This is the mail archive of the cygwin-xfree mailing list for the Cygwin XFree86 project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

TCP/IP Security Limits - WinXP and XWIN.exe


Hi.

I am using cygwin on winXPSP2 to run a linux-hosted tk application.
The application is invoked using a batch file which uses ssh to invoke
the application remotely on a linux box and cause it to display its
GUI on the windows desktop.

Unfortunately, once I close the application down, I experience failure
of the networking on the WinXP box. I can't make any connection in or
out of the box and any attempt to 'repair' the interface results in
the NIC not being able to obtain an IP address via DHCP. The only way
to resolve the issue is to reboot the box or to disable/enable the
network card.

Inspection of the Windows Event Log reveals the following omminous warning...

"TCP/IP has reached the security limit imposed on the number of
concurrent TCP connect attempts."

Trawling Microsoft.com reveals...

Limited number of simultaneous incomplete outbound TCP connection attempts
=========================================================

* Detailed description

The TCP/IP stack now limits the number of simultaneous incomplete
outbound TCP connection attempts. After the limit has been reached,
subsequent connection attempts are put in a queue and will be resolved
at a fixed rate. Under normal operation, when applications are
connecting to available hosts at valid IP addresses, no connection
rate-limiting will occur. When it does occur, a new event, with ID
4226, appears in the system's event log.

* Why is this change important? What threats does it help mitigate?

This change helps to limit the speed at which malicious programs, such
as viruses and worms, spread to uninfected computers. Malicious
programs often attempt to reach uninfected computers by opening
simultaneous connections to random IP addresses. Most of these random
addresses result in a failed connection, so a burst of such activity
on a computer is a signal that it may have been infected by a
malicious program.

* What works differently?

This change may cause certain security tools, such as port scanners,
to run more slowly.

* How do I resolve these issues?

Stop the application that is responsible for the failing connection attempts.

-----

Anyone run into this one before with XWin.exe? If so a nudge in the
right direction would be much appreciated.

Mark.

--
regards,

Mark P. Edwards



--
regards,

Mark P. Edwards

--
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple
Problem reports:       http://cygwin.com/problems.html
Documentation:         http://x.cygwin.com/docs/
FAQ:                   http://x.cygwin.com/docs/faq/


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]