XP Pro Network 'pauses' for some applications

OK, this has been bugging me for some time and I am not sure it is probably within my system.

I have 2 questions basically....


1) How to RESTORE the NETWORK s/w to the installed SP 2 state without wiping out the rest of XP?

2) The problem itself and if anyone has suggestions.

What I have is mostly circumstantial in that I can not point to any problem specifically.

A) Program is FireFox, most of the latest versions show this problem.

Problem is that is seems to go to sleep, guaranteed the first time it is started on a boot, and sometimes at other times too, but very rarely.

What is seen is that I open many tabs, 15 to be exact. Some folders will partially populate, some complete, and some are empty, and the icons on the folders spin. Then, maybe a minute or two later all populate and I can use the browser as normal.

B) During this period of 'sleeping' a few things can happen :

- on completed tabs, clicking on any link will do NOTHING until
all tabs complete.
- Randomly and very rarely, if I look in the EVENT VIEWER I'll
see the TCP/IP Timeout warning. Once this ends, all tabs
complete, but again, this is a RARE occurance. No other
TCP/IP programs are usually running except for a POP3
e-mail checker.

C) I have a program that is a FireFox extension from PC Mag. that will 'preview' links. I used IE as its engine. During the time of the 'stall/pause/sleeping' I can hover my mouse over any link shown and it will bring up a thumbnail of the URL. This happens as it uses the IE engine which had no problem working.

D) During the above 'stall' IE operates properly as does all other Internet programs I've tried.

E) My wife's machine which is running XP Home mostly exhibited the same problems, but not as bad as mine. My system is an Intel Hyperthreaded 3.6 GHZ machine, and hers was an older Intel P4 1.6 GHZ machine. Considering the speed diferences and the fact she was opening 25 folders, I considered her machine working correctly. We do share the Inet connection via a router.

F) All logs and firewall settings do not show any problems.

G) Reset Router and changed IP address of my machine, no change.

So, I'm perplexed. FireFox forums show no one else with these specific problems and my reports were sort of rejected as 'my problem'.

We replaced my wife's machine with a new Intel Core 2 Duo 2.13 GHZ one. Now her 25 tabs open almost instantly, at least compared to what I see when mine is working after the first 'stall'.

All this makes me feel that the problem is on my machine. I've reset the WinSocket, no change. Tried to re-install some components, no change.

Any suggestions or tools I can use to see some problems?

Irv Spalten

 

Adhering to WC3 standards, there is a limit as to how many connections are permitted to a remote host.

You can change this in XP. Copy and Paste the section below, open Notepad and Paste the block of text into a new document window. Then File, Save as..., and enter the name: add_connections.reg

----------- begin copy/paste below this line
REGEDIT4
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"MaxConnectionsPerServer "=dword:00000010
"MaxConnectionsPer1_0Server "=dword:00000010

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
"MaxConnectionsPerServer "=dword:00000010
"MaxConnectionsPer1_0Server "=dword:00000010


----------- end copy/paste above this line.


When the notepad session is complete, double click the saved file fix_connections.reg and agree to the registry merge.

Reboot and test.

Any other issue is a Firefox one.

.

 

Didn't work...

Bill,

Thanks. I looked at the above and saw blanks in the lines so I was not sure ('Curre ntVersion' and 'Curre ntVersion', but it shows correctly above in composing but in preview the blanks show to, how odd?) it would work. I opened REGEDIT and looked at those keys. The first set were not there, but the 2nd was already there. Added the first and rebooted.

Not much changed, and I got the TCP/IP warning,

Event Type: Warning
Event Source: Tcpip
Event Category: None
Event ID: 4226
Date: 9/3/2006
Time: 8:53:02 AM
User: N/A
Computer: IRVS
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....‚..€
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........

Mind you, all I think that was open was FF trying to open the tabs. Once the period ended, FF still was spinning some tab icons. I'm using IE to enter this.

I've been in the FF forums and I've been basically told I'm crazy and it isn't FF that is causing the problem...

As for the limit, I searched the web and found a few posts that pointed to files that would make the limit larger, but they didn't work either.

Thanks anyway,
Irv

 

That sounds normal to me. I use Firefoxs and open a dozen of so sites at once via the bookmark "Open in Tabs" option. It takes a lot longer than for a single page, for them all to get loaded especailly if Firefox is having trouble loading a particular page. If you open ten pages in tabs, you're asking Firefox to do ten times the work it normally does and it has to send out requests and receive data for ten times more sites. It's going to be relatively slow.

 

Reggie,

I thought that too. I tired cutting the tabs in half, didn't appreciably improve time. Tried SAFE MODE, no difference. Tried to isolate the problematic tabs, couldn't seem to find any combination that worked. Dropped out all extensions, no improvement.

What makes me think it 'could' be my machine was no one else complaining about FF doing the same and the fact that my wife with a new Intel Core 2 Duo can open almost 50% more tabs without seeing the same effects I am?

