security problems as viruses could just disable the service too easily.

I don't know why so many people worry about SP2 it is a great improvemnet over what we already have....?

If you want ot stop this from happening you shall have to use the patch I mentioned earlier in the post.

[Switeck]

Originally posted by REALITY@7 August 2004 - 17:42
I was running a very populated torrent prior to the fix and noticed even though I was connected to alot users on the file I just couldnt get past 5k for any extended period, although I seem to remember having these issues ever since even sp1, Ive now opened the same torrent which has about the same users on it as just a few hours ago and I am getting a steady 20k - 50k and from what it looks like I am one of the fastest peer on this file.

I was wondering also how someone wouldve even know if tcpip.sys was even screwing down open connections other than the supposed message that has been know to appear in eMule which I never saw, most likely due to the fact I have very few files dling and their mostly rare ones with few sources. I also am wondering if sp1 had was affected in any similar way...

Ironically, you may have found a special case with BitTorrent which is less likely to set off Win XP SP2's draconian connection blocker.

It's only when your computer accumulates 10 FAILED connections in a short time that the blocker kicks in. But if you're on a very populated torrent and only attempting a few new connections every 5-10 seconds, then I think most of the new connections are slightly more likely to be LIVE connections -- thus the ratio of good to failed connections is rather high.

Mainly, it's when you FIRST connect to a torrent that tripping the blocker is most likely -- because that's when the torrent retries its STORED ip sourcelist...which are most likely to be dead for days/weeks/months!

Also, with many file-sharing programs, you can probably reduce settings to the point where tripping the blocker becomes unlikely -- but by then you're running using settings little different than what 56k dial-up users use!

Your example in e-mule is likewise probably unlikely to trip the blocker as well. You have few downloads with few sources and probably told emule to retry only a couple downloads at a time.

I'll say it again to ALL -- it's NOT the number of connections you HAVE that trips the blocker, but rather the number of FAILED connections gained in under a minute that causes the blocker to start KILLING many/all connections!

[RealitY]

Originally posted by Switeck@8 August 2004 - 17:41
Ironically, you may have found a special case with BitTorrent which is less likely to set off Win XP SP2's draconian connection blocker.

It's only when your computer accumulates 10 FAILED connections in a short time that the blocker kicks in.

Not sure if you noticed but I have applied the fix already which raises the value to 50 which should be enough for any user...

[killer04]

Cant find C:\WINDOWS\SERVICEPACKFILES\I386

[Alex H]

There is a patch on the Shareaza forums to make SP2 accept unlimmited connections. I think it is based on the one posted earlier, but I'm not going to be using SP2 so it doesn't really affect me.

Cant find the specific post for the patch, but it's somewhere on these forums.