Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am new to implementing information security. However i am trying to harden a windows server.I am using regedit to create parameters like SynAttackProtect,TcpMaxHalfOpen and TcpMaxHalfOpenRetried and set values to them. But i am not sure if this is a good way to do it. As in i browsed to this location HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TcpIp\Parameters and manually adding these parameters. Kindly suggest if this is okay

share|improve this question

1 Answer 1

up vote 1 down vote accepted

Completely preventing TCP SYN flood attacks is impossible; the best you can do is to mitigate them. Those registry settings are a valid option and may help you if you are under a weak or mild SYN flood attack. They work by simply limiting the duration and amount of half open connections when undergoing the symptoms of a SYN flood. In other words it makes the server less patient in waiting for the client to complete the three-way handshake (i.e. completing the connection).

Here are a few other common defenses to help mitigate SYN flood attacks:

  1. Increasing the server(s) resources (e.g. adding more memory, or more servers for load balancing)

  2. If filtering IP addresses is an option, this would be the most effective approach. For example, if you know your website will only be used by a certain IP address range (or geographical location) you could filter the IP addresses that are allowed to connect. A white-list of IP addresses of known legitimate clients could also be used to give higher priority to those connections.

  3. You could also check out SYN Cookies which is a creative mitigation method that could help as well.

For additional reading on these SYN flood mitigation methods, I suggest reading section 3 of RFC 4987

Hope this helps!

share|improve this answer
    
thanks for the comment. Pls comment about the way i am editing the registry values. is it a good way? –  shiva Oct 13 '13 at 5:35
    
shiva, your way is fine, but any time you modify anything in the registry, it is always a good idea to back it up first (right click the item and select Export). The following MSDN link goes into detail about how to change these registry values: msdn.microsoft.com/en-us/library/ee377058%28v=bts.10%29.aspx –  ansichart Oct 14 '13 at 22:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.