RRAS Could Forward IP Fragments Without Filtering (189099)
The information in this article applies to:
- Microsoft Routing and Remote Access Service Update for Windows NT Server 4.0
- Microsoft Windows NT Server 4.0
This article was previously published under Q189099 IMPORTANT: This article contains information about modifying the registry. Before you
modify the registry, make sure to back it up and make sure that you understand how to restore
the registry if a problem occurs. For information about how to back up, restore, and edit the
registry, click the following article number to view the article in the Microsoft Knowledge Base:
256986 Description of the Microsoft Windows Registry
SYMPTOMS
If you enable packet filtering on an interface in the Microsoft Routing
and Remote Access Service Update for Windows NT (RRAS), IP fragments could
be forwarded without being filtered.
CAUSE
RRAS filters are "stateless." Therefore, no matter how the filter is
defined, it is possible that an unwanted fragment will be forwarded. For
RRAS to drop unwanted fragments, it must keep track of the protocol state,
from packet to packet, for each routed conversation.
RESOLUTIONTo resolve this problem, obtain the latest service pack for Windows NT 4.0. For additional information, click the following article number to view the article in the
Microsoft Knowledge Base:
152734 How to Obtain the Latest Windows NT 4.0 Service Pack
After you apply the service pack, make the following registry changes to use the new filter capabilities:
WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may
require you to reinstall your operating system. Microsoft cannot guarantee that you can solve
problems that result from using Registry Editor incorrectly. Use Registry Editor at your own
risk.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPFilterDriver
\Parameters
NOTE: The above registry key is one path; it has been wrapped for
readability.
Add the following values to the above Registry key:
- DefaultForwardFragments - REG_DWORD = 0 (Decimal)
Setting this to "0" causes the filterdriver to drop fragments if they
don't match a previous header.
- EnableFragmentChecking - REG_DWORD = 1 (Decimal)
Setting this to "1" enables fragment checks.
NOTE: Even with this new filter update properly installed, it is possible
for unwanted fragments to be forwarded through the router.
| Modification Type: | Major | Last Reviewed: | 8/9/2001 |
|---|
| Keywords: | kbbug KB189099 kbAudDeveloper |
|---|
|