MSS: (DisableIPSourceRouting) IP source routing protection level (protects against packet spoofing)
This machine-wide `REG_DWORD` value controls how the Windows TCP/IP stack handles source-routed IPv4 packets.
since 0.9.8.11
Purpose
Show registry keys (1)
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DisableIPSourceRouting
This machine-wide REG_DWORD value controls how the Windows TCP/IP stack handles source-routed IPv4 packets. A value of 2 causes Windows to drop all incoming IPv4 packets whose IP options specify a route selected by the sender. IP source routing is therefore completely disabled.
The setting applies only to source-routed packets. It does not disable ordinary IPv4 communication or general IP packet forwarding between network interfaces.
Notes
Security
IP source routing allows a sender to specify the intended network path of a datagram. It can be abused to obscure the actual transmission path, support certain packet-spoofing techniques, or bypass network boundaries.
Dropping all source-routed packets prevents the local IPv4 stack from processing these sender-supplied routing instructions. This setting does not provide general source-address validation and does not replace firewall or network-level anti-spoofing controls.
Possible side effects
Applications, diagnostic methods, or specialized network environments that deliberately use IPv4 source routing can no longer reach the computer with such packets. Normal IPv4 connections that do not use source routing are unaffected.
Notes
The registry path under Tcpip applies to IPv4. The corresponding IPv6 setting is stored at HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\DisableIPSourceRouting and is not changed by this value.
Microsoft documents that the system must be restarted before a change to this registry value takes effect.
Microsoft documentation
Microsoft Learn: Azure Policy guest configuration baseline for Windows reference
Microsoft Learn: Microsoft Security Bulletin MS06-032