Internet Server Unavailable Because of Malicious SYN Attacks

• Microsoft Windows NT Server versions 3.51 and 4.0

SYMPTOMS

On your computer running the TCP/IP protocol and connected to the Internet, some or all network services are rendered unavailable and error messages such as the following appear on the network client screen:

   The connection has been reset by the remote host.

CAUSE

Your computer has become the target of a malicious attack known as TCP/IP "SYN Flooding" or "SYN Attacks."

"Computer hackers" can target an entire machine, or a specific TCP service such as web services. The attack is focused on the TCP protocol used by all computers on the Internet, and is not specific to the Windows NT operating system.

How SYN Flooding Works

SYN Flooding works as follows: (see also CERT(sm) Advisory CA-96.21 at ftp://info.cert.org/pub/cert_advisories)

• A TCP connection request (SYN) is sent to the target computer. The source IP address in the packet is "spoofed," or replaced with an address that is not in use on the Internet, or that belongs to another computer. An attacker will send many of these TCP SYNs to tie up as many resources as possible on the target computer.
• Upon receiving the connection request, the target computer allocates resources to handle and track the new connection, then responds with a "SYN-ACK". In this case, the response is sent to the "spoofed" non- existent IP address.
• No response is received to the SYN-ACK. A default-configured Windows NT 3.5x or 4.0 computer will retransmit the SYN-ACK 5 times, doubling the time-out value after each retransmission. The initial time-out value is three seconds, so retries are attempted at 3, 6, 12, 24, and 48 seconds. After the last retransmission, 96 seconds are allowed to pass before the computer gives up on receiving a response, and deallocates the resources that were set aside earlier for the connection. The total elapsed time that resources are in use is 189 seconds.

How to Verify Your Computer is Under a SYN Attack

If you suspect that your computer is the target of a SYN attack, you can type the following command at a command prompt to view connections in the "SYN_RECEIVED" state:

   netstat -n -p tcp

   Active Connections

      Proto  Local Address         Foreign Address       State
      TCP    127.0.0.1:1030        127.0.0.1:1032        ESTABLISHED
      TCP    127.0.0.1:1032        127.0.0.1:1030        ESTABLISHED
      TCP    10.57.8.190:21        10.57.14.154:1256     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1257     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1258     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1259     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1260     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1261     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1262     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1263     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1264     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1265     SYN_RECEIVED
      TCP    10.57.8.190:21        10.57.14.154:1266     SYN_RECEIVED
      TCP    10.57.8.190:4801      10.57.14.221:139      TIME_WAIT

The effect of tying up connection resources varies, depending upon the TCP/IP stack and applications listening on the TCP port. For most stacks, there is a limit on the number of connections that can be in the half-open (SYN_RECEIVED) state. Once the limit is reached for a given TCP port, the target computer responds with a reset to all further connection requests until resources are freed.

RESOLUTION

Obtain the following update for Windows NT 3.51 or the latest Service Pack for Windows NT 4.0

Microsoft is committed to providing the best possible protection against these attacks from within the Windows NT operating system and has made a number of changes to its TCP/IP components available to customers in response to this threat.

The changes in the update can be applied individually, or all at once, as deemed necessary.

The changes are listed here:

*******************************************************************

*  1. Tcpip.sys times out half-open connections faster            *

A new version of Tcpip.sys has been produced that allows control of the number of times a response to a TCP connection request (SYN-ACK) will be retransmitted. Control is handled through a new registry parameter:

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \Tcpip
      \Parameters
       \TcpMaxConnectResponseRetransmissions
           Value Type: REG_DWORD
           Valid Range: 0-0xFFFFFFFF
           Default: 3

Value  Retransmission Times   Elapsed Time  Comments

3      3, 6, and 12 seconds   45 seconds    Cleanup 24 secs after last
retx
2      3, and 6 seconds       21 seconds    Cleanup 12 secs after last
retx
1      3 seconds              9  seconds    Cleanup 6  secs after last
retx

*******************************************************************

*  2. NetBT has a Higher, Configurable Backlog                    *

NetBT (NetBIOS over TCP/IP) uses TCP port 139 and is used by Microsoft Network Services such as file and print sharing. Version 3.51 and 4.0 NetBT has a "backlog" of connection blocks available that is two plus an incremental number depending on the NetBT clients (such as the redirector, server, and any NetBIOS applications running). On a typical server, this number will be 7-11. A new version of NetBT has been produced that automatically allocates more connection blocks as needed, in a configurable manner.

