Event 4226

[ecanderson]

These warnings appear frequently in my Event Viewer logs for XP, and I am beginning to wonder if these are being caused by the Scannercast software in its attempts to communicate with the RR server.

"TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts."

Per Microsoft, regarding 4226 (and I'm on SP3, but assume this applies as well to that):

Explanation
The TCP/IP stack in Windows XP with Service Pack 2 (SP2) installed limits the number of concurrent, incomplete outbound TCP connection attempts. When the limit is reached, subsequent connection attempts are put in a queue and resolved at a fixed rate so that there are only a limited number of connections in the incomplete state. During normal operation, when programs are connecting to available hosts at valid IP addresses, no limit is imposed on the number of connections in the incomplete state. When the number of incomplete connections exceeds the limit, for example, as a result of programs connecting to IP addresses that are not valid, connection-rate limitations are invoked, and this event is logged.

 

[W2PMX]

It might be the software. The software should make only one outbound connection and keep it open, or it should close any open connection before it opens another one. If it's opening multiple connections without closing them you'd get that situation. (It's like a memory leak, but in this case you could call it a "connection leak".)

But the only way to know for sure is to have the source code for the program.

 

[ecanderson]

Guess I should ask it this way ...

Would others of you running Scannercast on an XP SP3 system please check your system logs and see if you are seeing Event 4226 warnings?

 

[webstar22]

Event 4226 is normal if you are running any P2P or Torrent applications. it is throttling your outbound connections and is normal for win xp sp3 to do this.

You can increase the # of outbound connections allowed using this little app. www.LvlLord.de - Tipps, Tricks & Utilities - Tools i've do so for years.

 

[ecanderson]

Band-Aid solution.

Not running any P2P or Torrent or whatever other various pirate apps - which is why I suspect that Scannercast is the culprit. There should be no requirement to increase the allowed number of concurrent connections if a streaming application behaves properly. As it is, the warning is being posted in the logs for a REASON.

So again, I'm asking if other Scannercast users (aka Audio Feed Providers) on XP are also seeing this in their system logs, or can confirm that they are not.

 

[webstar22]

You 100% sure you have no malware on your machine?

 

[ecanderson]

Sigh. Yes.

So again, I'm asking if other Scannercast users (aka Audio Feed Providers) on XP are also seeing this in their system logs, or can confirm that they are not.

 

[webstar22]

So again, if you don't want suggestions don't post. Feed software is a single connection to RR.com for pushing audio and if it pulls stats that should be a single incoming connection from http. If you are seeing 4226 then you have something else pushing more then 10 half connections outbound which is triggering the throttle. If it was the scanner software we would have heard about it already.

 

[ecanderson]

No, I don't want "suggestions" - I was quite clear about what I would find helpful. I want those who use the software (yourself not included based upon the subscriber status) to assist me from personal experience with the application by taking a quick look a their logs to see if they also note this anomaly. If it were something so obvious as some other net intensive application banging away on my NIC, I would not have begun to suspect this otherwise well behaved application in my search for an answer.

I fully agree that it should be a single open connection in each direction at most. There are a very limited number of applications loaded, much less running, on this particular 'streamer', and I need to try to eliminate the even smaller subset of those that have any business opening a TCP connection for any reason - hence my request.

Since I find that most users don't ever look at their system logs, or even know where one might find them, and since this problem produces only frequent warnings and not outright errors or crashes that would otherwise raise anyone's attention, I do not find it impossible that such an issue might have been overlooked in the past. I would have not noticed it myself apart from a need to inspect the logs for other reasons having to do with an errant driver.

 

[zl2taw]

Had a look at my logs, I dont have any error 4226 events,
btw I am running Win XP with SP3

 

[ecanderson]

Appreciate the report. Am also running XP/SP3 here. Version on my app shows V0.14 with what appears to be a build number of 10307. Does that match yours? If so, your reply will free me to pursue one more possibility and exclude this one.

 

[zl2taw]

yeah mine is the same, I guess what you could try is loading up radiofeed (easy to setup) and see if you get the same events

 

[zl2taw]

did you get it sorted out ?

 

[ecanderson]

Not yet. Need an opportune moment to pull down the feed and make the swap, although as you haven't been seeing the problem with an identical (from the ScannerCast perspective) setup, I expect that the problem will remain. We're down to ScannerCast and AVG at the moment, and I may switch this machine back to Avast.

 

[zl2taw]

I too also run Avast free on all my PC here, just wondering if you have done a scan with malwarebytes software ?

 

[ecanderson]

Per previous post, we can discount malware/virus issues. Yes (sigh again) as it happens, Malwarebytes is one of THREE DIFFERENT TOOLS used to scan for something that might be trying to work outbound mischief (which is the only direction relevant to the 4226). The are now and never have been any P2P / Torrent style applications on this system which would intentionally create a great many concurrent connection attempts. I think we can safely assume that we are not dealing with any of the more common causes for this problem guys.

Moreover, the frequency with which the 4226 error occurs is FAR less than is commonly reported for normal sources. I'm seeing single errors only about once a week. For a warning of this type, I'd call that 'frequent', but I don't want to mislead anyone into thinking this is occurring on a hourly basis or anything that radical. That's part of what is making this harder to spot. If I were really getting hammered with these, I'd just open up WireShark, start ripping packets apart, and see who's doing what.

 

[ecanderson]

I should mention that by the time I finally do spot one of these (can't just sit and stare at the log all day), the issue has resolved itself, so even a NETSTAT -NO doesn't offer any information (typically, you'd see the culprit process there due to an abundance of SYN_SENT status for some process or another).

 

[zl2taw]

throw radiofeed up, and see how you go
need a hand setting up PM me & see what I can do

 

[zl2taw]

did you ever sort this out ?