Trenger hjelp med melding i Hendelsesloggen

[mirene]

Jeg har nettop reinstalert Windows XP pro. inklusiv alle oppdateringer.

Jeg pleier å ha Hendelsesloggen oppe noen ganger..for å se at alt er ok med windows/eller annet.

Men nå har jeg fått en melding jeg ikke har vert borti tidligere :

 

Jeg har fått en melding i hendelsesloggen under Start/Kontrollpanel/Administrative Verktøy/Hendelsesliste/System.

"TCP/IP har nådd sikkerhetsbegrensningen for antall samtidige TCP-tilkoblingsforsøk"

 

Kan noen hjelpe meg med hva dette kommer av ?

[sdhild99]

Er EventID 4226 ?

 

http://forum.hardware.no/index.php?showtopic=302169&hl=

 

En begrensning innført med SP2

[Syar-2003]

Dette er et av sikkerhets tiltakene i sp2 , den det gjelder for nettverk i tcp/ip .

http://www.microsoft.com/technet/prodtechn...netwk.mspx#EHAA

 

What new functionality is added to this feature in Windows XP Service Pack 2?

Restricted traffic over raw sockets

Detailed description

 

A very small number of Windows applications make use of raw IP sockets, which provide an industry-standard way for applications to create TCP/IP packets with fewer integrity and security checks by the TCP/IP stack. The Windows implementation of TCP/IP still supports receiving traffic on raw IP sockets. However, the ability to send traffic over raw sockets has been restricted in two ways:

 

• TCP data cannot be sent over raw sockets.

 

• UDP datagrams with invalid source addresses cannot be sent over raw sockets. The IP source address for any outgoing UDP datagram must exist on a network interface or the datagram is dropped.

 

 

Why is this change important? What threats does it help mitigate?

 

This change limits the ability of malicious code to create distributed denial-of-service attacks and limits the ability to send spoofed packets, which are TCP/IP packets with a forged source IP address.

 

Limited number of simultaneous incomplete outbound TCP connection attempts

Detailed description

 

The TCP/IP stack now limits the number of simultaneous incomplete outbound TCP connection attempts. After the limit has been reached, subsequent connection attempts are put in a queue and will be resolved at a fixed rate. Under normal operation, when applications are connecting to available hosts at valid IP addresses, no connection rate-limiting will occur. When it does occur, a new event, with ID 4226, appears in the system’s event log.

 

Why is this change important? What threats does it help mitigate?

 

This change helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in a failed connection, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.

 

What works differently?

 

This change may cause certain security tools, such as port scanners, to run more slowly.

 

How do I resolve these issues?

 

Stop the application that is responsible for the failing connection attempts.

[mirene]

Ja det var EventID 4226.

Og ja,jeg har SP2 instalert.

 

ok...jeg brukte det programmet som sto under linken.http://www.lvllord.de/?url=tools&lang=en

Og den satte opp verdien fra 10 til 50.

Jeg kunne og sette den høyere,om jeg ville.

Vil det ha noen positiv virkning og sette den enda høyere,en 50 ??

Og var 50 limmiten på Service Pack 1 ?

Endret 24. september 2004 av mirene

[Syar-2003]

Man må huske på at denne regelen med 10 simultaneous KUN gjelder for incomplete outbound connection attempts .

Normale utgående forbindelser til host IPer som svarer er fremdeles ubegrenset .

Endret 24. september 2004 av syar2003