.zigstack
	- Hardening your TCP/IP Stack (e.g. against DoS-Attacks)
	  of WindowsNT/2K/XP/2003-based workstations and servers.

.about
°°°°°°

	The TCP/IP protocol suite implementation for Windows
	NT/2K/XP/2003 obtains all of its configuration data from
	the registry. This information is written to the
	registry by the Setup program. Some customer
	installations may require changes to certain default
	values. To handle these cases, optional registry
	parameters can be created to modify the default
	behavior of some parts of the protocol drivers.

	All of the TCP/IP parameters are registry values
	located under the registry key

	HKEY_LOCAL_MACHINE
     	  \SYSTEM
            \CurrentControlSet
              \Services
                \Tcpip
                  \Parameters


.changelog
°°°°°°°°°°

	[version5]
	- remote registry included
	- seven new methods implemented
	  (tcp max half open, tcp max half open retried
	   tcp max connect response retransmissions,
	   fragment checking, multicast forward,
	   act as a router, address mask reply)
	- auto-advice for not done methods

	[version4]
	- rewritten with a GUI
	- auto-detection included.
	  (os detection, already done methods)

	[version3]
	- three new methods implemented
	  (tcp data retransmission, tcp ports exhausted,
	   perform router discovery)

	[version2]
	- three more methods implemented
	  (window scaling and timestamp, icmp redirect
	   ip source routing)

.info
°°°°°

	When started, the program checks the Registry for
	existing values, which are already set. If not set,
	ZigStack advises you to set, by marking the check-
	boxes. This check only works locally, at the moment.
	It also finds out which OS you use, to handle some
	methods.

	You have the choice to set these methods locally or
	remotely.
	If you want to access any remote registry, you have
	to fill out the "host"-, "user"-, "pass"-fields.
	In the host-field, set any IP or the Hostname.
	IMPORTANT: Without "\\"! This is done by ZigStack
	automatically.
	Username and passwords are case-sensitive!
	***
	One nice side-effect of ZigStack is, that many
	OS-Fingerprinting tools, like nmap, won't find
	out the OS of the hardened Box. (Sorry Fyodor ;)

	The "remote-registry"-service must be started, if you
	want to use the remote-reg. functions.
	Also, NETBIOS must be activated, because the
	authentification is used by the "net"-command.
	If you know any WinAPI functions which uses
	authentification, let me know.


.methods
°°°°°°°°

	- enable 'syn attack' protection.

	  This registry value causes
	  Transmission Control Protocol (TCP) to
	  adjust retransmission of SYN-ACKS.
	  When you set this method, the
	  connection responses time out more
	  quickly in the event of a SYN attack (a
	  type of denial of service attack).

	  In a SYN flood attack, the attacker
	  sends a continuous stream of SYN packets
	  to a server, and the server leaves the
	  half open connections open until it is
	  overwhelmed and is no longer able to
	  respond to legitimate requests.

	- enable 'dead gateway detection' protection.

	  TCP is allowed to perform
	  dead-gateway detection. When
	  dead-gateway detection is enabled, TCP
	  may ask the Internet Protocol (IP) to
	  change to a backup gateway if a number
	  of connections are experiencing
	  difficulty. Backup gateways are defined
	  in the Advanced section of the TCP/IP
	  configuration dialog box in Network
	  Control Panel.

	  An attacker could force the server to
	  switch gateways, potentially to an
	  unintended one.

	- enable 'path maximum transmission unit' protection.

	  TCP attempts to discover either the
	  maximum transmission unit (MTU) or
	  then largest packet size over the path
	  to a remote host. TCP can eliminate
	  fragmentation at routers along the path
	  that connect networks with different
	  MTUs by discovering the path MTU and
	  limiting TCP segments to this size.
	  Fragmentation adversely affects TCP
	  throughput. It is recommended that you
	  set this method. When you do so, an
	  MTU of 576 bytes is used for all
	  connections that are not hosts on the
	  local subnet.

	  If you do not set this value to 0, an
	  attacker could force the MTU to a very
	  small value and overwork the stack by
	  forcing the server to fragment a large
	  number of packets.

	- enable 'keep alive time packet' protection.

	  This method controls how often TCP
	  attempts to verify that an idle
	  connection is still intact by sending a
	  keep-alive packet. If the remote
	  computer is still reachable, it
	  acknowledges the keep-alive packet.
	  Keep-alive packets are not sent by
	  default.

	  An attacker who is able to connect to
	  network applications could cause a DoS
	  condition by establishing numerous
	  connections.

