Every night around 3 AM from the eventlog (Outlook complains it can't get to the exchange server) I lose all TCP/IP connectivity from my desktop. Other systems on the network still function, as well as the IP phone system plugged into the same hub, but not me.

And ipconfig /release and /renew gets me working again, so I'm able to handle DHCP broadcasts, but why would my IP get knocked out?

I'm an XP SP 3 32-bit system. Latest patches - EXCEPT that the latest SQLServer 2005 SP2 security patch is failing installing (for what its worth).

The only thing in the logs at the time related to networks is:

Event Type: Warning
Event Source:   Tcpip
Event Category: None
Event ID:   4226
Date:       11/6/2009
Time:       9:53:43 AM
User:       N/A
Computer:   HEIMDALL
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
0000: 00 00 00 00 01 00 54 00   ......T.
0008: 00 00 00 00 82 10 00 80   ......
0010: 01 00 00 00 00 00 00 00   ........
0018: 00 00 00 00 00 00 00 00   ........
0020: 00 00 00 00 00 00 00 00   ........

but that happens even when I'm working.

Ideas on how to diagnose this? Is there an "enhanced" TCP/IP diagnosis mode on the stack?

  • 1
    Re: Event ID: 4226. So far from 3 AM it hardly has anything to do with your problem. You may still want to investigate this but if it happens only several times a day, why bother. – Bender Nov 7 '09 at 1:21
  • Is the computer hibernating or on standby? – Tester101 Nov 12 '09 at 15:18
  • Are there any scheduled tasks set to run at or near that time? – Tester101 Nov 12 '09 at 15:20
  • are u running some torrent clients ? – user8228 Nov 12 '09 at 15:21
  • @Bender - I was remote connecting to it from home (it is my dev box for work) - I'd like it to be accessible if I'm not going into the office. @Tester101 - No, it was not hibernating or standby Scheduled tasks - maybe defrag. @Revolter - No torrent clients, why? – Eli Nov 17 '09 at 18:49

Since XP SP2, there are limits set on the number of concurrent and incomplete outbound TCP connection attempts. You can change the limit with this patch, but I'd recommend finding which programs are making all of these incomplete connections and fixing that instead. You can use the netstat command or Sysinternals TCPView to see what is making the connections.


Sounds like a possible issue with DHCP lease renewal. Windows machines often 'hiccup' if they've got open connections during a lease renew operation. Try increasing the default lease time from 1440 mins (24 hours) to something longer and see if the problem moves. I've had machines which seemed to just mysteriously disconnect from the network, and traced it down to my router's lease time. Even static DHCP leases didn't help, as they still expire and renew, although with the same IP each time. And recently, when using static leases, my router gives a 32bit 'infinite lease', 0xFFFFFFFF (ie, -1), which is proper by RFC-2131, and Windows thought the lease expired 1 second ago. Totally confused the Windows machines in the network.

  • How would I begin to learn about how to increase my "lease time"? I don't know where to start. – Gabriel Fair Feb 7 '13 at 20:59

Try adding a DHCP reservation on your router, or using a fixed IP. If that fails (and you're SURE the other computers aren't failing), try a newer network card driver, a different network cable, or a different network card. If you're still stuck, use wireshark to log all the packets in and out, and see if a certain packet is crashing the card driver or anything like that. Then use a power saving monitor to check if the card (or your whole computer) is going to sleep etc.


There is a setting on the network card which when checked allows Windows to turn off the NIC. Getting to the setting depends on the OS being used. On some XP machines (my experience is mainly with dell) there is a seperate icon in the control panel while in Vista it is in network and sharing..., network connections properties, advanced.

hope this helps

  • Kinda makes sense except:<BR> 1) Waking the computer locally does not restore connectivity<BR> 2) ipconfig /renew does re-establish the connection - if it was the NIC turned off, I don't think ipconfig /renew would work. – Eli Nov 17 '09 at 18:54

Do you have a fixed IP address?

In my case, when the ISP changes my IP address, all sort of side-effects can arrive, and connectivity may be lost for a period until the router and Windows come to a new agreement.

  • No - I don't have a fixed IP address (I've had the same IP from DHCP lease, but no guarantee on that). – Eli Nov 17 '09 at 18:52
  • Then my explanation has a chance of being correct. – harrymc Nov 17 '09 at 19:47

I guess the easy solution would to be to create a batch file containing the "ipconfig /release" and "ipconfig /renew" commands and put it into the Windows Task Scheduler to run every day just after 3 a.m.

  • 2
    I don't like this suggestion. It doesn't attempt to solve the problem, instead it's a bandaid that covers up the issue. Imagine his webserver was failing often, and rebooting fixed it...you wouldn't tell him to set a script to reboot his webserver every time, would you? – davr Nov 7 '09 at 0:47
  • @davr - agreed for sure – MDMarra Nov 7 '09 at 1:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.