SynAttackProtect

Question

Hi everyone!

Are the articles below still valid as good security practice on a network with W2K19 servers?

https://technet.microsoft.com/en-us/library/cc938202.aspx
https://technet.microsoft.com/en-us/library/cc938208.aspx

Should we enable it? The articles are from 2008.

Thanks.

Answer 1

Hi @Doria ,

As of Windows Vista and onwards (Vista/2008/Win 7/2008 R2/Windows 8/Windows 2012/Windows 2012 R2), syn attack protection algorithm has been changed in the following ways:

1. SynAttack protection is enabled by default and cannot be disabled!

2. SynAttack protection dynamically calculates the thresholds (of when it considers an attack has started) based on the number of CPU cores and memory available and hence it doesn’t expose any configurable parameters via registry, netsh etc.

3. Since TCPIP driver goes into attack state based on the number of CPU cores and the amount of memory available, systems with more resources will start dropping new connection attempts later compared to systems with less resources. That was hard-coded (as per the configured registry settings) on pre-Vista systems where the system was moved to attack state regardless of how much resources were available to the system. The new algorithm eliminates the need of any fine tuning and TCPIP stack will self-tune to best values possible depending on the available resources.

Reference:
https://learn.microsoft.com/en-us/archive/blogs/nettracer/syn-attack-protection-on-windows-vista-windows-2008-windows-7-windows-2008-r2-windows-88-1-windows-2012-and-windows-2012-r2

----------

(If the reply was helpful please don't forget to upvote or accept as answer, thank you)

Best regards,
Leon