3

I have a SYN spoofing attack on one of my servers. While there are enough resources available on server (BW, CPU, RAM), new legitimate requests get Request time-out error. It seems backlog queue gets full and new requests get time-out on the queue.

How to enable SYN cookies on windows server 2008 enterprise edition (64-bit)?

Improve this question

2 Answers 2

Reset to default
1

Here is a TechNet post on it:

"As of Windows Vista, SynAttack protection is enabled by default and cannot be disabled... Since TCPIP driver goes into attack state based on the number of CPU cores and the amount of memory available, systems with more resources will start dropping new connection attempts later compared to systems with less resources. That was hard-coded (as per the configured registry settings) on pre-Vista systems where the system was moved to attack state regardless of how much resources were available to the system."

Improve this answer
3
  • So why new requests get time-out while there are still enough resources ?
    – Xaqron
    Aug 3, 2011 at 6:08
  • Microsoft is sometimes a ship of fools. Just because they have SYN protection, it doesn't mean they are using SYN Cookies, as indicated by the words above "will start dropping new connection attempts". Cisco uses SYN cookies in their ASA when intercept takes over, and it will NEVER drop a connection attempt because of it.
    – Brain2000
    Feb 17, 2017 at 4:11
  • 1
    Syn cookies are different than that "SYN Protection" The default syn protection mentioned in that post is packet drop, which should be enabled well after syn cookies kick in. Syn Cookies are a first line connection.
    – Robert Wm Ruedisueli
    Mar 14, 2018 at 17:38
0

If you are using a Linux firewall there are several options for SYN DoS/DDoS protection there, before getting to the Windows server.

First, you can set up a quick reply rule to all unimportant SYN packets, making the firewall reply on the Windows server's behalf. (Non-established connections, you should install over-aggressive keepalive for valid packets. Pretty much all Syn Floods will fall into one of these categories.) You can then set the Syn Cookie threshold on these types of packets.

For standard frequency Keep-alive packets, they too should be quick-replied, but they should also be forwarded, and the server's reply should be caught.

This will essentially use the Linux firewall for your SYN cookie protection (and honestly, the Linux Syn cookie protocol is much better. The Syn cookie protocol on Windows is crap, which is why it's off by default in favor of just dropping packets.)

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .