Windows NT, 2000 & XP settings

This parameter determines the maximum TCP receive window size offered by the system. The receive window specifies the number of bytes a sender may transmit without receiving an acknowledgment. In general, larger receive windows will improve performance over high (delay * bandwidth ) networks. For highest efficiency, the receive window should be an even multiple of the TCP Maximum Segment Size (MSS).

Broadband tuners of the era favoured an even multiple of the MSS, such as 64240 (44 × 1460).

Default calculated by Windows from the MSS (8,760 bytes on Windows XP Ethernet)  ·  Range 0–0x3FFFFFFF

The TcpWindowSize parameter can be used to set the receive window on a per-interface basis. This parameter can be used to set a global limit for the TCP window size on a system-wide basis.

Usually set to the same value as the receive window.

Default This parameter does not exist by default.  ·  Range 0–0x3FFFFFFF

This parameter controls RFC 1323 time stamps and window-scaling options. Time stamps and window scaling are enabled by default, but can be manipulated with flag bits. Bit 0 controls window scaling, and bit 1 controls time stamps.

• 0: RFC 1323 options off
• 1: window scaling only
• 2: timestamps only
• 3: window scaling and timestamps

Needed for receive windows above 64 KB, so it mattered most on fast or satellite links.

Default No value; the default behavior is as follows: do not initiate options but if requested provide them.  ·  Range 0, 1, 2, 3

This parameter controls whether or not Selective Acknowledgment (SACK, specified in RFC 2018) support is enabled.

Keep enabled: it speeds recovery after packet loss.

Default 1 (true)  ·  Range 0, 1 (false, true)

This parameter determines the number of duplicate ACKs that must be received for the same sequence number of sent data before fast retransmit is triggered to resend the segment that has been dropped in transit.

Default 2  ·  Range 1–3

Specifies the maximum receive segment size.

Default 1460

Specifies the maximum send segment size.

Default 1460

Setting this parameter to 1 (True) causes TCP to attempt to discover the Maximum Transmission Unit (MTU or largest packet size) over the path to a remote machine. By discovering the Path MTU and limiting TCP segments to this size, TCP can eliminate fragmentation at routers along the path which connect networks with different MTUs. Fragmentation adversely affects TCP throughput and network congestion.

Leave on unless a broken router is black-holing large packets.

Default 1 (true)  ·  Range 0, 1 (false, true)

Specifies the default Time To Live (TTL) value set in the header of outgoing IP packets. The TTL determines the maximum amount of time an IP packet may live in the network without reaching its destination.

64 or 128 is plenty for any route across the Internet.

Default 128  ·  Range 0–0xff (0–255 decimal)

This parameter controls the number of times that TCP retransmits an individual data segment (not connection request segments) before aborting the connection.

Default 5  ·  Range 0–0xFFFFFFFF

Determines the time that must elapse before TCP can release a closed connection and reuse its resources.

Default 0xF0 (240 decimal)  ·  Range 30-300 (decimal)

Normally, Windows 2000 completes a Windows Sockets Receive when one of the following occurs: * Data arrives with the push bit set. * The user recv buffer is full. * 0.5 seconds have elapsed since any data arrived. Setting this parameter to a 1 causes Afd.sys to treat all incoming packets as though the push bit was set. This should only be done when necessary to work around client TCP/IP implementations that are not properly pushing data.

Default 0 (false)  ·  Range 0, 1 (false, true)

This parameter determines whether TCP uses the RFC 1122 specification for urgent data or the mode used by BSD- derived systems.

Default 0 (false)  ·  Range 0, 1 (false, true)

The number of receive bytes that AFD buffers on a connection before imposing flow control. For some applications, a larger value here gives slightly better performance at the expense of increased resource utilization.

Default 4096/8192/8192

This is similar to DefaultReceiveWindow, but for the send side of connections.

Default 4096/8192/8192

Datagrams smaller than the value of this parameter go through the fast I/O path or are buffered on send. Larger ones are held until the datagram is actually sent. The default value was found by testing to be the best overall value for performance. Fast I/O means copying data and bypassing the I/O subsystem, instead of mapping memory and going through the I/O subsystem. This is advantageous for small amounts of data.

Default 1024

This parameter controls the maximum amount of data that is transferred in a TransmitFile request on the fast path. Fast I/O is essentially copying data and bypassing the I/O subsystem, instead of mapping memory and going through the I/O subsystem. This is advantageous for small amounts of data.

Default 64 KB  ·  Range 0–0xffffffff

This parameter controls how Afd.sys uses system threads. Setting it to 0x10 causes AFD to use system threads to perform IO that results from a long (more than 2 SendPacketLength worth of data) TransmitFile request. Setting it to 0x20 causes AFD to use kernel-mode APC for IO and to execute everything in the context of the same thread. This is new in Windows 2000 and can improve performance by reducing the number of context switches in long TransmitFile requests.

