Proxomitron reduces RWIN to 32768

[z12]

laighleas Wrote:What was done to harden the stack?
...
SynAttackProtect = 2
TcpMaxHalfOpen = 100
TcpMaxHalfOpenRetired = 400
...

Since your tweaking, heres a little tid bit on SynAttackProtect, check out the Note:

http://www.microsoft.com/technet/prodtec....mspx#EGAA

microsoft Wrote:SynAttackProtect

Key: Tcpip\Parameters

Value Type: REG_DWORD

Valid Range: 0, 1

0 (no SYN attack protection)
1 (reduced retransmission retries and delayed RCE [route cache entry] creation if the TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are satisfied and a delayed indication to Winsock is made.)

Note: When the system finds itself under attack the following options on any socket can no longer be enabled: scalable windows (RFC 1323) and per adapter configured TCP parameters (Initial RTT, window size). This is because when protection is functioning the route cache entry is not queried before the SYN-ACK is sent and the Winsock options are not available at this stage of the connection.

Default: 1 - enabled for Windows Server 2003 Service Pack 1, 0 -disabled for Windows Server 2003 with no service packs installed

Recommendation: 1

Description: SYN attack protection involves reducing the amount of retransmissions for the SYN-ACKS, which will reduce the time for which resources have to remain allocated. The allocation of route cache entry resources is delayed until a connection is made and the connection indication to AFD is delayed until the three-way handshake is completed. Note that the actions taken by the protection mechanism only occur if TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are exceeded.

Mike