On a connection event, it now checks to see if the number of free blocks is below 2, and if so, adds an "increment" number of blocks, where "increment" is configurable in the registry as shown here:

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \NetBt
      \Parameters
       \BacklogIncrement
           Value Type: REG_DWORD
           Valid Range: 1-0x14  (1-20 decimal)
           Default: 3

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \NetBt
      \Parameters
       \MaxConnBackLog
           Value Type: REG_DWORD
           Valid Range: 1-0x9c40 (1-40,000 decimal)
           Default: 1000

*******************************************************************

*  3. Afd.sys has been modified to withstand large numbers of     *
*     "half-open" connections efficiently                         *

Windows Sockets applications such as ftp servers and web servers have their connection attempts handled by Afd.sys. Afd.sys has been modified to support large numbers of connections in the "half-open" state without denying access to legitimate clients. This is accomplished by allowing the administrator to configure a dynamic backlog.

The new version of Afd.sys supports four new registry parameters that can be used to control the dynamic backlog behavior.

EnableDynamicBacklog is a global switch to enable or disable dynamic backlog. It defaults to 0 (off), and this setting provides no change from the existing versions. Setting it to 1 enables the new dynamic backlog feature.

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \AFD
      \Parameters
       \EnableDynamicBacklog
           Value Type: REG_DWORD
           Valid Range: 0,1
           Default: 0
           Suggested value for a system under heavy attack: 1

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \AFD
      \Parameters
       \MinimumDynamicBacklog
           Value Type: REG_DWORD
           Valid Range: 0-0xFFFFFFFF
           Default: 0
           Suggested value for a system under heavy attack: 20

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \AFD
      \Parameters
       \MaximumDynamicBacklog
           Value Type: REG_DWORD
           Valid Range: 0-0xFFFFFFFF
           Default: 0
           Suggested value for a system under heavy attack: Memory
           dependent. This value should not exceed 5000 for each 32 MB of
           RAM installed in the server, in order to prevent exhaustion of
           non-paged pool when under attack.

  HKEY_LOCAL_MACHINE
  \SYSTEM
   \CurrentControlSet
    \Services
     \AFD
      \Parameters
       \DynamicBacklogGrowthDelta
           Value Type: REG_DWORD
           Valid Range: 0-0xFFFFFFFF
           Default: 0
           Suggested value for a system under heavy attack: 10 (0xa)

To take advantage of the changes to Afd.sys, Windows Sockets applications must specifically request a backlog greater than the value configured for MinimumDynamicBacklog when they issue their listen() call. Microsoft applications such as Internet Information Server (which has a default backlog of 25) are configurable. Application-specific details are available from the Microsoft Knowledgebase at http://www.microsoft.com/kb.

The modified drivers for Windows NT and instructions for installing them are available from Microsoft support channels or directly from the following Internet locations:

For Windows NT 3.51:

   ftp://ftp.microsoft.com/bussys/winnt
      /winnt-public/fixes/usa/nt351/hotfixes-postsp5/syn-attack

STATUS

Microsoft has confirmed the TCP/IP protocol in Windows NT versions 3.51 and 4.0 to be vulnerable to these attacks.

This problem has been corrected in the latest Microsoft Windows NT U.S. Service Pack for Windows NT 4.0. For information on obtaining the Service Pack, query on the following word in the Microsoft Knowledge Base (without the spaces):

   S E R V P A C K