Remove Windows XP-SP3 TCP/IP Connections Limit?

[polonus]

Hi malware fighters,

Removing the Windows XP-SP3 TCP/IP Connections Limit is that advisable?
Re: http://www.windowsreference.com/windows-xp/remove-windows-xp-sp3-tcpip-connections-limit/

I saw this message for this in the logs of Event Log Explorer:

TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

The limit for XPHome is 5 and XPPro is 10. Could this message also indicate malicious connection attempts?
Who will shed some light on this issue?

polonus

[bob3160]

http://www.speedguide.net/read_articles.php?id=1497

[polonus]

Hi bob3160,

Thanks for the link,

pol

[bob3160]

Hope it helped.

[hlecter]

The limit for XPHome is 5 and XPPro is 10. Could this message also indicate malicious connection attempts?
Who will shed some light on this issue?

polonus

I have been offline for a time and found this thread.

Just to clarify:

Windows XP all SP's Home and Pro has no practical limit on the number of concurrent TCP/IP connections
for OUTBOUND connections at a given time.

The numbers 5 and 10 quoted is about simultanous INCOMING connections to a shared folder or a shared printer or
other used shared resources.

So the whole point here is that the maximum OUTBOUND CONNECTION ATTEMPTS in a time-frame of one
second is set to 10 in XP SP2 and XP SP3 home and pro. The rationale for this is to stop malware making new connections too fast and thereby reduce the speed of spreading. XP RTM and XP SP1 didn't have this constraint.

Think of a malware wanting to make 1000 connections outbound from your machine.
That will take at least 100 seconds with this new rule instead of 0.00... seconds.
But in this scenario after that time you could have 1000 outbound simultanous connections without problems.

And you would get the warning in Eventlog/System as you mention.

There is no registry setting for this '10 connection attempts per second' rule.

Some people therefore hack the tcpip.sys file which contains this limit and set it to e.g. 100 instead of 10.

The article at speedguide.net contains much info about hacking that file.

Polonus;
I think this answers your original question: Could this message also indicate malicious connection attempts?
Yes, if there is no other reason for a lot of connection attempts in a given time-frame and the message in Eventlog/System is recurring.

HL

[Hard_ROCKER]

Known problem for us torrent users. You can imagine how many connections are going in and out when downloading torrents. I've been patching this biatch since like forever it seems.

[Lisandro]

How does this work on Vista?

[Hard_ROCKER]

Tech to put your mind at ease, MS has removed this limit if you have Service Pack 2 installed. Also Win 7 does not have this limit... Cheers mate !

[Lisandro]

Tech to put your mind at ease, MS has removed this limit if you have Service Pack 2 installed. Also Win 7 does not have this limit... Cheers mate !

Seems that Vista don't have that limit also... Thanks.

[Hard_ROCKER]

Like i said the limit was removed with Vista Service Pack 2.

[satyr]

Just to clarify:

Windows XP all SP's Home and Pro has no practical limit on the number of concurrent TCP/IP connections for OUTBOUND connections at a given time.

The numbers 5 and 10 quoted is about simultanous INCOMING connections to a shared folder or a shared printer or other used shared resources.

Yeah, it's not 10 concurrent connections, but 10 half-open concurrent connections or in other words connection attempts.

Think of a malware wanting to make 1000 connections outbound from your machine.
That will take at least 100 seconds with this new rule instead of 0.00... seconds.
But in this scenario after that time you could have 1000 outbound simultanous connections without problems.

Though it surely is a security measure, it's somewhat pointless. I mean, if there is a worm exploiting a vulnerability in a given environment, I is limited to only infect 10 machines at a time? But then it'll infect 10, and then 10, etc...

If you are interested, see the debate in "On patching the Win XP SP2's "tcpip.sys" driver ..." thread that I opened on forum on Ars Technica.

Known problem for us torrent users. You can imagine how many connections are going in and out when downloading torrents. I've been patching this biatch since like forever it seems.

I use a p2p program Soulseek and I was too getting these warnings (Event ID: 4226) in the Event Viewer all the time, therefore, same as you, I manually patched (for others, see this post of mine that explains how to do it) the "tcpip.sys" driver. Also, there is xp-AntiSpy program that does it four you!!