SP 52043: Set the SYN Attack “TcpMaxPortsExausted” parameter in Windows
Symptom: There are many symptoms to a SYN attack. As an example, a client with hostile intent sends as many SYN packets as possible (maybe thousands per second or even much, much more) and instead of using the correct 'from address' in the SYN packet they just make one up. This is called 'address spoofing'.
Resolution: Modify the system registry settings to set the “TcpMaxPortsExausted” setting to 5.
Additional Information: The “TcpMaxPortsExausted” registry entry defines the number of dropped SYN requests, after which the protection against SYN attacks starts to operate.
Category:
Security
