Linux Today: Linux News On Internet Time.

Doxpara Research: TCP Chorusing in the Windows 9x TCP/IP Stack

Oct 21, 1999, 18:34 (5 Talkback[s])
(Other stories by Dan Kaminsky)

[ Thanks to Jay Fink for this link. ]

"Microsoft Windows 95 and 98 clients have the capability to bind multiple TCP/IP stacks to the same MAC address, simply by having the protocol added more than once in the Network control panel. This is actually quite useful, except for the fact that these stacks can run concurrently on the same IP, even if they receive their IP through BOOTP/DHCP. The effect of the bug is to cause the number of ACKnowledgement packets sent to be equal to that of the number of loaded and bound TCP/IP stacks, creating excessive and significant network noise and collisions. At least one Samba 2.0.0beta1 server on an affected subnet can become completely inaccessible when one of these machines start misbehaving."

"Redundant ACKing can be referred to as TCP Chorusing, due to the minor time delays introduced between multiple copies of identical data. The problem is undetectable using the Ping command built into Windows 95 or 98--this is a significant bug in and of itself. Linux´s ping is not similarly crippled. NT does not detect TCP Chorusing with its Ping command."

Complete Story