Harden the TCP/IP Stack for Denial of Service Attacks
Denial of service attacks are network attacks that are aimed at making a computer or a particular service unavailable to network users. These settings can be used to increase the ability for Windows to defend against these attacks when connected directly to the Internet.
Open your registry and find the key below.
Create the following DWORD values and set them according to the table below.
EnableDeadGWDetect = "0" (default = 1)
Disables dead-gateway detection as an attack could force the server to switch gateways.
EnableICMPRedirect = "0" (default = 1)
Stops Windows from altering its route table in response to ICMP redirect messages. Some documentation has this listed as "EnableICMPRedirects" but according to Microsoft it should be "EnableICMPRedirect" no "s".
EnablePMTUDiscovery = "0" (default = 1)
Disables maximum transmission unit (MTU) discovery as an attacker could force the MTU value to a very small value and overwork the stack.
KeepAliveTime = "300,000" (default = 7,200,000)
Reduces how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.
NoNameReleaseOnDemand = "1" (default = 0)
Protects the computer against malicious NetBIOS name-release attacks.
PerformRouterDiscovery = "0" (default = 1)
Disables ICMP Router Discovery Protocol (IRDP) where an an attacker may remotely add default route entries on a remote system.
SynAttackProtect = "2" (default = 0)
Automatically adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress.
Restart Windows for the changes to take effect.
Note: These values will not give the best performance due to additional checking and less optimization, but they will provide greater protection against attacks.
Settings:
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
Name: EnableDeadGWDetect, EnableICMPRedirect, EnablePMTUDiscovery, KeepAliveTime, NoNameReleaseOnDemand, PerformRouterDiscovery, SynAttackProtect
Type: REG_DWORD (DWORD Value)
Open your registry and find the key below.
Create the following DWORD values and set them according to the table below.
EnableDeadGWDetect = "0" (default = 1)
Disables dead-gateway detection as an attack could force the server to switch gateways.
EnableICMPRedirect = "0" (default = 1)
Stops Windows from altering its route table in response to ICMP redirect messages. Some documentation has this listed as "EnableICMPRedirects" but according to Microsoft it should be "EnableICMPRedirect" no "s".
EnablePMTUDiscovery = "0" (default = 1)
Disables maximum transmission unit (MTU) discovery as an attacker could force the MTU value to a very small value and overwork the stack.
KeepAliveTime = "300,000" (default = 7,200,000)
Reduces how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.
NoNameReleaseOnDemand = "1" (default = 0)
Protects the computer against malicious NetBIOS name-release attacks.
PerformRouterDiscovery = "0" (default = 1)
Disables ICMP Router Discovery Protocol (IRDP) where an an attacker may remotely add default route entries on a remote system.
SynAttackProtect = "2" (default = 0)
Automatically adds additional delays to connection indications, and TCP connection requests quickly timeout when a SYN attack is in progress.
Restart Windows for the changes to take effect.
Note: These values will not give the best performance due to additional checking and less optimization, but they will provide greater protection against attacks.
Settings:
System Key: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
Name: EnableDeadGWDetect, EnableICMPRedirect, EnablePMTUDiscovery, KeepAliveTime, NoNameReleaseOnDemand, PerformRouterDiscovery, SynAttackProtect
Type: REG_DWORD (DWORD Value)