From:
http://www.microsoft.com/downloads/details.aspx?FamilyID=7bd948d7-b791-4
0b6-8364-685b84158c78&DisplayLang=en
http://tinyurl.com/z0rv
If you don't want to wade through that...
Detailed description
The TCP/IP stack now limits the number of simultaneous incomplete
outbound TCP connection attempts. After the limit has been reached,
subsequent connection attempts are put in a queue and will be resolved
at a fixed rate. Under normal operation, when applications are
connecting to available hosts at valid IP addresses, no connection
rate-limiting will occur. When it does occur, a new event, with ID 4226,
appears in the system's event log.
Why is this change important? What threats does it help mitigate?
This change helps to limit the speed at which malicious programs, such
as viruses and worms, spread to uninfected computers. Malicious programs
often attempt to reach uninfected computers by opening simultaneous
connections to random IP addresses. Most of these random addresses
result in a failed connection, so a burst of such activity on a computer
is a signal that it may have been infected by a malicious program.
What works differently?
This change may cause certain security tools, such as port scanners, to
run more slowly.
How do I resolve these issues?
Stop the application that is responsible for the failing connection
attempts.
Now, there's a tcpip.sys out there that 'fixes' this, but it's not a
official Microsoft release, so it may or may not be a good idea to
install such a thing..
Nick Johannes
MIS/IT, ShopNBC
-----Original Message-----
From: Ian Hayes [mailto:Ian.Hayes@DPSI-INC.COM]
Sent: Wednesday, August 11, 2004 10:56 AM
To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Subject: XP SP2 nmap incompatibility
Installed XP SP2 yesterday. While the installation was lengthy but
event-free, I did notice that nmap 3.55 stopped working correctly. I was
in between scanning subnets here on the network, and installed SP2.
After that, when I resumed my sweeps, I noticed that nmap was reporting
that any host I tried scanning had all its ports filtered. I tried
upgrading the Winpcap driver to the beta one, but that didn't improve
things. I doublechecked my Windows Firewall settings and verified that
it was set to OFF.
After removing SP2, I scanned a host with a known configuration and nmap
correctly identified the open ports and what OS it was running.
-----
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such
that just hitting reply is going to result in the message coming to the list,
not to the individual who sent the message. This was done to help reduce the
number of Out of Office messages posters received. So if you want to send a
reply just to the poster, you'll have to copy their email address out of the
message and place it in your TO: field.
-----
