Weird one for you

OK, a simple enough “network” with 2 XP Home machines

One DSL router, two machines and a networked (RJ45) laser printer.

Machine 1 has a second hard drive which both machines map drives to.

Machine 2 operation is fine, can see files on the mapped drives and has internet access happily

Machine 1 is hitting the concurrent network connections limit of 5 in error log and thereafter cannot connect to the internet using IE, yet ping, tracert and domain resolution are all fine from dos.

This setup has been working fine for nearly two years, and after complaints of the machine going slow we now have this issue. It would appear to me that tcp-ip is messed up in someway. I have also spotted in the error logs that IDE1 has not responded correctly a couple of times, could this be the issue ? A failing HD, so when it tries to connect to the mapped drive it tries a couple of times - hence hitting the concurrent connections limit ?

:help: and :idea: required - I’m at a loss

DT.

Stab in the dark time

Ping tracert and dns lookups are connectionless, cant remember if nslookup is TCP or UDP but its possibly excluded from MS connection limits. Who knows the secrets of the XP TCP stack other than 1/2 million taiwanese hackers and Bill Gates :shrug:

I’m wondering if you have other TCP connections established ?

Any hints from a netstat -an ?

/edit
nslookup is UDP, had to go and find out.
So it wont show up in the connection limits.

Its probably the windows genuine advantage program calling home every 20 minutes plus windows update and itunes or real player

found it :sigh:

It’s for a client of the firm I used to work for, and they couldn’t find it. A netstat -no showed a load of SYN_SENT from the same PID. So found the PID in task manager and then looked it up. VIRUS it is then, some dirk had installed Limewire and viewed some sites of horrid nature when the boss was off for a couple of days. He got sent packing this afternoon, and his commission is going to have a wodge missing for my fee.

It would appear the virus was trying to broadcast that it had got on the machine, it never managed it, but took up all the connection states trying, one failed so it opened another, and another, and another …

I suppose whilst I’m remote in I should also go to FAH504 :chuckle:

Another hour or so to make sure it’s clean I think :sigh:

Cheers TFW :thumbsup: netstat got me out of linux mode as that it what I’m working on for my job that is paying the bills …

DT.

Good job troubleshooting.

Ah well, its all money towards the leccy bill