Export (0) Print
Expand All

TcpMaxHalfOpen

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Data type

Range

Default value

REG_DWORD

0x64–0xFFFF ( connections )

Windows NT Server: 0x64 ( 100 ) Windows NT Workstation: 0x1F4 ( 500 )

Description

Determines how many connections the server can maintain in the half-open (SYN-RCVD) state before TCP/IP initiates SYN flooding attack protection . This entry is used only when SYN flooding attack protection is enabled on this server, that is, when the value of the SynAttackProtect entry is 1 and the value of the TcpMaxConnectResponseRetransmissions entry is at least 2.

This entry establishes one of three configurable thresholds that, if exceeded, trigger TCP's SYN attack flooding protection feature. Because SYN flooding often results in many half-open connections, TCP interprets an elevated number of half-open connections to be a symptom of SYN flooding.

The other two thresholds are:

  • The number of connections that remain in the half-open (SYN-RCVD) state even after a connection request has been retransmitted exceeds the value of the TcpMaxHalfOpenRetried entry.

  • The number of connection requests that the system refuses exceeds the value of the TcpMaxPortsExhausted entry. The system must refuse all connection requests when its reserve of open connection ports runs out.

Note Image Note

The value of this entry should be greater than the value of the TCPMaxHalfOpenRetried entry.

Windows 2000 does not add this entry to the registry. You can add it by editing the registry or by using a program that edits the registry.

Related Entries

Page Image

SynAttackProtect

Page Image

TcpMaxConnectResponseRetransmissions

Page Image

TCPMaxHalfOpenRetried

Page Image

TcpMaxPortsExhausted

Was this page helpful?
(1500 characters remaining)
Thank you for your feedback
Show:
© 2014 Microsoft