Balcells Blog Home

And for the random geeky comment of the day:

Windows XP SP2 introduced a few new twists to TCP/IP in order to babysit users and "reduce the threat" of worms spreading fast without control. In one such attempt, the developers limited the number of possible TCP connection attempts per second to 10 (from unlimited in SP1). This argumentative feature affects server and P2P programs that need to open many outbound connections at the same time.

The "forward-thinking" of Microsoft developers here is that you can only infect 10 new systems per second via TCP/IP. Mmmh... If you also consider that each of those infected computers will infect 10 others at the same rate:

second 1: 1+10 computers
second 2: 10+10*10 computers (110 new ones)
second 3: 10+100*10 computers ( 1110 new ones)
second 4: 10+1000*10 computers (11110 new ones)
...
all the way to 10*60 + 10^60 computers in a single minute (that's a number with 60 digits, or it would far exceed Earth's population).

So, we've established this is not going to stop a worm spreading. At best it's going to delay it a few seconds, limit possible network congestion a bit, and limit the use of your PC to 10 connection attempts per second in the process. This is all fine, but still, users should have the option to easily disable or change the setting. Although the setting was registry editable in XP SP1, it is now only possible to edit it by changing it directly in the system file tcpip.sys. To make matters worse, that file is in use, so you also need to be in Safe mode in order to edit it.

Either that, or use a tool like this:

http://www.lvllord.de/?lang=en&url=downloads