Windows XP SP3 Causing Router Crashes

KrispyBytes writes "Windows XP SP3 has been named as the culprit causing home routers to go into a crash and reboot cycle. One router maker has released firmware updates to fix the problem, but has not yet revealed what is actually different about XP SP3's networking stack or UPnP behaviour that causes the problem. Router maker Billion Managing Director Raaj Menon said "as Microsoft plans to make Windows XP SP3 an automatic upgrade this month, the number of affected routers may increase significantly.""

Comments

Not surprising

[noidentity]

Windows XP SP3 has been named as the culprit causing home routers to go into a crash and reboot cycle.

Not surprising Windows causes that when installed on a router, considering it also makes PCs go into a crash and reboot cycle when installed on them.

Re:Not surprising

[Anonymous Coward]

Lets not jump to blame this on Windows. It could be that Windows isn't doing anything wrong, just something the router should be able to handle, but can't. We can point fingers when we know what the actual issue causing the router problems is.

Re:Not surprising

[Malevolyn]

Let's hope the mods come to their senses. You must be new here.

Re:Not surprising

[Paul Jakma]

The parent poster shouldn't be modded informative. Their post is a jumble of random network related terminology (several of which have 0 bearing on home routers) into information-less sentences. E.g. *BGP* or IOS on a home router? "Cache tables" (did the poster misremember hearing someone say "hash tables"?). The crowning glory though:

"Spanning tree malformations can do it".

The parent is either a wickedly funny troll, or an ignorant parrot. I just can't make up my mind..

Re:Not surprising

[RobertM1968]

See though, here's the thing... who do you blame?

In a way it is (caused by) SP3... (because) of something the router cannot handle.

So, it raises a few better questions than the ones being raised here (the blame game):

- (ROUTER'S FAULT) Why can't the router handle whatever type of traffic - and should it? At the very least, as a possible attack vector for routers, shouldn't it?

- (NOT NECESSARILY SP3's FAULT, BUT STILL AN ISSUE) Why is SP3 generating such traffic? What type of traffic is it generating? Could this traffic be considered (or detected elsewhere as) a DOS attack of some sort? (We do know that enough SYN packets will crash various routers - even high end ones). What is SP3 actually attempting to do (regardless of HOW, the more important questions are WHAT and WHY).

So, while the router may be at fault for the behavior due to the type of traffic, SP3 is at fault for generating traffic of a nature that is not needed (in any way I can think of) to utilize the Internet... and considering some of the new ad and update and spyware and DRM technologies that MS is trying to bring over to XP (see previous /. articles, various MS patents and more regarding their search plans, "Live" product plans and more)... is this traffic not just flawed, but totally unwanted and intrusive? Or is it simply a screw-up on MS's part that happened to indicate vulnerabilities in various routers?

See the thing is, the reasons MS has such code creating such traffic may be important (or simply a screw-up)... but regardless of that, it showed vulnerabilities in various routers... but regardless of that, it also showed some sort of traffic that SP3 generates that may also be the cause of other routers (that arent affected adversely by such traffic) detecting as an attack of some sort, causing all sorts of other issues (for instance, a subnet or port being shut down to block the traffic).

Think how wonderful that would be if it was at a large company, medical institution, school, EMS station, etc... where all their machines were on a NAT network, and one of them that got upgraded to SP3 suddenly got their single shared IP blocked from the Internet.

So, I think there may be plenty of blame to point at both MS and the router manufacturers...

But the sad thing is, (and I am loathe to say this on /. where I am expected to make judgements based off little or no facts), until enough facts come out (showing what type of traffic, why the traffic is being generated, and what unaffected routers do when they receive the traffic), the only blame so far is:
- MS for doing something (traffic wise) that no other device or OS manufacturer seems to have ever done before.
- The router manufacturers in question for having an implementation that is not robust enough to survive such traffic without crashing.

Before anyone goes on a MS rant

[Gregb05]

A computer on the network should not be able to crash the router. This is a problem with the manufacturing of the routers, not anything in particular with SP3. This problem could have arisen in any OS. The fact that it appeared with SP3 is irrelevant. I return you to your MS bashing.

Re:Before anyone goes on a MS rant

[John Hasler]

> It is the manufactures fault that thier crashing, but this bug wouldnt be seen if xp was
> behaving correctly.

Nonsense. Any router that can be crashed by anything that a computer connected to it does has a critical bug and should be recalled immediately.

Re:Before anyone goes on a MS rant

[Sleepy]

>just like a website should never crash a browser it is relevent that the OS/website is abusing the specifications soo badly to cause the crashes.

