Detections
Analytics
18.4.5 Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
Ensure 'MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds' is set to 'Enabled: 300,000 or 5 minutes (recommended)This value controls how often TCP attempts to verify that an idle connection is still intact by sending a keep-alive packet.
If the remote computer is still reachable, it acknowledges the keep-alive packet.
The recommended state for this setting is: 'Enabled: 300,000 or 5 minutes (recommended)'.
Rationale:
An attacker who is able to connect to network applications could establish numerous connections to cause a DoS condition.
Solution
To establish the recommended configuration via GP, set the following UI path to Enabled: 300,000 or 5 minutes (recommended):Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS: (KeepAliveTime) How often keep-alive packets are sent in milliseconds
Note: This Group Policy path does not exist by default.
An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: [The MSS settings -- Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)
Impact:
Keep-alive packets are not sent by default by Windows.
However, some applications may configure the TCP stack flag that requests keep-alive packets.
For such configurations, you can lower this value from the default setting of two hours to five minutes to disconnect inactive sessions more quickly.
See Also
Item Details
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7, CSCv6|9, CSCv6|9.2
Plugin: Windows
Control ID: 2684edb20115c780d5672f3fcc31f88d735b006ae0788b253bc07f225d050902