Doxpara Research: TCP Chorusing in the Windows 9x TCP/IP Stack

[ Thanks to Jay Fink
for this link. ]

“Microsoft Windows 95 and 98 clients have the capability to bind
multiple TCP/IP stacks to the same MAC address, simply by having
the protocol added more than once in the Network control panel.
This is actually quite useful, except for the fact that these
stacks can run concurrently on the same IP, even if they receive
their IP through BOOTP/DHCP. The effect of the bug is to cause the
number of ACKnowledgement packets sent to be equal to that of the
number of loaded and bound TCP/IP stacks, creating excessive and
significant network noise and collisions. At least one Samba
2.0.0beta1 server on an affected subnet can become completely
inaccessible when one of these machines start
misbehaving.“

“Redundant ACKing can be referred to as TCP Chorusing, due to
the minor time delays introduced between multiple copies of
identical data. The problem is undetectable using the Ping command
built into Windows 95 or 98–this is a significant bug in and of
itself. Linux´s ping is not similarly crippled. NT does not
detect TCP Chorusing with its Ping command.”

Complete
Story