DOCUMENT:Q177539

TITLE   :Windows 95 Stops Responding Because of Land Attack

PRODUCT :Microsoft Windows 95

PROD/VER:95

OPER/SYS:WINDOWS

KEYWORDS:kbbug kbenv kbpatch 



---------------------------------------------------------------------

The information in this article applies to:



 - Microsoft Windows 95

 - Microsoft Windows 95 OEM Service Release versions 1, 2, 2.1

---------------------------------------------------------------------



SYMPTOMS

========



After receiving spoofed connection request (SYN) packets over TCP/IP, a

computer running Windows 95 may begin to operate slowly. After about one

minute, Windows returns to normal operation.



This problem may occur with TCP/IP on other operating systems as well.



CAUSE

=====



This behavior occurs due to "Land Attack." Land Attack sends SYN packets

with the same source and destination IP addresses and the same source and

destination ports to a host computer. This makes it appear as if the host

computer sent the packets to itself. Windows 95 operates more slowly while

the host computer tries to respond to itself.



RESOLUTION

==========



Without WinSock 2.0 Update

--------------------------



This issue is resolved by the following updated file for Windows 95 and

Windows 95 OEM Service Release 2 (OSR2) without the WinSock 2.0 update

only:



   Vtcp.386 version 4.00.956 (dated 11/26/97) and later



To install this update, follow these steps:



1. Download the Vtcpup11.exe file from the Microsoft Software library to

   an empty folder on your hard disk..



2. In My Computer or Windows Explorer, double-click the Vtcpup11.exe file

   you downloaded in step 1.



3. Follow the instructions on the screen.



The following file(s) are available for download from the Microsoft

Software Library:



 ~ Vtcpup11.exe



For more information about downloading files from the Microsoft Software

Library, please see the following article in the Microsoft Knowledge Base:



   ARTICLE-ID: Q119591

   TITLE     : How to Obtain Microsoft Support Files from Online Services



The following files are installed by Vtcpup11.exe:



   File name     Version    Date/Time        Size     Destination folder

   ----------------------------------------------------------------------

   Vtcp.386      4.00.956   11/26/97 9:56a   47,413   Windows\System



With WinSock 2.0 Update

-----------------------



Microsoft has confirmed this to be a problem in the WinSock 2.0 update for

Windows 95. We are researching this problem and will post new information

here in the Microsoft Knowledge Base as it becomes available.



STATUS

======



Microsoft has confirmed this to be a problem in Microsoft Windows 95 and

OEM Service Release 2 (OSR2). An update to address this problem is now

available, but is not fully regression tested and should be applied only

to computers experiencing this specific problem. Unless you are severely

impacted by this specific problem, Microsoft does not recommend

implementing this update at this time. Contact Microsoft Technical Support

for more information.



MORE INFORMATION

================



For additional information about this issue as it applies to Microsoft

Windows NT, please see the following article in the Microsoft Knowledge

Base:



   ARTICLE-ID: Q165005

   TITLE     : Windows NT Slows Down Due to Land Attack



For additional information about issues resolved by updates to this

component, please see the following articles in the Microsoft

Knowledge Base:



   ARTICLE-ID: Q170791

   TITLE     : Windows 95 TCP Clients Run Out of Ports



   ARTICLE-ID: Q168747

   TITLE     : Update to Windows 95 TCP/IP to Address Out-of-Band Issue



Additional query words: 95 



============================================================================



THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS

PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND.  MICROSOFT DISCLAIMS

ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES

OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  IN NO

EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR

ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL,

CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF

MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE

POSSIBILITY OF SUCH DAMAGES.  SOME STATES DO NOT ALLOW THE EXCLUSION

OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES

SO THE FOREGOING LIMITATION MAY NOT APPLY.