Endpoint Protection

As you all might know, DoS is typically a kind of attack where the attacker repeatedly send SYN packets to you. When you have a Firewall or IPS you can be sure of protection. Without a Firewall, you can still enable protection and I will be speaking more about this in this post.

You should have heard about the TCP/IP service in Windows. By making a change in TCP/IP service we are going to enable DoS protection.

1. 
   
   Run regedit.exe
2. Navigate to the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters registry subkey.
3. From the Edit menu, select New, DWORD Value.
4. Enter the name TcpMaxHalfOpen, then press Enter.
5. Double-click the new value, set it to 100, then click OK.
6. Enter the name TcpMaxHalfOpenRetried, then press Enter.
7. Double-click the new value, set it to 80, then click OK.
8. Enter the name SynAttackProtect, then press Enter.
9. Double-click the new value, set it to 1, then click OK.
10. Reboot the machine.

When SynAttackProtect value is 0, it offers no protection. Value 1 indicate to delay the response Notification untill three way handshake is complete by the received by the SYN packet. By default, this is not invoke untill it exceeds the TcpMaxHalfOpen and TcpMaxHalfOpenRetried values. The values TcpMaxHalfOpen and TcpMaxHalfOpenRetried could be changed, and I strongly recommend to test with different settings in your environment, then choose the best ones.