	- enable 'no name release on demand' protection.

	  This method determines whether the
	  computer releases its NetBIOS name
	  when it receives a name-release
	  request. This method was added to
	  allow the administrator to protect the
	  computer against malicious
	  name-release attacks.

	  NOTE: You must be using Windows 2000
	  Service Pack 2 (SP2) or later to use the
	  NoNameReleaseOnDemand method.

	- enable 'window scaling and timestamp' protection.

	  This parameter controls RFC 1323 time stamps
	  and window-scaling options. Time stamps and
	  window scaling are enabled by default, but
	  can be manipulated with flag bits. Bit 0
	  controls window scaling, and bit 1 controls
	  time stamps. Both will be disabled.

	- enable 'icmp redirect' protection.

	  Internet Control Message Protocol (ICMP)
	  redirects cause the stack to plumb host
	  routes. These routes override the Open
	  Shortest Path First (OSPF) generated routes.

	  This behavior is expected. The problem is that
	  the 10 minute time out period for the ICMP
	  redirect plumbed routes temporarily creates a
	  black hole for the network where traffic will
	  no longer be routed properly for the affected
	  host.

	- enable 'ip source routing' protection.

	  IP source routing is a mechanism allowing
	  the sender to determine the IP route that
	  a datagram should take through the network,
	  used primarily by tools such as tracert.exe
	  and ping.exe.

	  An attacker could use source routed packets
	  to obscure their identity and location.
	  Source routing allows a computer sending a
	  packet to specify the route it takes.

	- enable 'tcp data retransmission' protection.

	  This parameter controls the number of times
	  that TCP retransmits an individual data
	  segment (non connect segment) before aborting
	  the connection. The retransmission time out
	  is doubled with each successive retransmission
	  on a connection. It is reset when responses
	  resume. The base time out value is dynamically
	  determined by the measured round trip time on
	  the connection.

	  In a SYN flood attack, the attacker sends a
	  continuous stream of SYN packets to a server,
	  and the server leaves the half open connections
	  open until it is overwhelmed and no longer is
	  able to respond to legitimate requests.

	- enable 'tcp ports exhausted' protection.

	  This parameter controls the point at which SYN
	  ATTACK protection starts to operate. SYN ATTACK
	  protection begins to operate when
	  TcpMaxPortsExhausted connect requests have been
	  refused by the system because the available
	  backlog for connections is set at 0.

	  In a SYN flood attack, the attacker sends a
	  continuous stream of SYN packets to a server,
	  and the server leaves the half open connections
	  open until it is overwhelmed and no longer is
	  able to respond to legitimate requests.

	- enable 'perform router discovery' protection.y

	  This setting is used to enable or disabled the
	  Internet Router Discovery Protocol (IRDP). IRDP
	  allows the system to detect and configure
	  Default Gateway addresses automatically.

	  An attacker who has gained control of a system
	  on the same network segment could configure a
	  computer on the network to impersonate a router.
	  Other computers with IRDP enabled would then
	  attempt to route their traffic through the
	  already compromised system.

	- enable 'tcp max half open' protection

	  Sets the number of TCP connections to be in the
	  SYN_RCVD state before SYN flood protection enables.
	  It is kind of a DoS-Attack.

 	- enable 'tcp max half open retried' protection

	  Sets the number of TCP connections to be in the
	  SYN_RCVD state with at least one retransmission
	  being sent before SYN flood protection enables.
	  It is kind of a DoS-Attack

	- enable 'tcp max connect response transmissions' protection

	  Sets the number of SYN/ACK responses that are sent
	  to a SYN request. It can be used to fingerprint and
	  for a DoS-Attack.

	- enable 'fragment checking' protection

	  Denies fragmented packets to be processed by the
	  stack.

	- enable 'multicast forward' protection

	  Enabled allows for IP multicasts to be
	  forwarded. Disabled denies any IP multicast
	  forwarding.

	- enable 'act as a router' protection

	  Allows for the computer to act as a router.

	- enable 'address mask reply' protection

	  Allows for ICMP type 18 packets to be returned.
	  If not enabled, it denies the stack to respond
	  when queried with an ICMP type 17 packet.


.greets
°°°°°°°
	{ docfx		helpful as always
	{ consi         thanks for spending so much time by
			helping me, to realize this tiny tool! :)
			wodka *na zdorowie*
	{ baDDany       still my inspiration *kisses*
	{ wakee         will give you some beer, next time. ;)
	{ holiday/thc   additional hints


.contact
°°°°°°°°

	ah@primepage.de | http://xaitax.de