Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

This question already has an answer here:

I would like to make sure that my Windows 2008 servers are hardened against DDOS attacks.

There is a Microsoft Technet article on Hardening the TCP/IP stack, but it was last revised in January 2006. There is another article (somewhat duplicative) specifically for Windows Server 2003, but I can't find one for Windows Server 2008.

Does anyone know if these protections are already in place in Windows Server 2008's TCP/IP stack or if they are still relevant?

I found a portion of a book on Safari called Windows Server 2008 TCP/IP Protocols and Services that read:

TCP in Windows Server 2008 and Windows Vista use SYN attack protection to prevent a SYN attack from overwhelming the computer.

and

TCP in Windows Server 2008 and Windows Vista no longer supports the TcpMaxConnectResponseRetransmissions, SynAttackProtect, TcpMaxHalfOpen, and TcpMaxHalfOpenRetried registry values.

...but I can't find a mention of the other registry values nor a second source for this information.

share|improve this question

marked as duplicate by Tom O'Connor Aug 25 '13 at 22:19

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers 2

up vote 4 down vote accepted

They re-wrote the TCP/IP stack in Vista/2008 and included many security related changes.

You may be interested in reading the "Next Generation TCP/IP Stack" document from Microsoft as it contains links to the new registry settings, enhancements & security protections and others.

share|improve this answer
    
Did you see anything on security? The link you linked to mentioned performance enhancements only (as far as I saw). –  Adam Brand Jul 20 '09 at 22:36

Check out the DISA / NSA Windows 2008 Server Security and Technical Implementation Guide (STIG) here (Scroll down for Windows guides): DISA IASE Site

The STIG has a number of security tweeks and registry changes designed to harden your network stack (and local machine in general).

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.