JSI Tip 10301. You receive Event ID 4226 in the System event log on Windows XP SP2?

You receive EVENT ID 4226, TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts, in the System event log on Windows XP SP2.

In Service Pack 2, the TCP/IP stack now limits the number of simultaneous incomplete outbound TCP connection attempts. When the limit is reach, further attempts are queued and resolved at 10 per second, in order to limit the speed at which malicious programs spread.

If you encounter this limit without any malicious programs, download the Intelligent TCPIP.SYS patcher / EventID 4226 patch and unzip it.

When you run EvID4226Patch.exe, you receive:

Intelligent TCPIP.SYS patcher / EventID 4226 patch             Version 2.23d
(c) 2004-05 LvlLord (www.LvlLord.de)        use parameter /? for more options

This program is in development. Visit http://www.LvlLord.de for a new version
- Windows mode
- Recognised Windows-directory: C:\WINDOWS

- 'Windows XP SP2 or newer' TCPIP.SYS detected ...

- Build of TCPIP.SYS  : 5.1.2600.2827 (I386)
- Build of safety copy: 5.1.2600.2827 (I386)

Found limit position                            : 0x4F5A2
Current maximum concurrent half-open connections: 10

If you continue, please press 'Abort' and 'Yes' on the popup from Windows
File Protection. Because we change system files, Windows tries to restore the
original one. So it's normal.

Do you really want to change the limit to 50?
 (Y=Yes  /  N=No  /  C=Change limit  /  U=Uninstall)
When you press Y and Cancel the subsequent Windows File Protection, your %SystemRoot\System32\DRIVERS\Tcpip.sys and %SystemRoot\System32\DLLCACHE\Tcpip.sys are patched.

NOTE: It is best to restart your computer.

Hide comments


  • Allowed HTML tags: <em> <strong> <blockquote> <br> <p>

Plain text

  • No HTML tags allowed.
  • Web page addresses and e-mail addresses turn into links automatically.
  • Lines and paragraphs break automatically.