When it does 'stall', I can open IE and open all the stalled URL's though? This would indicate it isn't the URL's causing this. Only other reasons I can think of are a FF problem or a Windows TCP/IP problem. I'd imagine if it were FF others would see it. I'm thinking along the lines of FF either getting an error reply back and timing out after a retry or some other situation where it 'lost' a TCP/IP packet and was waiting for it and then gives up. Same would be for Windows.

Just want to rule out Windows being the culprit here.

I did post my TABS that I was opening when starting FF and those that did try it did have about the same problem and they claimed it was because no one should be opening that many tabs. I've never seen restrictions on how many to open at one time though? Also, the non-completing URL's vary each time I start FF.

I guess I can give up trying to solve this as well and wait until I get a faster processor too?

Thanks,
Irv

 

The line break is some sort of site software bug; I have seen it on several php-based sites.

I can assure you I did not type it, and I believe it resolves correctly. If not remove the space in notepad.

As for the limit on maximum TCP/IP sessions per limit, see: http://www.speedguide.net/read_articles.php?id=1497

.

 

Bill,

It was still there (the blank) when I cut and pasted it into notepad. No problem though.

As for the TCP/IP link, I used that patch before with no perceived improvement. Top it off, I still got the 4226 warning, so either the patch was ineffective or something more insideous is causing that (I swept the system for virii, bugs, adware, etc., and found nothing). I'm not going to worry about that at all.

Irv

 

You're right. I wouldn't expect to be able to open IE and all the sites in a tab list before Firefox had finished.

However, the fact that IE doesn't seem to have a problem points to a Firefox problem. If this was a TCP/IP problem, it should affect IE the same way. What version of Firefox are you running?

 

Reggie,

Well, I am running the latest Firefox that is not beta, 1.5.0.6. IE is the lastest too non-beta, 6.0.2900.

They are not a one to one comparison. IE opens a single URL while I'm opening many on FF. I seem to feel it is FF but other can't reproduce this and my wife opening more has no problem, so it sort of points back to my machine. I have 4 systems here, 2 significantly slower so any results are not meaningful (it they did fully populate sooner that is, which they don't) and a slightly faster one which is my wifes. If it isn't in FF that it must be TCP/IP and how it handles the significantly more packets that FF would create a need for.

Normally TCP/IP would just give the packet to the app and not know what is what, the app handles the destination and handling of packets. If either detected and error or didn't know how to handle the packet I would not be surprised of a hang condition until a timeout occured and one gave up. If it were in FF I might expect to see a fragmented display or missing data depending on what was on a lost packet. I have not seen any that I can say for sure are 'broke'. Since IE works it might be that it can get TCP/IP to send it packets while FF can't get any, but the problem could also be in FF. Now if FF was hung, you'd expect packets to get lost as well as TCP/IP seems to be working while FF is hung. Hence, I suspect it is TCP/IP that isn't sending packets to FF, nor is it listening to FF. If it were, then clicking on a link while FF is 'hung' would work as a new request would be handled, but it isn't, so again, either FF is 'stalled' or TCP/IP isn't listening to it?

I tried a Packet Sniffer that wrote all packets to disk, but it was way too huge to even try to figure out. Just was hoping someone could direct me to either an external tool or which XP built-in tool, like NETSTAT for instance, that would show me the traffic at the time it was happening.

Irv

 

In order to generate a 4226 message you have to be opening new connections at a rate that exceeds 10 connections per second. Think about it. That is one heck of a lot of new connections. I know P2P programs that will do this, but not browsers.

In any case, you had two lingering questions:

1. A real-time Netsat type command. Yes, use the freeware from Sysinternals/Microsoft called TCP View: http://www.sysinternals.com/Utilities/TcpView.html

2. How to do a re-install of TCP/IP:

1. Click Start, and then click Run.
2. In the Open box, type Regedit, and then press ENTER.
3. Navigate to the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
4. On the Registry menu, click Export Registry File.
5. In the File name box, type the name of the backup file; for example, type Winsock Registry key, and then click Save. Note the name of the folder in which the registration file is saved.
6. Repeat steps 3 through 5 for the following registry key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2
7. Delete the following keys from the registry:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Winsock2

NOTE: Steps 3 through 6 backed up the two registry keys. You can use the backup files to restore the keys in the event that your computer displays unexpected behavior. For more information about how to restore registry keys from .reg files, search the Registry Editor Help files for the Import or export registry keys topic.

8. Close the Registry Editor.
9. Locate the Nettcpip.inf file in %winroot%\inf, and then open the file in Notepad.
10. Locate the [MS_TCPIP.PrimaryInstall] section. Change the Characteristics = 0xa0 entry by replacing 0xa0 with 0x80. Save the file. Exit Notepad.
11. In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
12. On the General tab, click Install, select Protocol, and then click Add.
13. In the Select Network Protocols window, click Have Disk.
14. In the Copy manufacturer's files from text box, type c:\windows\inf, and then click OK.
15. Select Internet Protocol (TCP/IP), and then click OK.

Note This step returns you to the Local Area Connection Properties screen. However, the Uninstall button is now available.

