The TCP/IP stack in Windows XP with Service Pack 2 (SP2) installed limits the number of concurrent, incomplete outbound TCP connection attempts. When the limit is reached, subsequent connection attempts are put in a queue and resolved at a fixed rate so that there are only a limited number of connections in the incomplete state. During normal operation, when programs are connecting to available hosts at valid IP addresses, no limit is imposed on the number of connections in the incomplete state. When the number of incomplete connections exceeds the limit, for example, as a result of programs connecting to IP addresses that are not valid, connection-rate limitations are invoked, and this event is logged.
Establishing connectionrate limitations helps to limit the speed at which malicious programs, such as viruses and worms, spread to uninfected computers. Malicious programs often attempt to reach uninfected computers by opening simultaneous connections to random IP addresses. Most of these random addresses result in failed connections, so a burst of such activity on a computer is a signal that it may have been infected by a malicious program.
Connection-rate limitations may cause certain security tools, such as port scanners, to run more slowly.
_NetStat() Func _NetStat() Local $sRet $sRet = Run(@ComSpec & " /c Netstat -no", "", @SW_HIDE,2) While 1 $line = StdoutRead($sRet) If @error Then ExitLoop $Info = StringSplit($line,@CR) ;ConsoleWrite($line & @CR) For $i = 5 to $Info - 1 ConsoleWrite($Info[$i] & @CR) $Pid = StringRight($Info[$i],4) ;ConsoleWrite($Pid & @CR) $Process = $Pid ; = PID _ProcessInfo($Process) ;ConsoleWrite($Process & @CR) next ;ConsoleWrite($Info & @CR) Wend While 1 $line = StderrRead($sRet) If @error Then ExitLoop ConsoleWrite( "STDERR read: "& $line & @CR) Wend EndFunc Func _ProcessInfo($Process) Dim Const $wbemFlagReturnImmediately = 0x10 Dim Const $wbemFlagForwardOnly = 0x20 $oWMIService = ObjGet("winmgmts:" & @ComputerName & "rootCIMV2") If Not @error Then $oItems = $oWMIService.ExecQuery("SELECT * FROM Win32_Process where ProcessId = " & $Process, "WQL", $wbemFlagReturnImmediately + $wbemFlagForwardOnly) For $Item In $oItems ConsoleWrite(" Name: " & @tab & @tab& @tab& "ProcessId: " & @tab & @tab & "CommandLine: " & @tab & @LF) ConsoleWrite(" "& $Item.Name & @tab & @tab & @tab& $Item.ProcessId & @tab & @tab & @tab & $Item.CommandLine & @LF) Next EndIf EndFunc
Edited by ptrex, 14 September 2012 - 09:48 AM.