getting quick arp request

[Ben Sizer]

seb wrote:
> I am not fully confident to apply the patch from
> http://www.lvllord.de/?lang=en&url=downloads .on computers other than
> mine.

Fully understandable.

> Is there another solution ?

I believe it is possible to overwrite the .dll that SP2 gives you with
the older one. Obviously you lose any other bug fixes or enhancements
Microsoft put in there. I don't remember the actual file in question,
sorry. And I don't suppose this is much more acceptable than the
previous 'solution'.

> Still without the above patch on windows, the software "angry ip scan"
> for example managed to output a lot of more socket connection. How is
> it possible ?

It sends an ICMP ping to each address first, meaning it doesn't have to
waste time on trying a TCP connection to a host that doesn't respond.
This leads to fewer half-open connections.

It may also be that it implements part of its own TCP/IP stack, and
accessing the ethernet card directly, but I don't know how practical
that is for you. Ethereal and nmap appear to do this; you might want to
browse their open source code, and/or ask on their mailing lists or
forums.

-- 
Ben Sizer