Windows 95 Stops Responding Because of Land Attack

 Last reviewed: March 10, 1998
Article ID: Q177539
The information in this article applies to:
  • Microsoft Windows 95
  • Microsoft Windows 95 OEM Service Release versions 1, 2, 2.1

SYMPTOMS

After receiving spoofed connection request (SYN) packets over TCP/IP, a computer running Windows 95 may begin to operate slowly. After about one minute, Windows returns to normal operation.

This problem may occur with TCP/IP on other operating systems as well.

CAUSE

This behavior occurs due to "Land Attack." Land Attack sends SYN packets with the same source and destination IP addresses and the same source and destination ports to a host computer. This makes it appear as if the host computer sent the packets to itself. Windows 95 operates more slowly while the host computer tries to respond to itself.

RESOLUTION

Without WinSock 2.0 Update

This issue is resolved by the following updated file for Windows 95 and Windows 95 OEM Service Release 2 (OSR2) without the WinSock 2.0 update only: 

   Vtcp.386 version 4.00.956 (dated 11/26/97) and later
To install this update, follow these steps:

  1. Download the Vtcpup11.exe file from the Microsoft Software library to an empty folder on your hard disk..

  2. In My Computer or Windows Explorer, double-click the Vtcpup11.exe file you downloaded in step 1.

  3. Follow the instructions on the screen.

The following file(s) are available for download from the Microsoft Software Library: 

 ~ Vtcpup11.exe (size: 155264 bytes)
For more information about downloading files from the Microsoft Software Library, please see the following article in the Microsoft Knowledge Base: 

   ARTICLE-ID: Q119591
   TITLE     : How to Obtain Microsoft Support Files from Online Services
The following files are installed by Vtcpup11.exe: 

   File name     Version    Date/Time        Size     Destination folder
   ----------------------------------------------------------------------
   Vtcp.386      4.00.956   11/26/97 9:56a   47,413   Windows\System

With WinSock 2.0 Update

This issue is resolved by the following updated file for Windows 95 and Windows 95 OEM Service Release 2 with the Winsock 2 update only: 

   Vtcp.386 version 4.00.1424 (dated 12/10/97) and later
To install this update, follow these steps:

  1. Download the Vtcpup20.exe file from the Microsoft Software Library to an empty folder.

  2. In My Computer or Windows Explorer, double-click the Vtcpup20.exe file you downloaded in step 1.

  3. Follow the instructions on the screen.

The following file(s) are available for download from the Microsoft Software Library: 

 ~ Vtcpup20.exe (size: 158384 bytes)
For more information about downloading files from the Microsoft Software Library, please see the following article in the Microsoft Knowledge Base: 

   ARTICLE-ID: Q119591
   TITLE     : How to Obtain Microsoft Support Files from Online Services
The following files are installed by Vtcpup20.exe: 

   File name     Version    Date/Time        Size     Destination folder
   ---------------------------------------------------------------------
   VTCP.386      4.00.1424  12/10/97  2:24p  52,133   Windows\SYSTEM

Identifying the Winsock 2.0 update

For information about how to determine whether the Winsock 2.0 update has been installed an a computer running Windows 95, please see the following article in the Microsoft Knowledge Base: 

   ARTICLE-ID: Q177719
   TITLE     : Identifying Windows Sockets 2 Run-Time Components for
               Windows 95

STATUS

Microsoft has confirmed this to be a problem in Microsoft Windows 95 and OEM Service Release 2 (OSR2). An update to address this problem is now available, but is not fully regression tested and should be applied only to computers experiencing this specific problem. Unless you are severely impacted by this specific problem, Microsoft does not recommend implementing this update at this time. Contact Microsoft Technical Support for more information.

MORE INFORMATION

For additional information about this issue as it applies to Microsoft Windows NT, please see the following article in the Microsoft Knowledge Base: 

   ARTICLE-ID: Q165005
   TITLE     : Windows NT Slows Down Because of Land Attack
For additional information about issues resolved by updates to this component, please see the following articles in the Microsoft Knowledge Base: 

   ARTICLE-ID: Q170791
   TITLE     : Windows 95 TCP Clients Run Out of Ports

   ARTICLE-ID: Q168747
   TITLE     : Update to Windows 95 TCP/IP to Address Out-of-Band Issue

Additional query words:
Keywords : osr2 win95 kbnetwork
Version : WINDOWS:95
Platform : WINDOWS
Solution Type : kbfix

THE INFORMATION PROVIDED IN THE MICROSOFT KNOWLEDGE BASE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. MICROSOFT DISCLAIMS ALL WARRANTIES, EITHER EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. IN NO EVENT SHALL MICROSOFT CORPORATION OR ITS SUPPLIERS BE LIABLE FOR ANY DAMAGES WHATSOEVER INCLUDING DIRECT, INDIRECT, INCIDENTAL, CONSEQUENTIAL, LOSS OF BUSINESS PROFITS OR SPECIAL DAMAGES, EVEN IF MICROSOFT CORPORATION OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. SOME STATES DO NOT ALLOW THE EXCLUSION OR LIMITATION OF LIABILITY FOR CONSEQUENTIAL OR INCIDENTAL DAMAGES SO THE FOREGOING LIMITATION MAY NOT APPLY.

Last reviewed: March 10, 1998
© 1998 Microsoft Corporation. All rights reserved. Terms of Use.