patching tcpip.sys after SP3

[SiberLynx]

Hi Guys,

After SP3 un-patched tcpip.sys this question was asked many times already.

But the answer is still controversial. Even in this forum, where previously it was always suggested to patch I can see few posts stating "you don't need to patch half-open connections"

Well, I tested it after SP3. download speed is 4 times less then usual 200KB/s instead of 700-800KB/s, and upload which always was 60KB/s as set. Now is max 19 KB/s.

The test performed on the same torrent which constantly has around 300 seeders

In addition Browsing during uTorrent download is substantially slower. Previously I could not see the difference.

Sorry for the long preamble.

So there are 2 questions:

1) Can the same patches (LvlLord or xp-AntiSpy, which I prefer) be applied to post SP3 tcpip.sys?

2) Can anybody comment on this new patch? http://www.liciece.com/?p=735

Wherever you go now searching for "post SP3 info you find this reference. And those figures 500/600/1000 ??? Sure it is something different to half-open connections.

Thanks in advance

[DreadWingKnight]

Halfopen limits and download speeds are completely unrelated.

Halfopen limits only affect the amount of time it takes to get all your connections established.

Noticing slower browsing speeds means you need to lower your halfopen setting in uTorrent. (I have mine st at 4, works like a champ)

Those halfopen patches are unnecessary.

[SiberLynx]

Noticing slower browsing speeds means you need to lower your halfopen setting in uTorrent. (I have mine st at 4, works like a champ)

Hi DreadWingKnight,

Thanks for reply.

Well, probably I should not touch speed and give examples but just ask those 2 Q.

Thing is that the issue is a bit more complicated. I should say just performance and another things around Torrent like browsing at the same time etc.

Instructions about half-opened are still strongly state to do that (sure not for Vista- different story, I know).

Please don't get me wrong I am not criticizing you. You most likely have more knowledge that I have in this area.

The trick is how I understand it that the correct answer probably is: make it lower unless you patched. But IF you patched

(say to 100) set it in Torrent lower then that value (say to 80). That was tested thoroughly with SP2 and sure I went already through lowering with no result and patching with great result including browsing and FTP downloading/uploading simultaneously (utorrent at full speed up/down).

Anyway, mainly my Q was: is the same patch safe after SP3 and would there be any bad implications regarding not only uTorrent.

Many say the old "XP patch" works but I just wanted to ask in uTorrent Forum.

and the second Q from my initial post still intriguing.

My regards

[DreadWingKnight]

Increasing the halfopen limit in uT just speeds up other problems occurring. Patching tcpip.sys or not, you should NEVER increase your halfopen limit, simply because of how often you have to re-patch and re-patch and re-patch and re-patch and re-patch.

Increasing halfopen doesn't solve any problems and just makes for more problems down the road.

The patch you linked is probably not going to be worth doing even if you plan on patching.

[GTHK]

EvID patch works on SP3 (the LvlLord or whatever).

[Dark Shroud]

The LvlLord patch hasn't been update in 3 years, you really don't want that thing near your PC. Combigned with the fact that MS is not backing down from locking up the tcp/ip stack. A decent amount Malware programs have started to infect it so MS continue to update it, lock it, and will restore the files if they are changed/modded.

[GTHK]

The patch works fine, no need to update it.

And people need to use a good anti-virus and stop downloading porno from random sites . I think some companies actually do some common sense security training for there employees.

[SiberLynx]

Hi Guys,

Thanks for you responses.

I did not mean to create troubles and "word-fighting" Everything is Cool!

patch works on SP3

Yes & confirmed by other places & sources

The LvlLord patch hasn't been update in 3 years, you really don't want that thing near your PC. Combigned with the fact that MS is not backing down from locking up the tcp/ip stack. A decent amount Malware programs have started to infect it so MS continue to update it, lock it, and will restore the files if they are changed/modded

and thats how it was set here for 2 years.

I don't use LvlLord patch. As I said, I use xp-AntiSpy and that one updates periodically current version is 3.96-8.