16. Select Internet Protocol (TCP/IP), click Uninstall, and then click Yes.
17. In Control Panel, double-click Network Connections, right-click Local Area Connection, and then select Properties.
18. On the General tab, click Install, select Protocol, and then click Add.
19. In the Select Network Protocols window, click Have Disk.
20. In the Copy Manufacturer's files from text box, type c:\windows\inf, and then click OK.
21. Select Internet Protocol (TCP/IP), and then click OK.
22. Restart your computer.
23. Test your Internet connectivity.

.

 

Bill,

I was really surprised how many FF entries there were? Still, these were not connections I assume as if they were they would have triggered a 4226 message which they didn't.

I thought 10 was the magic number, not 20?

This caused me some real problems... as indicated below and the differences I saw.

The protocol displays and not Digitally signed but assumed it was OK anyway.

After this completed I was asked to re-boot, which I did...

Upon re-boot I got the BSOD, IRQ_NOT_LESS_OR_EQUAL which is usually a h/w error. I was able to boot into Safe Mode w/Network however. Followed the next set under safe mode.

Problem at this point, got an error that an 'extended error has occured' but no additional information... Still could not boot into real mode without the blue screen. Quandry here, so I decided to put the REG files back under safe mode. Still got the BSOD...

OK, have a Norton backup and restored from that after saving a few needed new files. I'm back to where I was.

Did I have a problem due to something in the system wrong?

Irv

 

"I thought 10 was the magic number, not 20? "

My apologies. 10 connections per second is correct.

Which explains your Tcp View results -- those are TCP/IP sessions of which the limit I suppose is quite high -- over 65,000 ports, with 8 or more connection types possible.

The default limits:

. 10 connections per second
. only three connections to a single host

For your TCP/IP issues, I agree the instructions are a little difficult to follow. I am a little concerned about your results though.

The instructions were from notes I had made, which are reflected in this recent revision of the first of the famous two Winsock Corruption MS KB articles: http://support.microsoft.com/default.aspx?scid=kb;en-us;318584

The other article has a different approach, which you should try: http://support.microsoft.com/?kbid=811259

Both of these approaches are more comprehensive than this approach, which does have its merits I must insist: netsh in ip reset resetlog.txt

Please let use know the results of the Article 2 approach to restoring TCP/IP under XP.

.

 

Bill,

I had been there before to this article I think?

Anyway, following it, I got into immediate trouble.

--------
Method 2: Use the Msinfo32 program
Note Use this method only if you do not have a Windows XP Setup CD and you do not have Support Tools installed. 1. Click Start, click Run, type Msinfo32, and then click OK.
2. Expand Components, expand Network, and then click Protocol.
--------

This is a Dell XPS and maybe Dell replaced something, but I didn't see COMPONENTS anywhere. So I went back to Method 1 and installed the support tools.

Ran Method 1 and routed the output to a file to read it throughly. Used it both with the /test:winsock and without it. Added the /v to see all details too. Did not see any fails or problems?

I recall when I got to this URL before I ran "%windir%\network diagnostic\xpnetdiag.exe" and it didn't find any problems (still have the HTML file), but not sure how I was instructed to do this?

Also, I did follow these directions from the URL at that time...

=========
Manual steps to recover from Winsock2 corruption
Windows XP with Service Pack 2 instructions
To repair Winsock if you have Windows XP Service Pack 2 (SP2) installed, type netsh winsock reset at the command prompt, and then press ENTER.
==========

and didn't see any changes in operation.

I followed the URL to the new stuff in XP and an expanded NETSH command to show the catalog (which appears to be what the MSINFO32 would have shown). Running "netsh winsock show catalog" shows only a few DLL's involved,

C:\WINDOWS\system32\VetRedir.dll which is part of CA's (Computer Associates) firewall
%SystemRoot%\system32\mswsock.dll standard file
%SystemRoot%\system32\rsvpsp.dll standdard file

I guess I could also go into the registry and track those keys, but to me, there doesn't seem to be a problem?

Yes, in case you ask, I did shutdown all the CA security programs and run FF, no difference.

Either it is something else in this machine or I think TCP/IP reports correctly back that it is OK. Still, there could be a s/w bug in it.

Do you run FF? If so, I'll post my start tabs for you to try.

Oh, I did try the 'guided tour' and it couldn't find the right help either?

Irv

 

I'm sorry I have never run Fire Fox.

 

OK, not a problem.

I *did* figure out how come I get HELP AND SUPPORT up. Seems a 'cleaner' I probably ran at some time cleaned out my INDEX.DAT from C:\WINDOWS\PCHEALTH\HELPCTR\OfflineCache. I tried my wifes machine which is 3 weeks old, and ran MSINFO32 and it came up as expected. Searched the web and found the info on CCLEANER.

Copied over my wife's Media Center INDEX.DAT and it worked OK, but it could be different from XP PRO's. Mine was only 68 bytes! Her's was 92K, and a copy of mine from the initial ship from Dell was 88K. Putting back either her's or my initial one made it work correctly....

 

Update your CCleaner. It no longer deletes necessary index.dat files.

.

 

Bill,

Understood, but I no longer use it. I did in the past I know.