Coffeehouse Thread

13 posts

Forum Read Only

This forum has been made read only by the site admins. No new threads or comments can be added.

Connection Limit / SP2 / Hate MS

Back to Forum: Coffeehouse
  • User profile image
    Manip

    I just got hit by the SP2 'feature' that causes me to lose connectivity when I hit my connection limit (event 4226). Now your all thinking, then don't run P2P apps or something.. but I wasn't.. I was using the computer in a normal way to do a normal thing I would expect XP to be able to do.

    I had approx 8~ IE windows open. I was browsing EBay, opening windows for things that interest me and leaving them open if I want to come back and give them even greater attention (my normal strategy). But then my main EBay search page (window) gets disconnected and I have to start from scratch now.. or at least I *would* if I could connect to EBay.

    I think it is unreasonable to set the connection limit *so* low. This was put in place to stop machines being used as zombies in bot-nets but what is the point when you can't even use XP for the purpose of which it was designed?!

    This normal usage behaviour that was adversely effected by your security clearly shows that you did a sucky job with sucky testing.

    Oh and I don't need to hear that I shouldn't have *so* many pages open because that is how *I* like to surf and it isn't up to my you or my OS to tell me otherwise.

    Before you ask, the only programs that where making out-going connections (according to 'NetView') are MSN Messenger, Trillian (AIM) and IE (Times the number of browser windows).

  • User profile image
    Larry​Osterman

    The limit on connections isn't a limit on outgoing connections.  It's a limit on outgoing connections that haven't completed.  So you can have hundreds and hundreds of outgoing connections, IF there's a live server on the other side of the connection.

  • User profile image
    mikekol

    This normal usage behaviour that was adversely effected by your security clearly shows that you did a sucky job with sucky testing.

    Seriously, dude.  A little sucky research would go a long way before you waste some sucky bandwidth on a sucky rant like this.  Like Larry said, it's not a limit on sucky TCP connections.  It's a limit on sucky TCP connections that don't have sucky active communication with the sucky box on the sucky other end.  If you got the sucky error during your "normal" sucky use, it's because there were too many sucky dead connections, not too many sucky connections in general.

    Sucky.

  • User profile image
    VBJB

    mikekol wrote:
    This normal usage behaviour that was adversely effected by your security clearly shows that you did a sucky job with sucky testing.

    Seriously, dude.  A little sucky research would go a long way before you waste some sucky bandwidth on a sucky rant like this.  Like Larry said, it's not a limit on sucky TCP connections.  It's a limit on sucky TCP connections that don't have sucky active communication with the sucky box on the sucky other end.  If you got the sucky error during your "normal" sucky use, it's because there were too many sucky dead connections, not too many sucky connections in general.

    Sucky.


    LOL (mikekol rant goes well with his picture)

  • User profile image
    mikekol

    It just seemed like a really good idea at the time Smiley

  • User profile image
    lars

    LarryOsterman wrote:
    It's a limit on outgoing connections that haven't completed.


    Still you should not have to be bothered by this if you're just browsing the web.
    Anyone else experiencing these problems?


  • User profile image
    object88

    LarryOsterman wrote:
    It's a limit on outgoing connections that haven't completed.


    So, a user can only have, for example, ~10 (or whatever the limit is) web pages loading at the same time?  What about pages that auto-reload (which aren't that many, but they do exist)?

  • User profile image
    Jeremy W

    Um, no, because web page connections complete as soon as the page loads. It's only if there are a certain number of connections in a "hung" state (as I understand it).

    It's not open connections. It's not active connections. It's not passive connections. It's not listeners...

    As I understand it, it's open, outgoing connections which are in a hung state.

  • User profile image
    lars

    Could this be caused by pages littered with banners and pictures from ad-servers that don't respond quickly enough?

  • User profile image
    Mike Dimmick

    lars wrote:
    Could this be caused by pages littered with banners and pictures from ad-servers that don't respond quickly enough?


    Possibly. To get technical, it's TCP connections where the client has sent its initial SYN but the server hasn't yet replied with SYN-ACK. The initial SYN can have accompanying data but I don't think regular use of Winsock APIs does so: an Ethereal log I just took shows the SYN/SYN-ACK/ACK three-way handshake happening before any data packets are sent. That's a waste of three perfectly good packets, of course...

    The new code limits the number of connections that can be in the SYN_SEND state to 10. Any further connection attempts will be queued (i.e. the TCP stack won't send the initial SYN) until either the SYN-ACK is received or the stack times the request out.

    So far I've only seen this event when running the BitTorrent client. I've not seen it at all when just using the web browser, but YMMV. If you are seeing it, you may be infected with something - if you haven't already, download and install XP SP2, load up an anti-virus (I'm using AVG) and run a spyware check (although take the response with a pinch of salt - my check last night with AdAware flagged up my use of about:blank as my IE start page twice and about 300 harmless cookies). Oh, and run as a limited user. Yes, it's painful. But it's probably the single most important thing you can do to limit what malicious code can do.

    For more helpful info, I can't do better than suggest double-clicking the event in Event Viewer then clicking the link to Help and Support Center. Unfortunately this page doesn't appear to be available elsewhere despite being web content.

  • User profile image
    Mike Dimmick

    Actually, it looks like you can use WSAConnect rather than plain old connect to send your data with the connection request; the server can use AcceptEx, rather than just accept or WSAAccept, to wait for some data to be sent before the TCP stack reports that the asynchronous operation completes.

    I believe IIS 5.x uses AcceptEx to get better performance. IIS 6.0 uses the HTTP.SYS driver which keeps everything in kernel mode until something actually needs processing by user-mode code.

  • User profile image
    lars

    Does this only apply to TCP? Can you still "go postal" with UDP?

  • User profile image
    lars

    Manip wrote:
    I just got hit by the SP2 'feature' that causes me to lose connectivity when I hit my connection limit (event 4226). Now your all thinking, then don't run P2P apps or something.. but I wasn't.. I was using the computer in a normal way to do a normal thing I would expect XP to be able to do.


    When Outlooks goes looking for new mail on the different servers I use, and NewGator (RSS reader integrated with Outlook) kicks in at the same time I get the same delays surfing. If I happen to run Sharpreader at the same time it gets even worse. So this limit does interfer and cripple my normal computer usage.

Conversation locked

This conversation has been locked by the site admins. No new comments can be made.