About IP Helper API and new SYN attack notification on Microsoft Windows Server 2003 Service Pack 1

Hi All,

As written in the article "New Networking Features in Microsoft Windows
Server 2003 Service Pack
1(http://www.microsoft.com/technet/com...uy/cg1204.mspx) ,
it seems that the IP Helper API supports new SYN attack notification APIs
named NotifySecurityHealthChange and CancelSecurityHealthChangeNotify.
The information about these new APIs had not yet been published in the
Microsoft Developer Network (MSDN) at the moment of this article.

Does this information available now? If yes could you give me pointer to it.

Or is it possible to know if on a server we have reached this state, or if
the server considers that it has been attacked by a SYN attack?

Thanks for your help.

Didier P

Didier,

I have been looking for this same information for several days now.
The only reference that I can find about it is in fact the article that
you point out. I just downloaded the Windows 2003 Server R2 SDK and
had a look at the iphlpapi.h file and did not see any reference to the
NotifySecurityHealthChange function. I would assume that this function
would be implemented in the same fashion as the NotifyAddrChange and
NotifyRouteChange functions that are already a part of that API. I may
be looking in the wrong place but I even just searched all the contents
of the include files for the SDK and did not find a definition for the
function.

I am at a loss personally as well.

Thanks,
Mark



Didier P wrote:
> Hi All,
>
> As written in the article "New Networking Features in Microsoft Windows
> Server 2003 Service Pack
> 1(http://www.microsoft.com/technet/com...uy/cg1204.mspx) ,
> it seems that the IP Helper API supports new SYN attack notification APIs
> named NotifySecurityHealthChange and CancelSecurityHealthChangeNotify.
> The information about these new APIs had not yet been published in the
> Microsoft Developer Network (MSDN) at the moment of this article.
>
> Does this information available now? If yes could you give me pointer to it.
>
> Or is it possible to know if on a server we have reached this state, or if
> the server considers that it has been attacked by a SYN attack?
>
> Thanks for your help.
>
> Didier P