[MxxCon]

Hello P2P Supporter,

If you installed Windows XP SP2, then Microsoft has severly limited the rate at which connections can be made on your computer. Where you used to be able to establish hundreds of connections in a short period of time, you may now only establish connection to 10 peers. Any more than 10 connections in often 10+ seconds (this depends on the latency of the connecting party) will cause new connections to become throttled and eventually denied all together.

This has serious damaging effects to eMule, the eDonkey Network, P2P as a whole. It means a slower network and eventually fewer search results. It means connections fail more frequently and losing your spot in someone's queue. It also provides a means for disruptive users or music industry thugs to sabotage P2P networks by preventing connection opportunity through SYN attacks.

This also effects your web browser and other internet applications. If you ever notice slow browsing, broken images, or ignored page requests while you have eMule running... now you know why!

And even searching for new multiplayer game servers will be severly hindered.

You can tell if this new "speed limit" is effecting you by viewing your System Event messages (Right-Click "My Computer > Manage > System Tools > Event Viewer > System"). You will see yellow-triangle Warning events with "Tcpip" as the Source. Double-Clicking on one of these events will display the following message.

" TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts. "

Micro$oft implimented this feature to slow down the effect of email worms and exploits. They figure people don't need to be making so many connections in such a short timeframe, even though P2P demands it. Yet another tactic to try and curb file trading.

There is a fix however. It requires editing your tcpip.sys file, which is located in your c:\windows\system32\drivers\ folder. There may be other tcpip.sys files on your system, but this appears to be the important one. This file is a binary file, and requires a hex editor to make changes.

Before making any changes to your system, always backup what you're about to hack.

The following instructions are for the Final Release of XP SP2 (build 2180). Other builds may or may not have the same tcpip.sys file. The file should be exactly 359,040 bytes and have a Last Modified time of 8/3/2004 11:14 PM. Its CRC-32 is 8042A9FB and MD5 is 9F4B36614A0FC234525BA224957DE55C.

This fix will remove all tcpip socket creation limitations in Microsoft Windows XP SP2.

In your hex editor...

First Goto offset 130 (hex) or 304 (decimal)...
Replace these 4 bytes of hex data: 6E 12 06 00
With these 4 bytes of hex data: 62 13 06 00

Then Goto offset 4F322 (hex) or 324386 (decimal)... *from beginning of file*
Replace these 4 bytes of hex data: 0A 00 00 00
With these 4 bytes of hex data: FE FF FF 00

If any of the data that you're replacing does not match exactly, double check what you are doing, or abort completely.

Once you are confident you applied the correct changes, save the file. You should not experience any write protect issues while saving. If you do, log on as administrator.

Reboot.

YOU ARE NOW FREE FROM MICROSOFT RULE AND OPPRESSION!
well, just a little bit anyway. enjoy!

[source: http://www.lvllord.de/]

This post has been edited by MxxCon: 11 August 2004 - 04:17 AM

[Frozen North]

Sounds great... if it works.

I'll let someone else try it first.

[YaRi]

Until there is a simple tool that makes the correction, this won't be adopted by the masses. Most ppl do not have even hex-editors available..

[hhhh81]

You can find an automated fix here :
http://www.lvllord.d...fix/4226fix.htm

[YaRi]

That's great, I've found another link also: http://www.neowin.ne...st&id=584323903

[Yemble]

This patch DOES get rid of the 4226 events from the Event Log, however, it does not totally cure the problems when running eMule with SP2.

I am still experiencing dropped PING packets when running both eMule and IE simultaneously. This is resulting in Messenger disconnecting. I think that there is something else in play here, but I'm not quite sure what.

I did note that SP2 seems to play with some of the TCP settings, which I have reset with TcpOptimizer program (www.speedguide.net)....

....but my problem remains

[ichonderoga]

Works like a charm, thx a million

/Ichon

[Edit: To below comment]
Well maybe I don't get it, but atleast everything works like the good old days, now. So good hunting NoFace ...
[/edit]

This post has been edited by ichonderoga: 16 August 2004 - 08:11 PM

[NoNameFace]

You really don't get it, do you?

