Detections
Analytics
18.4.11 Ensure 'MSS: (TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted' is set to 'Enabled: 3'
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
This setting controls the number of times that TCP retransmits an individual data segment (non-connect segment) before the connection is aborted.The retransmission time-out is doubled with each successive retransmission on a connection.
It is reset when responses resume.
The base time-out value is dynamically determined by the measured round-trip time on the connection.
The recommended state for this setting is: 'Enabled: 3'.
Rationale:
A malicious user could exhaust a target computer's resources if it never sent any acknowledgment messages for data that was transmitted by the target computer.
Solution
To establish the recommended configuration via GP, set the following UI path to 'Enabled: 3':Computer Configuration\Policies\Administrative Templates\MSS (Legacy)\MSS:(TcpMaxDataRetransmissions) How many times unacknowledged data is retransmitted
Note: This Group Policy path does not exist by default.
An additional Group Policy template ('MSS-legacy.admx/adml') is required - it is available from this TechNet blog post: [The MSS settings -- Microsoft Security Guidance blog](https://blogs.technet.microsoft.com/secguide/2016/10/02/the-mss-settings/)
Impact:
TCP starts a retransmission timer when each outbound segment is passed to the IP.
If no acknowledgment is received for the data in a given segment before the timer expires, then the segment is retransmitted up to three times.
See Also
Item Details
Category: SYSTEM AND COMMUNICATIONS PROTECTION
References: 800-53|SC-7, CSCv6|9, CSCv6|9.2
Plugin: Windows
Control ID: eabd0c58df5434cfd098e841b04b5ba673658eccc321e018d22f442ecb85ba2f