grinthock.com – A World Of Opinionation

Event ID 4226, Delayed Write Failures and uTorrent?

Posted on July 30th, 2008 by grinthock.
Categories: Department of WTF, Software.

If you are like me you probably use uTorrent or Azereus alot to download the latest creative commons works and linux distros.

Recently I have been experiencing an error on the machine I use for uTorrent.  I dedicate one of my machines for this, because I just don’t like it running on a production machine.  The storage in that machine is minimal, so all of  the actual data is stored off on our NAS box.

Occasionally i’ve had this problem, but in the last 2 days, it simply will not stop.   The uTorrent machine loses its connection with the NAS, as a result we get this error that i’m sure many people have seen before.

At the same time uTorrent decides, well, I cannot write, puts all the torrents into an “ERROR” state and just sits there forever.   If you simply re-start the torrent file, it will run again, for awhile, until we get another delayed write failure.

Having seen this error occasionally, but now more frequently, I decided it was time to look into this BS.    Having visited the event log I found a bunch of errors…

I did find the delayed write error like this….

Event Type:    Warning
Event Source:    MRxSmb
Event Category:    None
Event ID:    50
Date:        7/29/2008
Time:        6:10:07 PM
User:        N/A
Computer:    torrentbox
Description:
{Delayed Write Failed} Windows was unable to save all the data for the file \Device\LanmanRedirector. The data has been lost. This error may be caused by a failure of your computer hardware or network connection. Please try to save this file elsewhere.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 04 00 04 00 02 00 56 00   ……V.
0008: 00 00 00 00 32 00 04 80   ….2..?
0010: 00 00 00 00 0c 02 00 c0   …….À
0018: 00 00 00 00 00 00 00 00   ……..
0020: 00 00 00 00 00 00 00 00   ……..
0028: 0c 02 00 c0               …À

But I also found this error IMMEDIATELY before the delayed write failure messages.

Event Type:    Warning
Event Source:    Tcpip
Event Category:    None
Event ID:    4226
Date:        7/29/2008
Time:        6:01:48 PM
User:        N/A
Computer:    torrentbox

Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00   ……T.
0008: 00 00 00 00 82 10 00 80   ….?..?
0010: 01 00 00 00 00 00 00 00   ……..
0018: 00 00 00 00 00 00 00 00   ……..
0020: 00 00 00 00 00 00 00 00   ……..

I’m sorry, did I read this right?  Microsoft is imposing a connection limit?   So upon doing some research here’s what I found.  Microsoft limits the number of concurrent TCP Connection attempts to 10 as of Windows XP SP2, this is a “security” feature to stop worms from spreading like wildfire.  Personally, I think it’s a good idea, we need software to help all the stupid helpeless users out there who don’t know better, but we need to KNOW These things!

Luckily as I searched I was also able to find this website LVLLord’s Event 4226 Patcher  this guy wrote a tool that can patch the TCPIP.SYS file to change the limit.  The old limit was 65535, but I changed mine to 250.  This had immediate performance effects, my Torrent’s started up faster, connections were quicker, it allowed the entire machine to work cleaner.

While I understand the requirement to limit, 10 limits power users who run applications that open A LOT of TCP/IP connections, like network scan tools, network administration tools, all sorts of software would be limited by this.  Just a warning for you, once you patch it, keep your eye on it, Microsoft likes to update the TCPIP.SYS file fairly often, so obviously when there’s an update, your change will go away.

0 comments.