How to enable SYN attack prevention at the Windows operating system level

SYN (synchronous) is a handshake signal that is used when TCP/IP establishes a connection. When a normal TCP network connection is established between the client and the server, the client first emits a SYN message, the server uses the Syn+ack answer to receive the message, and the last client responds with an ACK message. This allows reliable TCP connections to be established between the client and the server, and data can be passed between the client and the server.

The SYN attack exploits the TCP protocol flaw, sends a large number of forged TCP connection requests, and makes the exploited resource run out of resources, unable to respond or process the normal service request in time.

The following describes a method for preventing SYN attacks at the Windows operating system level by modifying the registry to limit the number of TCP semi-connections and the time of the Half-open connection.

Enable SYN attack protection

At the beginning-> run-> type regedit, under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, The value name is SynAttackProtect and the recommended value is 2

Specifies the number of TCP connection requests that must be exceeded for triggering SYN flood attack protection threshold 5

At the beginning-> run-> type regedit, under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, The value name is tcpmaxportsexhausted and the recommended value is 5

Specifies a threshold of 500 for the number of TCP connections in the SYN_RCVD state

At the beginning-> run-> type regedit, under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, The value name is TcpMaxHalfOpen and the recommended value is 500

Specifies a threshold of 400 for the number of TCP connections in the SYN_RCVD state in which the retransmission has been sent at least once.

At the beginning-> run-> type regedit, under the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters, The value name is tcpmaxhalfopenretried and the recommended value is 400

This column more highlights: http://www.bianceng.cnhttp://www.bianceng.cn/Network/Security/