Microsoft KB Archive/189099

= RRAS Could Forward IP Fragments Without Filtering =

Article ID: 189099

Article Last Modified on 10/31/2006

-

APPLIES TO


 * Microsoft Routing and Remote Access Service Update for Windows NT Server 4.0
 * Microsoft Windows NT Server 4.0 Standard Edition

-



This article was previously published under Q189099



IMPORTANT: This article contains information about modifying the registry. Before you modify the registry, make sure to back it up and make sure that you understand how to restore the registry if a problem occurs. For information about how to back up, restore, and edit the registry, click the following article number to view the article in the Microsoft Knowledge Base:

256986 Description of the Microsoft Windows Registry



SYMPTOMS
If you enable packet filtering on an interface in the Microsoft Routing and Remote Access Service Update for Windows NT (RRAS), IP fragments could be forwarded without being filtered.



CAUSE
RRAS filters are "stateless." Therefore, no matter how the filter is defined, it is possible that an unwanted fragment will be forwarded. For RRAS to drop unwanted fragments, it must keep track of the protocol state, from packet to packet, for each routed conversation.



RESOLUTION
To resolve this problem, obtain the latest service pack for Windows NT 4.0. For additional information, click the following article number to view the article in the Microsoft Knowledge Base:

152734 How to Obtain the Latest Windows NT 4.0 Service Pack

After you apply the service pack, make the following registry changes to use the new filter capabilities:

WARNING: If you use Registry Editor incorrectly, you may cause serious problems that may require you to reinstall your operating system. Microsoft cannot guarantee that you can solve problems that result from using Registry Editor incorrectly. Use Registry Editor at your own risk.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\IPFilterDriver \Parameters

NOTE: The above registry key is one path; it has been wrapped for readability.

Add the following values to the above Registry key:
 * DefaultForwardFragments - REG_DWORD = 0 (Decimal)

Setting this to "0" causes the filterdriver to drop fragments if they don't match a previous header.
 * EnableFragmentChecking - REG_DWORD = 1 (Decimal)

Setting this to "1" enables fragment checks.

NOTE: Even with this new filter update properly installed, it is possible for unwanted fragments to be forwarded through the router.

Additional query words: ntrouter

Keywords: kbbug KB189099

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.