RRAS Could Forward IP Fragments Without Filtering

ID: Q189099

The information in this article applies to:

Microsoft Routing & Remote Access Service Update for Windows NT Server version 4.0
Microsoft Windows NT Server version 4.0

IMPORTANT: This article contains information about editing the registry. Before you edit the registry, make sure you understand how to restore it if a problem occurs. For information about how to do this, view the "Restoring the Registry" Help topic in Regedit.exe or the "Restoring a Registry Key" Help topic in Regedt32.exe.

SYMPTOMS

If you enable packet filtering on an interface in the Microsoft Routing and Remote Access Service Update for Windows NT (RRAS), IP fragments could be forwarded without being filtered.

CAUSE

RRAS filters are "stateless." Therefore, no matter how the filter is defined, it is possible that an unwanted fragment will be forwarded. For RRAS to drop unwanted fragments, it must keep track of the protocol state, from packet to packet, for each routed conversation.

RESOLUTION

To resolve this problem, obtain the latest service pack for Windows NT 4.0. For additional information, please see the following article in the Microsoft Knowledge Base:

Q152734 How to Obtain the Latest Windows NT 4.0 Service Pack

NOTE: If this product was already installed on your computer when you purchased it from the Original Equipment Manufacturer (OEM) and you need this fix, please call the Pay Per Incident number listed on the above Web site. If you contact Microsoft to obtain this fix, and if it is determined that you only require the fix you requested, no fee will be charged. However, if you request additional technical support, and if your no-charge technical support period has expired, or if you are not eligible for standard no-charge technical support, you may be charged a non-refundable fee.

For more information about eligibility for no-charge technical support, see the following article in the Microsoft Knowledge Base:

Q154871 Determining If You Are Eligible for No-Charge Technical Support

After you apply the service pack, make the following registry changes to use the new filter capabilities:

WARNING: Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk.

For information about how to edit the registry, view the "Changing Keys and Values" Help topic in Registry Editor (Regedit.exe) or the "Add and Delete Information in the Registry" and "Edit Registry Data" Help topics in Regedt32.exe. Note that you should back up the registry before you edit it. If you are running Windows NT, you should also update your Emergency Repair Disk (ERD).

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPFilterDriver \Parameters

NOTE: The above registry key is one path; it has been wrapped for readability.

Add the following values to the above Registry key:

DefaultForwardFragments - REG_DWORD = 0 (Decimal)

Setting this to "0" causes the filterdriver to drop fragments if they don't match a previous header.

EnableFragmentChecking - REG_DWORD = 1 (Decimal)

Setting this to "1" enables fragment checks.

NOTE: Even with this new filter update properly installed, it is possible for unwanted fragments to be forwarded through the router.

Additional query words: ntrouter

Keywords : ntras kbbug4.00
Version : WinNT:4.0
Platform : winnt
Issue type : kbbug