Protect Against SYN Attacks
A SYN attack exploits a vulnerability in the TCP/IP connection establishment mechanism. To mount a SYN flood attack, an attacker uses a program to send a flood of TCP SYN requests to fill
the pending connection queue on the server. This prevents other users from establishing network connections.
The SYN flooding attack protection feature of TCP detects symptoms of denial-of-service attacks and it responds by reducing the time the server spends on connection requests that it cannot
acknowledge.
This property applies to Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1, Windows Server 2003 with SP2
To protect the network against SYN attacks, follow these generalized steps, explained later in this document:
- Enable SYN attack protection
- Set SYN protection thresholds
- Set additional protections
- Enable SYN Attack Protection
The named value to enable SYN attack protection is located beneath the registry key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters.
Value name:
SynAttackProtect
Recommended value: 2
Valid values: 0, 1, 2
Description: Causes TCP to adjust retransmission of SYN-ACKS. When you configure this value the connection responses timeout
more quickly in the event of a SYN attack. A SYN attack is triggered when the values of
TcpMaxHalfOpen or TcpMaxHalfOpenRetried are exceeded.
Set SYN Protection Thresholds
The following values determine the thresholds for which SYN protection is triggered. All of the keys and values in this section are under the registry key
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters. These keys and values are:
- Value name:
TcpMaxPortsExhausted
- Recommended value: 5
- Valid values: 0–65535
- Description: Specifies the threshold of TCP connection requests that must be exceeded before SYN flood protection is triggered.
- Value name:
TcpMaxHalfOpen
- Recommended value data: 500
- Valid values: 100–65535
- Description: When
SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state. When
SynAttackProtect is exceeded, SYN flood protection is triggered.
- Value name:
TcpMaxHalfOpenRetried
- Recommended value data: 400
- Valid values: 80–65535
- Description: When
SynAttackProtect is enabled, this value specifies the threshold of TCP connections in the SYN_RCVD state for which at least one retransmission has been sent. When
SynAttackProtect is exceeded, SYN flood protection is triggered.
