port lockouts

is there any kind of security or other mechanism that would cause a port to
be locked out if a connection isn't accepted quickly enough by the program
that is listening on it?? Say a server program opens a port to listen for
clients to connect, but then when a client connects it doesn't accept that
connection for a long time, say up to 30 seconds or so. maybe other clients
also connect and are then waiting in the port backlog at the same time??

I remember reading the ipsec troubleshooting chapter in the Domain Isolation
Guide in which something similar can happen in certain situations if ipsec
is being used to protect traffic on the server via ESP/AH. You can read more
below if you are using ipsec on the server. If you are not using ipsec I
don't know offhand what the problem would be and it would be helpful to
determine if the problem is related to only a particular server service and
then try to find information about that service from the publisher
documentation and it may also be helpful to check the logs via Event Viewer
to see if anything pertinent is recorded, maybe use netmon or Ethereal to
capture the packet exchange sequence, use Port Reporter to record port usage
on the server, and verify that there are no conflicts on what service is
using a port with tools like TCPView and Process Explorer from
ysInternals. --- Steve

http://www.microsoft.com/technet/sec.../ipsecch7.mspx
--- troubleshooting ipsec
http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
http://www.microsoft.com/downloads/d...displaylang=en
--- Port Reporter

"Dave" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> is there any kind of security or other mechanism that would cause a port
> to be locked out if a connection isn't accepted quickly enough by the
> program that is listening on it?? Say a server program opens a port to
> listen for clients to connect, but then when a client connects it doesn't
> accept that connection for a long time, say up to 30 seconds or so. maybe
> other clients also connect and are then waiting in the port backlog at the
> same time??
>
>

this is a telnet server app used as a chat type of system, no ipsec, just
simple telnet streams. it does have some features that use an access
database which can be slow responding, so new incoming connections aren't
always serviced instantly. we used to have problems with win2k-pro with the
5 connection backlog limit on that system's crippled ip stack, but have
upgraded to 2k3 server now and still occasionally see the port lockup. some
experimenting points to the possibility of a timeout instead of a backlog
hanging up the port, but i'm not sure where to start looking for that. i
have played with trying to turn off the syn attack protection, but that
doesn't seem to have helped.

"Steven L Umbach" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>I remember reading the ipsec troubleshooting chapter in the Domain
>Isolation Guide in which something similar can happen in certain situations
>if ipsec is being used to protect traffic on the server via ESP/AH. You can
>read more below if you are using ipsec on the server. If you are not using
>ipsec I don't know offhand what the problem would be and it would be
>helpful to determine if the problem is related to only a particular server
>service and then try to find information about that service from the
>publisher documentation and it may also be helpful to check the logs via
>Event Viewer to see if anything pertinent is recorded, maybe use netmon or
>Ethereal to capture the packet exchange sequence, use Port Reporter to
>record port usage on the server, and verify that there are no conflicts on
>what service is using a port with tools like TCPView and Process Explorer
>from ysInternals. --- Steve
>
> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
> --- troubleshooting ipsec
> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
> http://www.microsoft.com/downloads/d...displaylang=en
> --- Port Reporter
>
> "Dave" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> is there any kind of security or other mechanism that would cause a port
>> to be locked out if a connection isn't accepted quickly enough by the
>> program that is listening on it?? Say a server program opens a port to
>> listen for clients to connect, but then when a client connects it doesn't
>> accept that connection for a long time, say up to 30 seconds or so.
>> maybe other clients also connect and are then waiting in the port backlog
>> at the same time??
>>
>>
>
>

I was going to suggest looking into the anti-DoS behaviors, but
you appear to have already started down that road (syn attack
protection).

