Windows Server
United States - English
Home
Windows Server “8” Beta
2008
2003
Library
Forums
2 out of 3 rated this helpful - Rate this topic

Stealth Mode in Windows Firewall with Advanced Security

Updated: January 20, 2009

Applies To: Windows Server 2008

Stealth mode is a mechanism in Windows Firewall that helps prevent malicious users from discovering information about network computers and the services that they run.

It is common for an attacker to use an automated scanning process to send query packets to a range of IP addresses. For each IP address, the scanning process sends packets to a range of port numbers, and the response packets are used to identify the services that are installed on the computer. For example, if a computer responds to a UDP query with an ICMP unreachable packet, or to a TCP query with a reset message, then an attacker is able to determine the existence of a computer at that IP address and an open port in Windows Firewall that can be used to reach the computer. The attacker can then use this information to attempt to exploit vulnerabilities.

Stealth mode in Windows Firewall with Advanced Security is designed to help protect against this kind of attack. Stealth mode blocks outgoing ICMP unreachable and TCP reset messages for a port when no application is listening on that port.

Stealth mode is enabled by default on computers that are running Windows Vista®, Windows Server® 2008, Windows® 7, and Windows Server® 2008 R2.

ImportantImportant
Network packets dropped by the stealth mode feature are not logged.

Did you find this helpful?
(1500 characters remaining)
Community Content Add
Annotations FAQ
Stealth Mode can not be disabled,

Based on this link, Stealth Mode could be disabled:

http://msdn.microsoft.com/en-us/library/cc231557(PROT.10).aspx
...

FW_PROFILE_CONFIG_DISABLE_STEALTH_MODE: This value is a DWORD used as an on/off switch. When this option is off, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific.<7> The merge law for this option is to let the value of the Group Policy RSOP store win if it is configured; otherwise, the local store value is used. This symbolic constant has a value of 2.
...

====================

Please take in consideration, that disabling stealth mode is not supported, even if the registry key is working.

The MSDN link it’s a protocol documentation link which is intended for interop across platforms and 3rd party products.

History
Stealth Mode is always Enabled.
Certain elements of the filtering platform are always active, even when the firewall is disabled, including Stealth Mode. There is no supported way to disable stealth mode.
History