... and yes who cares about MS repatching. I check after MS updates with the same program. It reports: "Already Patched" -Yes/No ... takes a second :-)

After reading other sites as well it is Done! Got everything back !!!

On the same test torrent got my 750-830 KB/s (this time #of seeders dropped) and upload was back to 60-68 KB/s

and I brows at the same lightnig speed

and I tested download from FTP when torrent was working hard. It was 250-300 KB/s stable compare to before 32-50 KB/s and dropping to Zero.00 KB/ and waiting.

Thanks again

Best wishes

[GTHK]

Just a note, the patch doesn't directly increase speed, it let's you open connections more quickly, which can be good if you have µTorrent, and some other programs that all need to open connections. Opening too many connections at once will be disadvantageous though on broken hardware and/or some ISP's.

[SiberLynx]

doesn't directly increase speed, it let's you open connections more quickly, which can be good if you have µTorrent

Hi GTHK,

Thanks again. µTorrent is the one and the best! Yes I know about "doesn't directly"... but indirectly which is proven 3rd time during reset forced by MS. That cannot be accidental... and overall performance etc. - I have no doubts about that.

Cheers

[GTHK]

Did you change the limit with µT? Or did you leave it at the default and only patch Windows? The impact of a low limit in XP is most noticeable when applications exceed it.

[Firon]

It only improves when you set it too high and the patch is reset.

I had no trouble maxing out my 100mbit port with the limit set to 8.

[Ultima]

And I've no trouble maxing my 10mbit out with 4. Quickly connecting to peers has no effect on the overall speed -- not even indirectly.

[SiberLynx]

Hi Guys,

did you leave it at the default and only patch Windows

No I did not leave it in µTorrent as the default.

I changed it as in every instruction all over the Net about increasing torrents speed. 100 in patch & 80 in µTorrent.

one of the instructions still referenced in Ultima's (Hi Ultima! ) tips page somewhere

(don't remember the link precisely but I came across it in the past sure it can be found)

Cheers

P.S.found it:

Sorry I just copy/paste it ... not much time here but "patching TCPIP.sys" is a link to Oh! Lord!

http://forum.utorrent.com/viewtopic.php?id=15992#p258232

Try patching TCPIP.sys (Windows XP w/ SP2, Windows 2003 w/ SP1, or newer)? Windows Vista users can try this out, but no guarantees are made. Users not on Windows XP w/ SP2, Windows 2003 w/ SP1, Windows Vista, or newer can skip this step.

[GTHK]

It says to patch XP, not µT. Patching µT isn't recommended (by others) because of the problems it can cause. Have you tried recently downloading with both limits at default?

[jewelisheaven]

... You don't patch uT. You change the setting under Advanced. The reason when people ASK, they are told to NOT change halfopen, is because it does not do what people think and it can cause more problems than it (apparently) solves.

Half-open connections SOLE benefit is to increase the rate of speeds' increase during the start of a torrent. I.e. if you are on a 10Mbit download line and it takes 10 minutes to get there from 100 peers, a higher half open rate can lower that to 5 minutes from the same 100 peers. Notwithstanding you don't need even half that many peers

Many hardware brands and models do not handle the load filesharing applications deal to them, AND increasing the instantaneous load does not help this. This is the reason there is no need to change your half open value, EITHER in Windows, OR in uT.

[GTHK]

Patch/change a setting, when you've been up as long as I have, well, my Windows event log says I typed my password wrong eight times in a row. For once I can be happy I'm on crappy home, pro would have locked the acct and I'd have to use the Administrator acct to unlock it.

Anyway, I've remembered two little fun facts. One, my router said something ridiculous like 150% load when I tested 3000+ connections and a high half open limit, and two, there's a one byte change to 1.7.7 that lets you use DHT on private flagged torrents.

[Ultima]

@SiberLynx: You'll notice that the "recommendation" to patch TCPIP.sys is at the bottom of the list of things to try for interrupted connections -- with good reason. It's not really recommended; it's simply offered as a last resort. I haven't updated the links either because I don't patch my TCPIP.sys (so I can't really keep up with what works and what doesn't).