"Dave" <(E-Mail Removed)> wrote in message
news:0fydnXUpNtozvI7ZRVn-(E-Mail Removed)...
> this is a telnet server app used as a chat type of system, no ipsec, just
> simple telnet streams. it does have some features that use an access
> database which can be slow responding, so new incoming connections aren't
> always serviced instantly. we used to have problems with win2k-pro with
> the 5 connection backlog limit on that system's crippled ip stack, but
> have upgraded to 2k3 server now and still occasionally see the port
> lockup. some experimenting points to the possibility of a timeout instead
> of a backlog hanging up the port, but i'm not sure where to start looking
> for that. i have played with trying to turn off the syn attack
> protection, but that doesn't seem to have helped.
>
> "Steven L Umbach" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>>I remember reading the ipsec troubleshooting chapter in the Domain
>>Isolation Guide in which something similar can happen in certain
>>situations if ipsec is being used to protect traffic on the server via
>>ESP/AH. You can read more below if you are using ipsec on the server. If
>>you are not using ipsec I don't know offhand what the problem would be and
>>it would be helpful to determine if the problem is related to only a
>>particular server service and then try to find information about that
>>service from the publisher documentation and it may also be helpful to
>>check the logs via Event Viewer to see if anything pertinent is recorded,
>>maybe use netmon or Ethereal to capture the packet exchange sequence, use
>>Port Reporter to record port usage on the server, and verify that there
>>are no conflicts on what service is using a port with tools like TCPView
>>and Process Explorer from ysInternals. --- Steve
>>
>> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
>> --- troubleshooting ipsec
>> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
>> http://www.microsoft.com/downloads/d...displaylang=en
>> --- Port Reporter
>>
>> "Dave" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> is there any kind of security or other mechanism that would cause a port
>>> to be locked out if a connection isn't accepted quickly enough by the
>>> program that is listening on it?? Say a server program opens a port to
>>> listen for clients to connect, but then when a client connects it
>>> doesn't accept that connection for a long time, say up to 30 seconds or
>>> so. maybe other clients also connect and are then waiting in the port
>>> backlog at the same time??
>>>
>>>
>>
>>
>
>

Offhand I don't know exactly what to tweak but if you have not seen the link
below it may help in tweaking the registry though I would be sure to backup
the registry and System State of the server first. I would also try to
contact the publisher for advice. --- Steve

http://technet2.microsoft.com/Window...a87c81033.mspx


"Dave" <(E-Mail Removed)> wrote in message
news:0fydnXUpNtozvI7ZRVn-(E-Mail Removed)...
> this is a telnet server app used as a chat type of system, no ipsec, just
> simple telnet streams. it does have some features that use an access
> database which can be slow responding, so new incoming connections aren't
> always serviced instantly. we used to have problems with win2k-pro with
> the 5 connection backlog limit on that system's crippled ip stack, but
> have upgraded to 2k3 server now and still occasionally see the port
> lockup. some experimenting points to the possibility of a timeout instead
> of a backlog hanging up the port, but i'm not sure where to start looking
> for that. i have played with trying to turn off the syn attack
> protection, but that doesn't seem to have helped.
>
> "Steven L Umbach" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>>I remember reading the ipsec troubleshooting chapter in the Domain
>>Isolation Guide in which something similar can happen in certain
>>situations if ipsec is being used to protect traffic on the server via
>>ESP/AH. You can read more below if you are using ipsec on the server. If
>>you are not using ipsec I don't know offhand what the problem would be and
>>it would be helpful to determine if the problem is related to only a
>>particular server service and then try to find information about that
>>service from the publisher documentation and it may also be helpful to
>>check the logs via Event Viewer to see if anything pertinent is recorded,
>>maybe use netmon or Ethereal to capture the packet exchange sequence, use
>>Port Reporter to record port usage on the server, and verify that there
>>are no conflicts on what service is using a port with tools like TCPView
>>and Process Explorer from ysInternals. --- Steve
>>
>> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
>> --- troubleshooting ipsec
>> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
>> http://www.microsoft.com/downloads/d...displaylang=en
>> --- Port Reporter
>>
>> "Dave" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>> is there any kind of security or other mechanism that would cause a port
>>> to be locked out if a connection isn't accepted quickly enough by the
>>> program that is listening on it?? Say a server program opens a port to
>>> listen for clients to connect, but then when a client connects it
>>> doesn't accept that connection for a long time, say up to 30 seconds or
>>> so. maybe other clients also connect and are then waiting in the port
>>> backlog at the same time??
>>>
>>>
>>
>>
>
>

that article is where i got the info on the syn attack protection. and i am
in regular contact with the publisher and other users of this software who
are also looking for fixes. one user has gone as far as writing a telnet
proxy that quickly accepts connections and then puts them on hold to pass
them to the server at a controlled rate, this helps but that software will
also occasionally lock up from this other mechanism.

