Avidity Software

New VNCAdmin 2.1.43 release. Added a few misc. fixes along with an XP SP2 check and notification of potential issues concerning this.

Getting too few results when scanning on a Windows XP SP2 machine? Here's why.



From the article...

Limited number of simultaneous incomplete outbound TCP connection attempts

Detailed description

The TCP/IP stack now limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit has been reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate. Under normal operation, when applications are connecting to available hosts at valid IP addresses, no connection rate-limiting will occur. When it does occur, a new event, with ID 4226, appears in the system’s event log.

Why is this change important? What threats does it help mitigate?

This change helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in a failed connection, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.

What works differently?

This change may cause certain security tools, such as port scanners, to run more slowly.

How do I resolve these issues?

Stop the application that is responsible for the failing connection attempts.



------



There is a tool/patch/hack/etc that will edit your TCPIP.sys file and allow you to change the limit of 10 simultaneous incomplete outbound TCP connection attempts to whatever you want.

This tool can be found here. I have used this with great success, but of course, if it breaks your system, I cannot be held responsible. :)

If you have any issues, of course, shoot me an email.