Desktop

Ask something
Discussion Locked

IP Header has a length of 24 bytes

0 helpful
19 replies

by timhg

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Previous (unanswered) question has similar problem to me so I thought I'd repost (with higher points !!)-

IP Header has a length of 24 Bytes
a Cisco router sends an UDP request, the length of its IP-header is strictly 20 bytes, to a windows2000server.
Within the UDP answer,my windows2000 server sends an IP-header with a length of 24 bytes
because it adds 4 bytes for "options = no options" to the router.
therefor my firewall rejects this answer because of a security lack.
now my question:where / how can I configure the TCP/IP options in that way, that my header will not exceed a length of 20 bytes.

19 replies

by shanghai sam

Link didn't work

A very short, simple answer telling how to turn off TCP option in NT 4 (or at least restrict to 20 bytes somehow)is what I need.

by boyhowdy

I've been researching your problem, and as far as I can tell there is no way to do this without modifying your firewall. There is no simple answer for restrictying the header. Between the MS Knowledge Base and several gurus that I know, The best Ihave come up with is the list of TCP/IP and NBT parameters at:

http://support.microsoft.com/support/kb/articles/Q120/6/42.asp?LN=EN-US&SD=gn&FR=0&qry=TCP/IP%20and%20NBT%20Parameters&rnk=1&src=DHCS_MSPSS_gn_SRCH&SPR=WIN2000

This is a list of all the parameters that can be modified. There is not one that has the answer you are looking for. There is no way of letting this traffic through without modifying your firewall.

Sorry... I hope this information helps, none the less.

by yuval

I dont know about the windows 2000 server BUT --
If you can't find a solution you can try hiding the server beyond NAT by the Cisco router - so the router will rebuild the packets with 20 bytes headers...

Yuval

by cmoss

Check your registry settings for PMTU (Path Maximum Transmission Units). By default, PMTU Detect is disabled. This process would allow the OS to detect a non-PMTU compliant router, sometimes called a black hole router. Try the following to reduceproblems from these older IOS versions:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters.
Select the EnablePMTUBHDetect entry, and change the value to 1.

Additional info is available. I hope this helps.

by michael roark - ccna/da mcp 3csa

First of all, in your question you say Win2k server, in a later comment you say NT4. But here is your answer anyways.
The correct answer DOES come from Q120642, you just need to know how to interpret it.
If you have read RFC791, which is the foundation for IPv4 (can be found at http://rfc.net/rfc0791.html) You may very well realize something about the parameters that you have overlooked. Obviously your server is adding in the extra parameters in your header for a reason. The reason is it's probably added into your registry for something or another.
Please go to your registry (Start>Run>Regedit)
and go to this Key.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters
Your Adapter may/may not have a folder in between services and Tcpip... then it would be ...\services\'adaptername'\tcpip\parameters.
and look for the key called "DefaultTOS" It may have been added in there by a program you might have installed,
with this entry, a value of no options will automatically be added to your header, if you delete it, it will probably drop it back down to the default size (of what it recieved)...
Note that DefaultTOS is not available in Windows 2000.
Now, in the case of Win2K, is your Firewall hardware? software?what kind of firewall is this, please feel free to Email me directly, and I'll see what I can do about giving you the correct configuration for your particular firewall.
michael.roark@4its.org
Good Luck

This discussion is closed to new replies.