This limit does not influence eMule's performance AT ALL. What does happen is that eMule takes maybe one or two minutes longer to make all the connections, that's all.

This post has been edited by NoNameFace: 16 August 2004 - 05:46 PM

[guillaumeemule]

from Microsoft website :
http://www.microsoft...ion127121120120

Quote

The TCP/IP stack now limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit has been reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate. Under normal operation, when applications are connecting to available hosts at valid IP addresses, no connection rate-limiting will occur. When it does occur, a new event, with ID 4226, appears in the system’s event log.

So you can connect as fast as you want as long as the remote hosts accept the connections.
However, the incomplete connections will temporarely slow the new ones, which shouldn't be a so big problem.
I started emule and just had one time the alert.
5mn later, I am downloading at 30KB/s...

At worse I think you will just take more time to have more sources (if some sources does not respond), but I can be wrong.

This post has been edited by guillaumeemule: 16 August 2004 - 09:45 PM

[netfinity]

Just hope all these infested people will upgrade to SP2 so we can get rid of those constant DDOS like attacks that bring our broadband routers on their knees.

[nemesisv]

Fully automated version :

https://a833.c1s1.ne...PSP2Patch%2EEXE

Able to uninstall.

[Abraxsis]

I've got Winxp Professional with service pack 1. Should I even bother installing service pack 2? I'm a regular user of torrents and emule, so I'm not sure wether to install it or skip it. Any suggestions? Any benefits from installing it?

[netfinity]

The main feature with SP2 is that it greatly reduces the chance you get infected with virus/worms. Also, provides a quite neat pop-up blocker in Internet Explorer.

If you don't have an external firewall (e.g broadband router), I suggest that SP2 is installed and the Windows Firewall (only way to get boot time protection in Windows) is activated.

I use both WF and Kerio FW, plus that I have a broadband router. You can never be safe enough!

[wdekler]

MS makes an update to improve security and people start patching their systems to undo it... just to reduce their p2p startup time...

[PluG]

I`ve now installed SP2 without patching and my emule don`t seem to be running any different. But given the higher level of protection even if startup had been affected I prolly wouldn`t have installed the patch anyway.

@wdekler
Most probably the same ppl who are normally complaining about all the security holes in Windows.

[kadau]

Quote

Should I even bother installing service pack 2?

If you want to continue to get updates for xp then yes, you should install sp2, otherwise (feel free to correct me if im wrong) you wont be recieving any from m$..

[netfinity]

Quote

If you want to continue to get updates for xp then yes, you should install sp2, otherwise (feel free to correct me if im wrong) you wont be recieving any from m$..

Well, that will be most likely true as much as you need to have SP1 to install every post SP1 fixes. I wouldn't dare to use IE or Outlook without applying the latest patches, as a firewall or antivirus program doesn't give protection against attacks encapsulated within contents you access. (e.g buffer over/underrun attacks)

Worth to notice is that Linux probably have more vunerabilies as there is not as fun to test em as with Windows. Windows clients exist in large quantities and in large the computer knowledge among their userbase is much lower than compared to Linux. This makes Windows a hot target for this kind of attacks.

[kadau]

Quote

You really don't get it, do you?

This limit does not influence eMule's performance AT ALL

heh, you people amuse me. believe it or not just because something works some way on *your* setup doesn't necessarily mean its the same for everyone else. there are plenty of variables involved here. now for me, without the patch, most of my downloads only find a fraction of the possible sources. so for my setup, the patch makes a difference. jeez

[Abraxsis]

I think I'm going to wait and see with this new service pack. I've been running XP for about a year now, with no firewall or antivirus software, and I've had no problems at all so far. I think I'll keep things as they are since everything's working perfectly as is. With my luck I'd install it and my pc would stop working...lol.

[netfinity]

Quote

I think I'm going to wait and see with this new service pack. I've been running XP for about a year now, with no firewall or antivirus software, and I've had no problems at all so far. I think I'll keep things as they are since everything's working perfectly as is. With my luck I'd install it and my pc would stop working...lol.

I'm astonished! If I install a clean Windows 2000 or XP on a machine without first putting it behind a firewall or unplug the network cable, my machine would be infected long before I ever get the login screen.