"Steven L Umbach" <(E-Mail Removed)> wrote in message
news:%(E-Mail Removed)...
> Offhand I don't know exactly what to tweak but if you have not seen the
> link below it may help in tweaking the registry though I would be sure to
> backup the registry and System State of the server first. I would also try
> to contact the publisher for advice. --- Steve
>
> http://technet2.microsoft.com/Window...a87c81033.mspx
>
>
> "Dave" <(E-Mail Removed)> wrote in message
> news:0fydnXUpNtozvI7ZRVn-(E-Mail Removed)...
>> this is a telnet server app used as a chat type of system, no ipsec, just
>> simple telnet streams. it does have some features that use an access
>> database which can be slow responding, so new incoming connections aren't
>> always serviced instantly. we used to have problems with win2k-pro with
>> the 5 connection backlog limit on that system's crippled ip stack, but
>> have upgraded to 2k3 server now and still occasionally see the port
>> lockup. some experimenting points to the possibility of a timeout
>> instead of a backlog hanging up the port, but i'm not sure where to start
>> looking for that. i have played with trying to turn off the syn attack
>> protection, but that doesn't seem to have helped.
>>
>> "Steven L Umbach" <(E-Mail Removed)> wrote in message
>> news:(E-Mail Removed)...
>>>I remember reading the ipsec troubleshooting chapter in the Domain
>>>Isolation Guide in which something similar can happen in certain
>>>situations if ipsec is being used to protect traffic on the server via
>>>ESP/AH. You can read more below if you are using ipsec on the server. If
>>>you are not using ipsec I don't know offhand what the problem would be
>>>and it would be helpful to determine if the problem is related to only a
>>>particular server service and then try to find information about that
>>>service from the publisher documentation and it may also be helpful to
>>>check the logs via Event Viewer to see if anything pertinent is recorded,
>>>maybe use netmon or Ethereal to capture the packet exchange sequence, use
>>>Port Reporter to record port usage on the server, and verify that there
>>>are no conflicts on what service is using a port with tools like TCPView
>>>and Process Explorer from ysInternals. --- Steve
>>>
>>> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
>>> --- troubleshooting ipsec
>>> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
>>> http://www.microsoft.com/downloads/d...displaylang=en
>>> --- Port Reporter
>>>
>>> "Dave" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>> is there any kind of security or other mechanism that would cause a
>>>> port to be locked out if a connection isn't accepted quickly enough by
>>>> the program that is listening on it?? Say a server program opens a
>>>> port to listen for clients to connect, but then when a client connects
>>>> it doesn't accept that connection for a long time, say up to 30 seconds
>>>> or so. maybe other clients also connect and are then waiting in the
>>>> port backlog at the same time??
>>>>
>>>>
>>>
>>>
>>
>>
>
>

So I assume you have tweaked about with the dynamic backlog settings.
Have you seen
http://support.microsoft.com/kb/196271/en-us


"Dave" <(E-Mail Removed)> wrote in message
news:VIidnbXmkpJ7w4nZRVn-(E-Mail Removed)...
> that article is where i got the info on the syn attack protection. and i
> am in regular contact with the publisher and other users of this software
> who are also looking for fixes. one user has gone as far as writing a
> telnet proxy that quickly accepts connections and then puts them on hold
> to pass them to the server at a controlled rate, this helps but that
> software will also occasionally lock up from this other mechanism.
>
> "Steven L Umbach" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> Offhand I don't know exactly what to tweak but if you have not seen the
>> link below it may help in tweaking the registry though I would be sure to
>> backup the registry and System State of the server first. I would also
>> try to contact the publisher for advice. --- Steve
>>
>> http://technet2.microsoft.com/Window...a87c81033.mspx
>>
>>
>> "Dave" <(E-Mail Removed)> wrote in message
>> news:0fydnXUpNtozvI7ZRVn-(E-Mail Removed)...
>>> this is a telnet server app used as a chat type of system, no ipsec,
>>> just simple telnet streams. it does have some features that use an
>>> access database which can be slow responding, so new incoming
>>> connections aren't always serviced instantly. we used to have problems
>>> with win2k-pro with the 5 connection backlog limit on that system's
>>> crippled ip stack, but have upgraded to 2k3 server now and still
>>> occasionally see the port lockup. some experimenting points to the
>>> possibility of a timeout instead of a backlog hanging up the port, but
>>> i'm not sure where to start looking for that. i have played with trying
>>> to turn off the syn attack protection, but that doesn't seem to have
>>> helped.
>>>
>>> "Steven L Umbach" <(E-Mail Removed)> wrote in message
>>> news:(E-Mail Removed)...
>>>>I remember reading the ipsec troubleshooting chapter in the Domain
>>>>Isolation Guide in which something similar can happen in certain
>>>>situations if ipsec is being used to protect traffic on the server via
>>>>ESP/AH. You can read more below if you are using ipsec on the server. If
>>>>you are not using ipsec I don't know offhand what the problem would be
>>>>and it would be helpful to determine if the problem is related to only a
>>>>particular server service and then try to find information about that
>>>>service from the publisher documentation and it may also be helpful to
>>>>check the logs via Event Viewer to see if anything pertinent is
>>>>recorded, maybe use netmon or Ethereal to capture the packet exchange
>>>>sequence, use Port Reporter to record port usage on the server, and
>>>>verify that there are no conflicts on what service is using a port with
>>>>tools like TCPView and Process Explorer from ysInternals. --- Steve
>>>>
>>>> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
>>>> --- troubleshooting ipsec
>>>> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>> --- Port Reporter
>>>>
>>>> "Dave" <(E-Mail Removed)> wrote in message
>>>> news:(E-Mail Removed)...
>>>>> is there any kind of security or other mechanism that would cause a
>>>>> port to be locked out if a connection isn't accepted quickly enough by
>>>>> the program that is listening on it?? Say a server program opens a
>>>>> port to listen for clients to connect, but then when a client connects
>>>>> it doesn't accept that connection for a long time, say up to 30
>>>>> seconds or so. maybe other clients also connect and are then waiting
>>>>> in the port backlog at the same time??
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>

