Detections
Analytics

18.4.12 Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted.

The retransmission time-out is doubled with each successive retransmission on a connection.

It is reset when responses resume.

The base time-out value is dynamically determined by the measured round-trip time on the connection.

The recommended state for this setting is: 'Enabled: 3'.

Rationale:
A malicious user could exhaust a target computer's resources if it never sent any acknowledgment messages for data that was transmitted by the target computer.

Solution

To establish the recommended configuration via GP, set the following UI path to 'Enabled: 3':


Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS:(TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted

Note: This Group Policy path does not exist by default.

An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: [The MSS settings -- Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)

Impact:
TCP starts a retransmission timer when each outbound segment is passed to the IP.

If no acknowledgment is received for the data in a given segment before the timer expires, then the segment is retransmitted up to three times.

See Also

https://workbench.cisecurity.org/files/1929

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-7, CSCv6|9, CSCv6|9.2

Plugin: Windows

Control ID: f7902da97b5b831cc91587ad082e932d0c6dfc76eb1a036c4bec842080ab0465