up vote 1 down vote favorite
share [g+] share [fb]

I have a SYN spoofing attack on one of my servers. While there are enough resources available on server (BW, CPU, RAM), new legitimate requests get Request time-out error. It seems backlog queue gets full and new requests get time-out on the queue.

How to enable SYN cookies on windows server 2008 enterprise edition (64-bit)?

link|improve this question
40% accept rate
feedback

1 Answer

up vote 0 down vote

Here is a TechNet post on it:

"As of Windows Vista, SynAttack protection is enabled by default and cannot be disabled... Since TCPIP driver goes into attack state based on the number of CPU cores and the amount of memory available, systems with more resources will start dropping new connection attempts later compared to systems with less resources. That was hard-coded (as per the configured registry settings) on pre-Vista systems where the system was moved to attack state regardless of how much resources were available to the system."

link|improve this answer
So why new requests get time-out while there are still enough resources ? – Xaqron Aug 3 '11 at 6:08
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.