Security Considerations for Network Attacks
| Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist. |
In the connected world of the Internet, a few malicious individuals can translate into major network security concerns for administrators with systems exposed to public networks. The recent denial of service attacks on many of the web's most popular sites makes this clearer than ever before. Many of these attacks generate large volumes of TCP/IP traffic. Commonly the targeted site may seem unavailable to the broader Internet because of the saturation of its network segment. Internally, however, the web servers may hardly seem affected by the attack.
Microsoft's TCP/IP stack, part of the Windows-family of operating systems, has been tested and proven reliable against many attacks and in its default state handles the most common types. In addition to these built-in capabilities, there are several common sense steps that can be taken to lower the vulnerability of a website to these and other network attacks:
Monitor networks boundaries for attacks. Many third party companies offer tools that can detect these types of attacks. (an intrusion detection tool that is widely used can be found at https://www.iss.net/)
Ensure that routers are not converting layer 3 broadcasts into layer 2 broadcasts. The Cisco command to disable this is: no ip directed-broadcast. This is the default setting for routers that use IOS version 12.0 or greater.
Restrict routers to allow only the use of ports that are necessary for the site to function.
Disable unnecessary or optional services (i.e.: Client for Microsoft Networks on a IIS server)
Enable TCP/IP filtering and restrict access to only the ports that are necessary for the server to function. (see Knowledge Base article **150543:**WinNT, Terminal Server, & ExchangeServicesUseTCP/IPPorts for a list of ports that Windows services use)
Unbind NetBIOS over TCP/IP where it is not needed.
Configure static IP addresses and parameters for public adapters.
Configure registry settings for maximum protection
Follow the steps for configuring Windows NT and IIS described in the IIS 4.0 Security Checklist
Consult Microsoft security web site regularly for security bulletins at https://www.microsoft.com/technet/security/default.mspx.
On This Page
Registry Settings for Maximum Protection from Network Attack
References
Registry Settings for Maximum Protection from Network Attack
The following registry settings will help to increase the resistance of the NT or Windows 2000 network stack to network denial of service attacks.
SynAttackProtect
Key: Tcpip\Parameters
Value Type: REG_DWORD
Valid Range: 0, 1, 2
0 (no synattack protection)
1 (reduced retransmission retries and delayed RCE (route cache entry) creation if the TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are satisfied.)
2 (in addition to 1 a delayed indication to Winsock is made.)
Note: When the system finds itself under attack the following options on any socket can no longer be enabled : Scalable windows (RFC 1323) and per adapter configured TCP parameters (Initial RTT, window size). This is because when protection is functioning the route cache entry is not queried before the SYN-ACK is sent and the Winsock options are not available at this stage of the connection.
Default: 0 (False)
Recommendation: 2
Description: Synattack protection involves reducing the amount of retransmissions for the SYN-ACKS, which will reduce the time for which resources have to remain allocated. The allocation of route cache entry resources is delayed until a connection is made. If synattackprotect = 2, then the connection indication to AFD is delayed until the three-way handshake is completed. Also note that the actions taken by the protection mechanism only occur if TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are exceeded.
TcpMaxHalfOpen
Key: Tcpip\Parameters
Value Type: REG_DWORD—Number
Valid Range: 100–0xFFFF
Default: 100 (Professional, Server), 500 (advanced server)
Recommendation: default
Description: This parameter controls the number of connections in the SYN-RCVD state allowed before SYN-ATTACK protection begins to operate. If SynAttackProtect is set to 1, ensure that this value is lower than the AFD listen backlog on the port you want to protect(see Backlog Parameters for more information) . See the SynAttackProtect parameter for more details.
TcpMaxHalfOpenRetried
Key: Tcpip\Parameters
Value Type: REG_DWORD—Number
Valid Range: 80–0xFFFF
Default: 80 (Professional, Server), 400 (Advanced Server)
Recommendation: default
Description: This parameter controls the number of connections in the SYN-RCVD state for which there has been at least one retransmission of the SYN sent, before SYN-ATTACK attack protection begins to operate. See the SynAttackProtect parameter for more details.
EnablePMTUDiscovery
Key: Tcpip\Parameters
Value Type: REG_DWORD—Boolean
Valid Range: 0, 1 (False, True)
Default: 1 (True)
Recommendation: 0
Description: When this parameter is set to 1 (True) TCP attempts to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote host. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path that connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion. Setting this parameter to 0 causes an MTU of 576 bytes to be used for all connections that are not to hosts on the local subnet.
NoNameReleaseOnDemand
Key: Netbt\Parameters
Value Type: REG_DWORD—Boolean
Valid Range: 0, 1 (False, True)
Default: 0 (False)
Recommendation: 1
Description: This parameter determines whether the computer releases its NetBIOS name when it receives a name-release request from the network. It was added to allow the administrator to protect the machine against malicious name-release attacks.
EnableDeadGWDetect
Key: Tcpip\Parameters
Value Type: REG_DWORD—Boolean
Valid Range: 0, 1 (False, True)
Default: 1 (True)
Recommendation: 0
Description: When this parameter is 1, TCP is allowed to perform dead-gateway detection. With this feature enabled, TCP may ask IP to change to a backup gateway if a number of connections are experiencing difficulty. Backup gateways may be defined in the Advanced section of the TCP/IP configuration dialog in the Network Control Panel. See the "Dead Gateway Detection" section in this paper for details.
KeepAliveTime
Key: Tcpip\Parameters
Value Type: REG_DWORD—Time in milliseconds
Valid Range: 1–0xFFFFFFFF
Default: 7,200,000 (two hours)
Recommendation: 300,000
Description: The parameter controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet. If the remote system is still reachable and functioning, it acknowledges the keep-alive transmission. Keep-alive packets are not sent by default. This feature may be enabled on a connection by an application.
PerformRouterDiscovery
Key: Tcpip\Parameters\Interfaces\Value Type: REG_DWORD
Valid Range: 0,1,2
0 (disabled)
1 (enabled)
2 (enable only if DHCP sends the router discover option)
Default: 2, DHCP-controlled but off by default.
Recommendation: 0
Description: This parameter controls whether Windows 2000 attempts to perform router discovery per RFC 1256 on a per-interface basis. See also SolicitationAddressBcast.
EnableICMPRedirects
Key: Tcpip\Parameters
Value Type: REG_DWORD
Valid Range: 0, 1 (False, True)
Default: 1 (True)
Recommendation: 0 (False)
Description: This parameter controls whether Windows 2000 will alter its route table in response to ICMP redirect messages that are sent to it by network devices such as a routers.
References
Cisco IP Addressing Commands
Network Ingress Filtering: Defeating Denial of Service Attacks which employ IP Source Address Spoofing
The Latest in Denial of Service Attacks: "Smurfing" Description and Information to Minimize Effects
The "stacheldraht" distributed denial of service attack tool
CERT® Advisory CA-2000-01 Denial-of-Service Developments