All browsers MUST expect garbage input, and pretty much anyone who expects otherwise has their head in the sand, and shouldn't go NEAR code. Document formats don't run in local memory and do not have system access - they're interpreted structures. If a browser crashes, it's the browser's (or it's plugins) fault, 100% of the blame 100% of the time. At worst, you should expect degraded-looking content and that's that.

I don't mean to be snarky, but your argument couldn't be more wrong or inappropriate. With networking, you're pretty close to the physical layer (not a great analogy, but browser code is far removed from traffic and is just a local representation, a user application).

We don't know yet what this is caused by. If it is affecting a lot of routers, it might very well be a "DOS". Or it could be something that holds too many connections open, or IP6 traffic that doesn't go anywhere and ties up the router table till it times out.

This could happen to Linux also, but it's less probable -- it's be code put out in the wild, and the distro's would do their own QA process, and may hold back. Most distros don't run kernel.org kernels, but their own patched tree.

Blaming the wrong programmers

[Jeffrey Baker]

Shouldn't the title of this post be "Shitty router programming causing router crashes"? It should matter what type of garbage come off the wire, the router must be able to handle it all without error.

Re:Blaming the wrong programmers

[yomegaman]

The "article" is just a reprinted press release from Billion. Of course they blame SP3, since the alternative is admitting their products are buggy pieces of junk.

Re:Maker?

[Neuropol]

One router maker has I think you meant manufacture i think YOU meant manufacturer

So...

[laurent420]

Windows is a DOS?

Re:Other Glitches?

[oz_paulb]

I have to agree.

I updated to SP3 yesterday, and now my microwave stopped working.

Coincidence? I think not!

Works for me, and probably for you

[Ethan Allison]

It only affects the "Billion BiPAC 5200" series.

I've never used one, never seen one, never heard of one, and you haven't either. Odd how the summary fails to mention that the problem is only with this obscure model...

Here's the technical reason

[Anonymous Coward]

Quote from their website:

"After detail analysis, we found that Windows XP SP3 sent out the DHCP packet with the Option 43 data (include Microsoft's 'Vendor Specific Information'), but Windows XP SP2 sent out the DHCP packet without the Option 43 data. However, the Option 43 data is not compatible with Billion's original definition, so it will cause this problem. The affected firmware versions of BiPAC 5200 series are 2.9.8.x and 2.11.0.x~2.11.33.x. There is no impact to BiPAC 5200 series if the firmware is 2.10.x.x. Please check Appendix A for checking your current firmware version."

http://au.billion.com/downloads/Notice-Billion-5200-series-via-Windows-SP3.pdf

Re:Here's the technical reason

[Richard_at_work]

Just to clarify the parent posters information, Option 43 (Vendor Specific Information) is a valid but optional part of the DHCP spec, covered in RFC 2132, part 8.4. A server not equipped to handle the Vendor Specific Information must ignore it.

Re:I installed SP3

[DavidD_CA]

Judging by most of the people here, you won't have any better success with Ubuntu or SuSe either.

You might try Mac OS. Or at the least, get an iPhone and use it liberally while in public.

Not MS to blame

[Opportunist]

As much as I hate defending the Redmond Computer Virus (tm), that's the router's fault.

Now, if SP3 created nonstandard packets that most routers still swallow but a router drops because they don't work to spec, blame MS. If the router replied with a bogus message to said nonstandard packet that locked up XP, blame MS. But a router HAS TO be able to accept a bogus packet. It may drop it, report it or if it feels like it send it on a roundtrip in hope that some machine can figure out what it's about, but it may NEVER crash due to it.

I hope I don't have to mention the security implications of this.

Re:Since I use Vista

[Lennie]

You however have other problems I'm guessing. ;-)

NAPT != Firewall

[Luke-Jr]

uPNP configures port forwarding for a NAPT (aka NAT) router. NAPT/NAT is *not* a firewall, and should not be treated like one. Its sole purpose is to translate addresses and ports (Network Address and Port Translating) between the internal and external networks. It is not meant to protect computers on either end from each other. uPNP facilitates the NAPT job by giving applications an easy way to automate the needed port forwarding for the WAN->LAN direction. If you want a firewall, get a real firewall.

apples to oranges

[spazdor]

Did the hardware manufacturers all just write flawless Linux drivers and buggy Windows ones?

Or did Linux developers just go a step further than Windows did, and take it upon themselves to make sure that hardware works properly on their OS?

Re:Glad I disabled auto-updates

[afidel]

I'm more glad I disabled uPnP, it's a very poorly designed spec with even crappier real world implementations. It's about the most bug-prone technology I know of.