[kk123]

Hi everyone my windows 2000 sp4 just been SYN Flood Attacked and it cannot go Online, once it go online the attack will happen again, i've already do serveral reg fix to remove this syn flood but cannot make it, my server got the most updated HF.

anyone face this problem b4 ?? pls guide me . Thx in advance

Attached File(s)

•  synflood.JPG (100.92K)
  Number of downloads: 38

[fdv]

What registry values did you tweak?

Under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, have you added Microsoft's recommended settings?

Value Name Value (REG_DWORD)
SynAttackProtect 2
TcpMaxPortsExhausted 1
TcpMaxHalfOpen 500
TcpMaxHalfOpenRetried 400
TcpMaxConnectResponseRetransmissions 2
TcpMaxDataRetransmissions 2
EnablePMTUDiscovery 0
KeepAliveTime 300000 (5 minutes)
NoNameReleaseOnDemand 1

[kk123]

Thx for your reply

yes i have tweaked as microsoft recomemed

anyway i have found a solution to resolve the problem now my server is running smoothly

[Win2k3EE]

kk123, on Jun 9 2005, 05:54 AM, said:

anyway i have found a solution to resolve the problem now my server is running smoothly
<{POST_SNAPBACK}>

Would you be kind to post your solution here. Maybe there are others who need your solution.

[kk123]

it is a service hiding under system32 and it only will triggle once u go online if u are not ONLINE <---- join public , it's like normal if u stay in private.

identify the particural service and delete it. (unpack32.exe).

So u need to apply the microsoft recemmemed tweak as fdv posted ( there is some more ) i can found it so i think there won't be a problem for u all

Hope this help

Best Regards to u all