HOW TO: Harden the TCP/IP Stack Against Denial of Service Attacks in Windows 2000

SUMMARY

Denial of service attacks are network attacks that are aimed at making a computer or a particular service on a computer unavailable to network users. Denial of service attacks can be difficult to defend against. To help prevent denial of service attacks, you can use one or both of the following methods:

• Keep your computer updated with the latest security fixes. Security fixes are located on the following Microsoft Web site:

  http://support.microsoft.com/www.microsoft.com/security

• Harden the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol stack on Windows 2000-based workstations and servers. The default TCP/IP stack configuration is tuned to handle normal intranet traffic. If you connect a computer directly to the Internet, it is recommended that you harden the TCP/IP stack against denial of service attacks.

back to the top

TCP/IP Registry Values That Harden the TCP/IP Stack

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

The following list describes the TCP/IP-related registry values that you can configure to harden the TCP/IP stack on computers that are directly connected to the Internet. All of these values are located under the following registry key:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

NOTE: All values are in hexadecimal unless otherwise noted.

• Value name: SynAttackProtect
  Key: Tcpip\Parameters
  Value Type: REG_DWORD
  Valid Range: 0,1,2
  Default: 0
  
  This registry value causes Transmission Control Protocol (TCP) to adjust retransmission of SYN-ACKS. When you configure this value, the connection responses time out more quickly in the event of a SYN attack (a type of denial of service attack).
  
  The following list describes the parameters that you can use with this registry value:
  • 0 (default value): Set SynAttackProtect to 0 for typical protection against SYN attacks.
  • 1: Set SynAttackProtect to 1 for better protection against SYN attacks. This parameter causes TCP to adjust the retransmission of SYN-ACKS. When you set SynAttackProtect to 1, connection responses time out more quickly if it appears that there is a SYN attack in progress. Windows uses the following values to determine if an attack is in progress:
    • TcpMaxPortsExhausted
    • TCPMaxHalfOpen
    • TCPMaxHalfOpenRetried
    
    
  • 2: Set SynAttackProtect to 2 for the best protection against SYN attacks. This value adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress. This parameter is the recommended setting.
    
    NOTE: The following socket options no longer work on any socket when you set the SynAttackProtect value to 2:
    • Scalable windows
    • TCP parameters that are configured on each adapter (including Initial RTT and window size)
      
• Value name: EnableDeadGWDetect
  Key: Tcpip\Parameters
  Value Type: REG_DWORD
  Valid Range: 0, 1 (False, True)
  Default: 1 (True)
  
  The following list describes the parameters that you can use with this registry value:
  • 1: When you set EnableDeadGWDetect to 1, TCP is allowed to perform dead-gateway detection. When dead-gateway detection is enabled, TCP may ask the Internet Protocol (IP) to change to a backup gateway if a number of connections are experiencing difficulty. Backup gateways are defined in the Advanced section of the TCP/IP configuration dialog box in Network Control Panel.
  • 0: It is recommended that you set EnableDeadGWDetect to 0. If you do not set this value to 0, an attack could force the server to switch gateways and cause it to switch to an unintended gateway.
• Value name: EnablePMTUDiscovery
  Key: Tcpip\Parameters
  Value Type: REG_DWORD
  Valid Range: 0, 1 (False, True)
  Default: 1 (True)
  
  The following list describes the parameters that you can use with this registry value:
  • 1: When you set EnablePMTUDiscovery to 1, TCP attempts to discover either the maximum transmission unit (MTU) or then largest packet size over the path to a remote host. TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs by discovering the path MTU and limiting TCP segments to this size. Fragmentation adversely affects TCP throughput.
  • 0: It is recommended that you set EnablePMTUDiscovery to 0. When you do so, an MTU of 576 bytes is used for all connections that are not hosts on the local subnet. If you do not set this value to 0, an attacker could force the MTU value to a very small value and overwork the stack.
• Value name: KeepAliveTime
  Key: Tcpip\Parameters
  Value Type: REG_DWORD-Time in milliseconds
  Valid Range: 1-0xFFFFFFFF
  Default: 7,200,000 (two hours)
  
  This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote computer is still reachable, it acknowledges the keep-alive packet. Keep-alive packets are not sent by default. You can use a program to configure this value on a connection. The recommended value setting is 300,000 (5 minutes).
• Value name: NoNameReleaseOnDemand
  Key: Netbt\Parameters
  Value Type: REG_DWORD
  Valid Range: 0, 1 (False, True)
  Default: 0 (False)
  
  This value determines whether the computer releases its NetBIOS name when it receives a name-release request. This value was added to allow the administrator to protect the computer against malicious name-release attacks. It is recommended that you set the NoNameReleaseOnDemand value to 1 (the default value).
  
  NOTE: You must be using Windows 2000 Service Pack 2 (SP2) or later to use the NoNameReleaseOnDemand value.

back to the top

Troubleshooting

When you change the TCP/IP registry values, you may affect programs and services that are running on the Windows 2000-based computer. It is recommended that you test these settings on non-production workstations and servers to confirm that they are compatible with your business environment.

back to the top