18.4.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes'

Information

18.4.6 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)'

This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.

If the remote computer is still reachable, it acknowledges the keep-alive packet.

The recommended state for this setting is: ''Enabled: 300,000 or 5 minutes (recommended)''.

Rationale:
An attacker who is able to connect to network applications could establish numerous connections to cause a DoS condition.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: 300,000 or 5 minutes (recommended):


Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds

Note: This Group Policy path does not exist by default.

An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: [The MSS settings -- Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)

Impact:
Keep-alive packets are not sent by default by Windows.

However, some applications may configure the TCP stack flag that requests keep-alive packets.

For such configurations, you can lower this value from the default setting of two hours to five minutes to disconnect inactive sessions more quickly.

See Also

https://workbench.cisecurity.org/files/1929

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv6|9, CSCv6|9.2

Plugin: Windows

Control ID: 471446e03041834a57f4858546d50fb9f5c4d6ce3e7f9c3e3486de488adabce2