Adjust TCP SYN Attack Thresholds in Regedit

This guide explains how to configure system-wide TCP SYN-flood attack protection thresholds in Windows using the Registry Editor (Regedit). By modifying specific TCP/IP parameters, administrators can harden the operating system against Denial of Service (DoS) attacks by controlling how the network stack responds to half-open connections and setting triggers for protective defenses.

Step 1: Open the Registry Editor

1. Press Win + R, type regedit, and press Enter.

2. If prompted by User Account Control (UAC), click Yes.

3. In the navigation bar, navigate to the following path:

   HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Step 2: Enable SYN Attack Protection

To enable the mechanism that handles SYN flood mitigation:

1. Right-click the Parameters key, select New > DWORD (32-bit) Value.
2. Name the value SynAttackProtect.
3. Double-click the newly created value and set the Value data to one of the following:
   • 0: Protection disabled.
   • 1: Reduced SYN-ACK retransmissions and delayed route cache entry creation under attack conditions.
   • 2 (Recommended for hardened environments): Protection enabled with aggressive mitigation; socket indications to the Winsock layer are delayed until the three-way handshake completes.

Step 3: Configure SYN Attack Threshold Values

Under the same Parameters registry key, create or modify the following DWORD (32-bit) values to define the exact thresholds that trigger protection:

1. TcpMaxHalfOpen

• Purpose: Sets the maximum number of connections allowed in the SYN_RCVD state before SynAttackProtect is triggered.
• Default Values: Typically 100 on standard clients, 500 on servers.
• Recommended Setting: 500 (Decimal) or lower for restricted network profiles.

2. TcpMaxHalfOpenRetried

• Purpose: Sets the threshold for half-open connections that have had at least one retransmission before attack protection begins.
• Default Values: Typically 80 on standard clients, 400 on servers.
• Recommended Setting: 400 (Decimal).

3. TcpMaxPortsExhausted

• Purpose: The threshold of connection requests that have been refused due to lack of available local ports before attack protection initiates.
• Default Value: 5
• Recommended Setting: 5 (Decimal).

4. TcpMaxConnectResponseRetransmissions

• Purpose: Controls how many times Windows retransmits a SYN-ACK packet before terminating the half-open connection.
• Default Value: 2 or 3
• Recommended Setting: Set to 1 or 2 (Decimal) to release reserved connection state resources more quickly.

Step 4: Apply Changes

1. Close the Registry Editor.
2. Restart the system for the changes to take effect across the TCP/IP stack.