Default 0x10  ·  Range 0x10, 0x20

The priority boost that AFD gives to a thread when it completes I/O for that thread. If a multithreaded application experiences starvation of some threads, the problem may be remedied by reducing this value.

Default 2  ·  Range 0–16

This parameter is used to prevent address sharing (SO_REUSEADDR) between processes so that if a process opens a socket, no other process can steal data from it.

Default 0  ·  Range 0, 1

The count of large buffers allocated by AFD at system startup. Allocate more buffers to improve performance at the cost of physical memory.

Default 0/2/10

Initial count of medium buffers.

Default 4/8/24

Initial count of small buffers.

Default 8/16/32

The size, in bytes, of large buffers used by AFD. Smaller values use less memory and larger values can improve performance.

Default PAGE_SIZE (4096 bytes on i386, 8192 bytes on Alpha)

The size in bytes of medium buffers used by AFD.

Default 1504

The size in bytes of small buffers used by AFD.

Default 128

HTTP specification requires that no one computer can have more than 2 simultaneous connections to any single HTTP server. This will affect all Windows application that uses the standard API, including Internet Explorer. People who keep multiple files on an online hard drive hate this restriction, because they can only download two or four files at a time. Windows developers choose to limit the maximum connections to a HTTP 1.0 server to four. In the HTTP 1.1 specification the number of connections was mandated to 2.

A favourite tweak: raising these let Internet Explorer fetch more page pieces at once.

Default 4 (HTTP 1.0) · 2 (HTTP 1.1)

This parameter can be used to allow programs to manipulate the Type Of Service (TOS) bits in the header of outgoing IP packets.

Default 1 (true)  ·  Range 0, 1 (false, true)

The IP header in every datagram specifies a Type of Service (ToS) value that can be used to specify the quality of service (QoS) setting for IP datagrams. The ToS value indicates the military origin of the protocol because it was designed for the Advanced Research Project Agency Networks that was the predecessor to the current Internet.

Default 0  ·  Range 0–255

Fast route look-up is enabled if this flag is set. This can make route lookups faster at the expense of non-paged pool memory. This parameter is created by the Routing and Remote Access Service.

Default 0 (false)  ·  Range 0, 1 (false, true)

This parameter controls the number of cached (pre-allocated) Transport Control Blocks (TCBs) that are available. A Transport Control Block is a data structure that is maintained for each TCP connection.

Default 250 / 500 / 1000 (small / medium / large system)  ·  Range 0–0xFFFFFFFF

This value should be set to a power of 2 (for example, 512, 1024, 2048, and so on.) If this value is not a power of 2, the system configures the hash table to the next power of 2 value (for example, a setting of 513 is rounded up to 1024.) This value controls how fast the system can find a TCP control block and should be increased if MaxFreeTcbs is increased from the default.

Default 512  ·  Range 0x40–0x10000 (64-65536 decimal)

This parameter controls the maximum amount of memory that the system allows for the route table data and the routes themselves. It is designed to prevent memory exhaustion on the computer caused by adding large numbers of routes.

Default 150,000 bytes (about 1,000 routes)  ·  Range Any DWORD (0xFFFFFFFF means no limit on memory.)

Synattack protection involves reducing the amount of retransmissions for the SYN-ACKS, which will reduce the time for which resources have to remain allocated. The allocation of route cache entry resources is delayed until a connection is made. If synattackprotect = 2, then the connection indication to AFD is delayed until the three-way handshake is completed. Note that the actions taken by the protection mechanism only occur if TcpMaxHalfOpen and TcpMaxHalfOpenRetried settings are exceeded.

• 0: no SYN-attack protection
• 1: fewer SYN-ACK retries and delayed route-cache entries once the TcpMaxHalfOpen limits are hit
• 2: as 1, plus a delayed indication to Winsock

Default 0 (false)  ·  Range 0, 1, 2

This parameter controls the number of connections in the SYN-RCVD state allowed before SYN-ATTACK protection begins to operate.

Default 100 (Professional)  ·  Range 100–0xFFFF

This parameter controls the number of connections in the SYN-RCVD state for which there has been at least one retransmission of the SYN sent, before SYN-ATTACK attack protection begins to operate.

Default 80 (Professional)  ·  Range 80–0xFFFF

Specifies how verbose TCP/IP should be about logging events in the event log. The highest level of verbosity is 16, and 1 is the lowest level.

• 1: only the most critical errors
• 4: serious protocol violations
• 8: non-serious protocol violations
• 12: information about unusual events
• 16: unusual events that some networks normally allow

Default 16