Appendix D: Tuning TCP/IP Response to Attack
Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
TCP/IP Security Settings
In addition to the settings that are listed above, the following keys can be altered to assist the system to deal more effectively with an attack. It is important to note that these recommendations by no means makes the system impervious to attack and only focuses on tuning the TCP/IP stack’s response to an attack. The setting of these keys does not address any of the many other components on the system, which could be used to attack the system. As with any change to the registry, the administrator needs to fully understand how these changes affect the default function of the system and whether they are appropriate in their environment.
SynAttackProtect
Key: Tcpip\Parameters
Value Type: REG_DWORD
Valid Range: 0, 1
0 (no SYN attack protection)
1 (reduced retransmission retries and delayed RCE [route cache entry] creation if the TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are satisfied and a delayed indication to Winsock is made.)
Note
When the system finds itself under attack the following options on any socket can no longer be enabled: scalable windows (RFC 1323) and per adapter configured TCP parameters (Initial RTT, window size). This is because when protection is functioning the route cache entry is not queried before the SYN-ACK is sent and the Winsock options are not available at this stage of the connection.
Default: 1 - enabled for Windows Server 2003 Service Pack 1, 0 - disabled for Windows Server 2003 with no service packs installed
Recommendation: 1
Description: SYN attack protection involves reducing the amount of retransmissions for the SYN-ACKS, which will reduce the time for which resources have to remain allocated. The allocation of route cache entry resources is delayed until a connection is made and the connection indication to AFD is delayed until the three-way handshake is completed. Note that the actions taken by the protection mechanism only occur if TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are exceeded.
TcpMaxHalfOpen
Key: Tcpip\Parameters
Value Type: REG_DWORD—number
Valid Range: 100–0xFFFF
Default: 100 (Windows Server 2003, Standard Edition), 500 (Windows Server 2003, Enterprise Edition; Windows Server 2003, Datacenter Edition)
Description: This parameter controls the number of connections in the SYN-RCVD state allowed before SYN-ATTACK protection begins to operate. If SynAttackProtect is set to 1, ensure that this value is lower than the AFD listen backlog on the port that you want to protect (see backlog parameters in Appendix C for more information). See the SynAttackProtect parameter for more details.
TcpMaxHalfOpenRetried
Key: Tcpip\Parameters
Value Type: REG_DWORD—number
Valid Range: 80–0xFFFF
Default: 80 (Windows Server 2003, Standard Edition), 400 (Windows Server 2003, Enterprise Edition; Windows Server 2003, Datacenter Edition)
Description: This parameter controls the number of connections in the SYN-RCVD state for which there has been at least one retransmission of the SYN sent, before SYN-ATTACK attack protection begins to operate. See the SynAttackProtect parameter for more details.
EnablePMTUDiscovery
Key: Tcpip\Parameters
Value Type: REG_DWORD—Boolean
ValidRange: 0, 1 (false, true)
Default: 1 (true)
Recommendation: 1
Description: When this parameter is set to 1 (true) TCP attempts to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to 0 causes an MTU of 576 bytes to be used for all connections that are not to hosts on the local subnet.
NoNameReleaseOnDemand
Key: Netbt\Parameters
Value Type: REG_DWORD—Boolean
ValidRange: 0, 1 (false, true)
Default: 0 (false)
Recommendation: 1
Description: This parameter determines whether the computer releases its NetBIOS name when it receives a name-release request from the network. It was added to allow the administrator to protect the machine against malicious name-release attacks.
EnableDeadGWDetect
Key: Tcpip\Parameters
Value Type: REG_DWORD—Boolean
ValidRange: 0, 1 (false, true)
Default: 1 (true)
Recommendation: 0
Description: When this parameter is set to 1, TCP is allowed to perform dead-gateway detection. With this feature enabled, TCP may ask IP to change to a backup gateway if a number of connections are experiencing difficulty. Backup gateways may be defined in the advanced properties of the TCP/IP protocol. See the “Dead Gateway Detection” section in this article for details.
KeepAliveTime
Key: Tcpip\Parameters
Value Type: REG_DWORD—time in milliseconds
Valid Range: 1–0xFFFFFFFF
Default: 7,200,000 (two hours)
Recommendation: 300,000
Description: The parameter controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote system is still reachable and functioning, it acknowledges the keep-alive transmission. Keep-alive packets are not sent by default. This feature may be enabled on a connection by an application.
PerformRouterDiscovery
Key: Tcpip\Parameters\Interfaces\interfaceGUID
Value Type: REG_DWORD
Valid Range: 0, 1, 2
0 (disabled)
1 (enabled)
2 (enable only if DHCP sends the router discover option)
Default: 2, DHCP-controlled but off by default.
Recommendation: 0
Description: This parameter controls whether Windows Server 2003 attempts to perform router discovery per RFC 1256 on a per-interface basis. See also SolicitationAddressBcast.