that article is about something that would seem unrelated? is that the
wrong article or the wrong type of setting? i don't know the term 'dynamic
backlog', and ms technet search comes up blank also.

"Roger Abell [MVP]" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> So I assume you have tweaked about with the dynamic backlog settings.
> Have you seen
> http://support.microsoft.com/kb/196271/en-us
>
>
> "Dave" <(E-Mail Removed)> wrote in message
> news:VIidnbXmkpJ7w4nZRVn-(E-Mail Removed)...
>> that article is where i got the info on the syn attack protection. and i
>> am in regular contact with the publisher and other users of this software
>> who are also looking for fixes. one user has gone as far as writing a
>> telnet proxy that quickly accepts connections and then puts them on hold
>> to pass them to the server at a controlled rate, this helps but that
>> software will also occasionally lock up from this other mechanism.
>>
>> "Steven L Umbach" <(E-Mail Removed)> wrote in message
>> news:%(E-Mail Removed)...
>>> Offhand I don't know exactly what to tweak but if you have not seen the
>>> link below it may help in tweaking the registry though I would be sure
>>> to backup the registry and System State of the server first. I would
>>> also try to contact the publisher for advice. --- Steve
>>>
>>> http://technet2.microsoft.com/Window...a87c81033.mspx
>>>
>>>
>>> "Dave" <(E-Mail Removed)> wrote in message
>>> news:0fydnXUpNtozvI7ZRVn-(E-Mail Removed)...
>>>> this is a telnet server app used as a chat type of system, no ipsec,
>>>> just simple telnet streams. it does have some features that use an
>>>> access database which can be slow responding, so new incoming
>>>> connections aren't always serviced instantly. we used to have problems
>>>> with win2k-pro with the 5 connection backlog limit on that system's
>>>> crippled ip stack, but have upgraded to 2k3 server now and still
>>>> occasionally see the port lockup. some experimenting points to the
>>>> possibility of a timeout instead of a backlog hanging up the port, but
>>>> i'm not sure where to start looking for that. i have played with
>>>> trying to turn off the syn attack protection, but that doesn't seem to
>>>> have helped.
>>>>
>>>> "Steven L Umbach" <(E-Mail Removed)> wrote in message
>>>> news:(E-Mail Removed)...
>>>>>I remember reading the ipsec troubleshooting chapter in the Domain
>>>>>Isolation Guide in which something similar can happen in certain
>>>>>situations if ipsec is being used to protect traffic on the server via
>>>>>ESP/AH. You can read more below if you are using ipsec on the server.
>>>>>If you are not using ipsec I don't know offhand what the problem would
>>>>>be and it would be helpful to determine if the problem is related to
>>>>>only a particular server service and then try to find information
>>>>>about that service from the publisher documentation and it may also be
>>>>>helpful to check the logs via Event Viewer to see if anything pertinent
>>>>>is recorded, maybe use netmon or Ethereal to capture the packet
>>>>>exchange sequence, use Port Reporter to record port usage on the
>>>>>server, and verify that there are no conflicts on what service is using
>>>>>a port with tools like TCPView and Process Explorer from
>>>>>sInternals. --- Steve
>>>>>
>>>>> http://www.microsoft.com/technet/sec.../ipsecch7.mspx
>>>>> --- troubleshooting ipsec
>>>>> http://www.sysinternals.com/Utilities/TcpView.html --- TCPView
>>>>> http://www.microsoft.com/downloads/d...displaylang=en
>>>>> --- Port Reporter
>>>>>
>>>>> "Dave" <(E-Mail Removed)> wrote in message
>>>>> news:(E-Mail Removed)...
>>>>>> is there any kind of security or other mechanism that would cause a
>>>>>> port to be locked out if a connection isn't accepted quickly enough
>>>>>> by the program that is listening on it?? Say a server program opens
>>>>>> a port to listen for clients to connect, but then when a client
>>>>>> connects it doesn't accept that connection for a long time, say up to
>>>>>> 30 seconds or so. maybe other clients also connect and are then
>>>>>> waiting in the port backlog at the same time??
>>>>>>
>>>>>>
>>>>>
>>>>>
>>>>
>>>>
>>>
>>>
>>
>>
>
>

