Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

syncattackprotect

Posted on 2010-09-24
8
Medium Priority
?
352 Views
Last Modified: 2012-05-10
how can i check what is the status on this in the OS? what is the recommended setting on this?

thanks
0
Comment
Question by:anushahanna
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 4
8 Comments
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 33755565
Do you mean Syn Attack DoS?
http://support.microsoft.com/kb/324270

"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
NOTE: All values are in hexadecimal unless otherwise noted.

    * Value name: SynAttackProtect
      Key: Tcpip\Parameters
      Value Type: REG_DWORD
      Valid Range: 0,1
      Default: 0

      This registry value causes Transmission Control Protocol (TCP) to adjust retransmission of SYN-ACKS. When you configure this value, the connection responses time out more quickly during a SYN attack (a type of denial of service attack).

      The following parameters can be used with this registry value:
          o 0 (default value): No SYN attack protection
          o 1: Set SynAttackProtect to 1 for better protection against SYN attacks. This parameter causes TCP to adjust the retransmission of SYN-ACKS. When you set SynAttackProtect to 1, connection responses time out more quickly if the system detects that a SYN attack is in progress. Windows uses the following values to determine whether an attack is in progress:
                + TcpMaxPortsExhausted
                + TCPMaxHalfOpen
                + TCPMaxHalfOpenRetried
      Note In Windows Server 2003 Service Pack 1, the default value for the SynAttackProtect registry entry is 1.
"
0
 
LVL 6

Author Comment

by:anushahanna
ID: 33756487
Razmus,
I do not see SynAttackProtect option under
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
or
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

does that mean it is just not set up.

thanks
0
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 33756604
Yes, I believe that would mean it's not set up.
Has the server not yet received SP1?
0
Veeam Task Manager for Hyper-V

Task Manager for Hyper-V provides critical information that allows you to monitor Hyper-V performance by displaying real-time views of CPU and memory at the individual VM-level, so you can quickly identify which VMs are using host resources.

 
LVL 6

Author Comment

by:anushahanna
ID: 33756687
it is at Enterprise 2003 OS with SP2.

it has to be manually setup?
0
 
LVL 30

Expert Comment

by:Rich Weissler
ID: 33756724
In that case, no... if you are post SP1, the default is protection enabled.
0
 
LVL 6

Author Comment

by:anushahanna
ID: 33756843
>>if you are post SP1, the default is protection enabled.

and it will not be seen in registry, either?
0
 
LVL 30

Accepted Solution

by:
Rich Weissler earned 2000 total points
ID: 33756907
Yes.
This article: http://support.microsoft.com/kb/910229 references an issue with windows 2003, when the SP is installed.
"To resolve this issue, use the regedit.exe utility to add a new DWORD value named SynAttackProtect to the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\ with value data of 00000000. "
Specifies specifically ADDING the key to the registry to be able to turn the feature off... the value defaults to 1 (on) if the key is missing.
0
 
LVL 6

Author Comment

by:anushahanna
ID: 33756968
Thanks a bunch my friend.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Scenerio: You have a server running Server 2003 and have applied a retail pack of Terminal Server Licenses.  You want to change servers or your server has crashed and you need to reapply the Terminal Server Licenses. When you enter the 16-digit lic…
While rebooting windows server 2003 server , it's showing "active directory rebuilding indices please wait" at startup. It took a little while for this process to complete and once we logged on not all the services were started so another reboot is …
This tutorial will teach you the special effect of super speed similar to the fictional character Wally West aka "The Flash" After Shake : http://www.videocopilot.net/presets/after_shake/ All lightning effects with instructions : http://www.mediaf…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…

670 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question