[SiberLynx]

Ultima, there were no intention to point to that link so that you feel uncomfortable now about it. Please don't get me wrong.

I even see that probably I should've put my initial Q much simpler than it is.

Like does the said patch work after SP3...and that's it.

I don't want to create some confusion especially for new less experienced users.

Because now I see there are remarks about mixing the patch and respective setting in uTorrent. I don't but other may.

Then there is a note here about increasing speed (rather reducing time ) from 10 min to 5 IF... but When 10Mbit connection. I am on 24Mbit.

We may go on and on.

If you as a moderator think that the thread is damaging and confusing for readers, please feel free to close it or even remove it.

At the same time as a last note I may say that such good Forum as this dedicated to such outstanding (I am not exaggerating) Software

deserves clear Instruction / Sticky or alike, where all this said step by step. Probably there will be some repetitions as in other instructions over the Net.

SP2/SP3 issue and/or differences if any should be highlighted too because people will come back again and again with all those Q and will refer to all those "other" manuals.

It may happen that it is just your instruction could be slightly edited after all to reflect some new stuff.

I thank everybody for their inputs and I hope that the suggestion above doesn't sound just wordy & weird and it has some sense.

Cheers everybody :-)

Wish you all the best.

[DreadWingKnight]

The most you shave off a torrent's download time by patching tcpip.sys and increasing the halfopen is actually less than what he said. You only shave at MOST 60 seconds off of a torrent's download time.

[Switeck]

If you're not firewalled in uTorrent, you don't NEED to set half open connections as high as when firewalled. Because peers and seeds are trying to connect to you too!

If you only care about maxing download speeds, then you have a different perspective on whether high half open rate is "good"! A "win" for you is an extremely high download speed...but where does the bandwidth come from?

Even if you've patched Windows, even if your compture hardware, software, and internet line can handle patching tcpip.sys to handle 100's of half open connections at once...

There is a point where you are REDUCING your speeds in uTorrent by setting half open connections too high!

Constantly trying to do handshakes for each new connection (especially encrypted!) has an absolute bandwidth cost...that's probably close to symmetrical down and up. Say you use 10 KB/sec download speed to maintain a high half open rate...no big deal! But does 10 KB/sec upload speed used seems equally small?

And if the torrents you're on have lots of firewalled peers and seeds, then each attempt to them is a guaranteed failure. Or if you're only allowing encrypted connections...then every peer or seed that isn't allowing encrypted connections (maybe due to running very old clients or disabled in settings), then once again they all fail. If the torrent downloads fast and lots of people leave the torrent shortly after finishing, then their ips are still listed for awhile...and your client still tries them, which of course always fail.

Or if the torrent is small, and only has 20 total peers+2 seeds, then a high half open rate is actually reduced to retrying only those 22 ips once every minute or so...for an actual half open rate of less than 1 per second. You gain nothing to set half open faster than default there either! If you did, it causes ALL the ips pretty much to be retried at about the same time...so you get a bandwidth spike then cutting into uploading and download, so setting max upload a little more difficult unless you don't mind "occasional web slowdowns" when all the connections are retried at once.

Or the torrent has 1000's of ips representing seeds, peers, firewalled clients, dead ips, and peers/seeds not allowing encryption. uTorrent hammers through all that as fast as your half open rate allows, but then what? You can't connect to them all ...OR the connection overheads would eat most lower-end broadband connections up, leaving little bandwidth to actually upload/download!

[Slider2k]

That's alot of text Switeck. But i think you should learn more about networking.

Connection in half-open state don't reserve bandwidth. Half-open state means that a connection is in state of establishing. Like when a host sent a connection request to a another host and is awaiting an acknowledgement. Read more on http://en.wikipedia.org/wiki/Half-open_connection

Next there's no "half-open rate" in networking. There's maximum half-open connections limit imposed by Microsoft in it's "security" SP2. The main purpose for it is that Microsoft thinks that it would help slowing network worms distribution. Networms use a distribution algorithm that is trying to connect to many randomly genereted ip addresses at once. Similarly to P2P apps that are trying to connect to many hosts at once. So this restriction is bogging down not only networms but also P2P connection establishing speed.