The port isn't what you should be looking at. The Appllication that uses
the port is supposed to do that. Ports are at the mercy of,... and only
exist in response to,...the Application that uses them.

--
Phillip Windell [MCP, MVP, CCNA]
www.wandtv.com
-----------------------------------------------------
Understanding the ISA 2004 Access Rule Processing
http://www.isaserver.org/articles/IS...cessRules.html

Troubleshooting Client Authentication on Access Rules in ISA Server 2004
http://download.microsoft.com/downlo...7/ts_rules.doc

Microsoft Internet Security & Acceleration Server: Guidance
http://www.microsoft.com/isaserver/t...dance/2004.asp
http://www.microsoft.com/isaserver/t...dance/2000.asp

Microsoft Internet Security & Acceleration Server: Partners
http://www.microsoft.com/isaserver/partners/default.asp

Deployment Guidelines for ISA Server 2004 Enterprise Edition
http://www.microsoft.com/technet/pro...isaserver.mspx
-----------------------------------------------------



"Dave" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
> is there any kind of security or other mechanism that would cause a port
to
> be locked out if a connection isn't accepted quickly enough by the program
> that is listening on it?? Say a server program opens a port to listen for
> clients to connect, but then when a client connects it doesn't accept that
> connection for a long time, say up to 30 seconds or so. maybe other
clients
> also connect and are then waiting in the port backlog at the same time??
>
>

So then how does that advise translate into solving a
problem with the MS provided Telnet dropping inbound ?

"Phillip Windell" <@.> wrote in message
news:%23qLXs%(E-Mail Removed)...
> The port isn't what you should be looking at. The Appllication that uses
> the port is supposed to do that. Ports are at the mercy of,... and only
> exist in response to,...the Application that uses them.
>
> --
> Phillip Windell [MCP, MVP, CCNA]
> www.wandtv.com
> -----------------------------------------------------
> Understanding the ISA 2004 Access Rule Processing
> http://www.isaserver.org/articles/IS...cessRules.html
>
> Troubleshooting Client Authentication on Access Rules in ISA Server 2004
> http://download.microsoft.com/downlo...7/ts_rules.doc
>
> Microsoft Internet Security & Acceleration Server: Guidance
> http://www.microsoft.com/isaserver/t...dance/2004.asp
> http://www.microsoft.com/isaserver/t...dance/2000.asp
>
> Microsoft Internet Security & Acceleration Server: Partners
> http://www.microsoft.com/isaserver/partners/default.asp
>
> Deployment Guidelines for ISA Server 2004 Enterprise Edition
> http://www.microsoft.com/technet/pro...isaserver.mspx
> -----------------------------------------------------
>
>
>
> "Dave" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> is there any kind of security or other mechanism that would cause a port
> to
>> be locked out if a connection isn't accepted quickly enough by the
>> program
>> that is listening on it?? Say a server program opens a port to listen
>> for
>> clients to connect, but then when a client connects it doesn't accept
>> that
>> connection for a long time, say up to 30 seconds or so. maybe other
> clients
>> also connect and are then waiting in the port backlog at the same time??
>>
>>
>
>