Why does KB941644 contain two different tcpip.sys files?

I noticed in the tech bulletin below that versions 6.0.6000.16567 and
6.0.6000.20689 of tcpip.sys are included for *both* 32-bit and 64-bit.
There are other related files there, too, all with two different versions.

Why would some versions of Vista get one version over another (which I'm
assuming is the case)? If it was just a 32-bit vs 64-bit thing I'd
understand, but as mentioned there are two versions of each file for 32-bit
and 64-bit.

http://www.microsoft.com/technet/sec.../ms08-001.mspx

"Milhouse Van Houten" <> wrote in message
news:%...
>I noticed in the tech bulletin below that versions 6.0.6000.16567 and
> 6.0.6000.20689 of tcpip.sys are included for *both* 32-bit and 64-bit.
> There are other related files there, too, all with two different versions.
>
> Why would some versions of Vista get one version over another (which I'm
> assuming is the case)?


The usual explanation is that one is labeled the GDR fix (which is essentially
just the code to fix only that problem in the base source) and the other one
is labeled the QFE fix (which is essentially a version which integrates all other
hotfixes which apply to that module.) So my guess would be that the newer
bigger module is the QFE version.

When you download such an update and look at how it is stored,
file and subdirectory labels may make these distinctions even more apparent.


FYI

Robert Aldwinckle
---


> If it was just a 32-bit vs 64-bit thing I'd
> understand, but as mentioned there are two versions of each file for 32-bit
> and 64-bit.
>
> http://www.microsoft.com/technet/sec.../ms08-001.mspx
>

"Robert Aldwinckle" <> wrote in message
news:...
> "Milhouse Van Houten" <> wrote in message
> news:%...
>>I noticed in the tech bulletin below that versions 6.0.6000.16567 and
>> 6.0.6000.20689 of tcpip.sys are included for *both* 32-bit and 64-bit.
>> There are other related files there, too, all with two different
>> versions.
>>
>> Why would some versions of Vista get one version over another (which I'm
>> assuming is the case)?
>
>
> The usual explanation is that one is labeled the GDR fix (which is
> essentially
> just the code to fix only that problem in the base source) and the other
> one
> is labeled the QFE fix (which is essentially a version which integrates
> all other
> hotfixes which apply to that module.) So my guess would be that the
> newer
> bigger module is the QFE version.
>
> When you download such an update and look at how it is stored,
> file and subdirectory labels may make these distinctions even more
> apparent.

Very interesting. While I didn't see any QFE/GDR indications in the version
I downloaded from the Download Center, I wonder what determines which one
you get (most people would get it via WU)? I would certainly have thought
that MS would automatically go for the QFE version, since particularly in
the case of 64-bit, there have been several previous tcpip.sys updates (some
but not all only available via tech support). I've seen reports of people
getting 16567 in 32-bit and 20689 in both 32-bit and 64-bit. I’m sure it's
just a matter of time before I see mention of someone getting 16567 in
64-bit as well.

I wonder if it could be this: If MS detects that you're running RTM
tcpip.sys, you get 16567; if you're running a later release, you get 20689.
Perhaps the logic is if you stuck with RTM all this time you don't need any
of the interim updates? I thought some of the 64-bit interims were
important though, so this doesn't make full sense.

"Milhouse Van Houten" <> wrote in message
news:...

> Very interesting. While I didn't see any QFE/GDR indications in the version
> I downloaded from the Download Center, I wonder what determines which one
> you get (most people would get it via WU)?


How is it stored and labeled? Check the .inf file to see what conditions
under which the one is installed and not the other?


> I would certainly have thought that MS would automatically go for the QFE
> version, since particularly in the case of 64-bit, there have been several
> previous tcpip.sys updates (some but not all only available via tech support).


No. In order to get hotfixes distributed in a timely manner there is inadequate
integration testing done to allow the integrated version to be made a default.


> I've seen reports of people
> getting 16567 in 32-bit and 20689 in both 32-bit and 64-bit. I’m sure it's
> just a matter of time before I see mention of someone getting 16567 in
> 64-bit as well.
>
> I wonder if it could be this: If MS detects that you're running RTM
> tcpip.sys, you get 16567; if you're running a later release, you get 20689.
> Perhaps the logic is if you stuck with RTM all this time you don't need any
> of the interim updates? I thought some of the 64-bit interims were
> important though, so this doesn't make full sense.


I have only seen an explanation of GDR versus QFE in TechNet Security
update bulletins. If you have a certain patch on you can automatically get
QFE versions installed provided you already have a QFE version of that
module (or I assume, set of modules). Otherwise you get the GDR version.


FYI

Robert
---

"Robert Aldwinckle" <> wrote in message
news:#...
> "Milhouse Van Houten" <> wrote in message
> news:...
>
>> Very interesting. While I didn't see any QFE/GDR indications in the
>> version
>> I downloaded from the Download Center, I wonder what determines which one
>> you get (most people would get it via WU)?
>
>
> How is it stored and labeled? Check the .inf file to see what conditions
> under which the one is installed and not the other?

This is one of those updates, as most seem to be these days, that is an .MSU
file. Inside that are CABs, and inside that are a number of inscrutable
files such as MUMs, CATs, and filenames that are merely numbers (0,1,2,
etc).

>> I would certainly have thought that MS would automatically go for the QFE
>> version, since particularly in the case of 64-bit, there have been
>> several
>> previous tcpip.sys updates (some but not all only available via tech
>> support).
>
> No. In order to get hotfixes distributed in a timely manner there is
> inadequate
> integration testing done to allow the integrated version to be made a
> default.

I guess with SP1 imminent anyway it's not that important which one someone
gets, since with that we'll all be on the same thing--until the next update,
anyway.