There's no drawbacks having unrestricted maximum half-open connections as it was before SP2. The maximum before SP2 was 16777214 half-open connnections.

[GTHK]

There are drawbacks, subpar hardware fails, and Microsoft limit resets. I have to wonder if the hardware is subpar because of the limit in Windows..

[Lord Alderaan]

A limit to concurrent halfopen connections results in a limit on how many connections are made each second simply because a new connection attempt is refused if the current maximum halfopens has been reached. Since connections only stay in halfopen status for a few milliseconds (to up to a few hundred milliseconds depending on ping time (aka lag or latency) to the target machine) as soon as a connection becomes established a spot for a new halfopen becomes available and the next connection attempt will be allowed.

By applying this limit universally in all windows based computers the drain on networks of 'networms' is reduced. The side effects of a decent limit (such as the default 10) are minimal. On P2P virtually nil. Whether you connect to a 100 peers in 1 second or 10 seconds has no noticeable effect. What is 10 seconds on a large torrent that takes hours to up to days to download? And who cares if a small torrent downloads in 1 minute instead of 50 seconds? And NO it does not have any effect on actual speeds.

The only program besides viruses that I can think of right now that probably actually suffers from this limit is a port scanner.

Most of us don't actually mind people increasing their limit. But what we do mind is the fact that we regularly have people complain about connection problems only to find out it was because they had increased both their OS and µtorrent half open limit and the subsequent restoration of the OS limit by a windows update caused µtorrent to choke their connection.

It makes µtorrent look like the culprit. Of course we could go and blame MS for restoring the limit with their updates etc etc. But the fact is that people meddle with things that they don't know anything about. They probably did it on the advise of some would-be whizkid that thinks he knows much and/or a 'me-against-the-microsoft' techy that didn't really think about the actual mechanics. Oh and of course there are the "I saw someone do this somewhere else and decided to make a how-to video on youtube for you guys but actually I have NO idea what I just changed (read: messed up)." videos...

[Switeck]

Slider2k said: "Connection in half-open state don't reserve bandwidth."

A connection ATTEMPT takes a tiny amount of (upload) bandwidth.

Until the other end replies, the connection is in a half open state, but that bandwidth is already spent either way. Individually, these tend to be very tiny bandwidth spikes not continuous bandwidth use. But if you have uTorrent's half open limit set above the default of 8, chances are you will have almost continuous outgoing connection attempts...unless the torrents you're on are nearly dead.

That connection remains in a half open state TILL the other end replies OR the attempt times out. *IF* the ip you're connecting to actually replies, then there is additional bandwidth costs...BitTorrent handshakes may be pretty lightweight, but they're not as lightweight when using encryption.

I am presuming quite a few (even many) of the ips attempted by uTorrent WILL connect. This means we cannot assume that a half open connection has an essentially nil bandwidth cost because SOME do connect. If they don't, you need to try less-dead torrents.

Another way of looking at half open connections is they are waiting to establish. Once the request is sent, your end is waiting till the time out period passes...then it gives up and quits listening for a reply.

The "half-open rate" I am referring to is roughly how fast ips are churned through in uTorrent's torrent peer list via outgoing connection attempts. Having a high half open connection limit set in uTorrent effectively increases that rate, as ips that time out don't stop connection attempts cold unless they manage to tie up every half open connection allowed at once.

Slider2k said: "There's no drawbacks having unrestricted maximum half-open connections as it was before SP2."

There are EXTREME DRAWBACKS with having uTorrent's max half open value set beyond 100, even if your Windows operating system can handle FAR higher values. There's too many types of networking software and hardware that will fold up and die from ridiculous half open values. An ISP can even take aggressive actions to "maintain network health" were you to run 1000 half open connections at once for a couple days straight. (NOTE: Setting uTorrent's half open value to 1000 alone wouldn't do that...you'd need enough running torrents to give uTorrent over 10000 ips to try per minute.)