Author Topic: OS/2 IP Stack Hardening  (Read 984 times)

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
OS/2 IP Stack Hardening
« on: December 14, 2025, 05:39:43 am »
Hi everyone.
I still (sometimes once a week) get kernel traps in the IP layer. Internet facing.
Has anyone published some details or a guide on the best hardening/tuning settings to be able to use on the stack?

Cheers,
-Chris

Dave Yeo

  • Hero Member
  • *****
  • Posts: 5624
  • Karma: +143/-1
    • View Profile
Re: OS/2 IP Stack Hardening
« Reply #1 on: December 14, 2025, 08:25:45 am »
Have you looked at the included documentation? Computer-->Help Center-->Information-->Components & Features-->Networking-->TCP/IP In particular, the TCP/IP Command Reference, inetcfg is one command to search for tuning. Lots of other stuff under TCP/IP too.
There's a few threads on here about the various settings inetcfg handles.
Crashes aren't good, you might want to open an issue at Arca Noae assuming you have a current subscription.

Dariusz Piatkowski

  • Hero Member
  • *****
  • Posts: 1460
  • Karma: +34/-0
    • View Profile
Re: OS/2 IP Stack Hardening
« Reply #2 on: December 14, 2025, 02:37:32 pm »
Dave Yeo has great advice, inetcfg has been extensively discussed on our forum, the search function will bring up a bunch of stuff.

The starting point though is to understand where you are in terms of your OS/2 version and the TCP/IP stack itself. There were numerous IBM fixes and Alex Taylor's Visual Guides can make a quick work of trying to figure it all out otherwise, so head on over to => http://www.altsan.org/os2/fixpaks/tcpip.html to take a look at what that looks like.

More specifically re: the trap, what are you actually seeing?

RTAN

  • Jr. Member
  • **
  • Posts: 78
  • Karma: +11/-0
    • View Profile
Re: OS/2 IP Stack Hardening
« Reply #3 on: December 14, 2025, 09:40:48 pm »
To echo Dariusz's point, could you tell us exactly what version of OS/2, MPTS/LAPS and TCP/IP you're running. Running SYSLEVEL from the command prompt will tell you if you're not sure. Alternatively tell us what FixPaks you've applied and we can work it out from there.

Alex's guide is indeed excellent and I have used it many times myself to work out exactly what level of MPTS & TCP/IP I can safely reach with any given version of OS/2!

Richard.

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #4 on: December 15, 2025, 06:30:56 am »
I have two machines, main and inet.

The trimmed syslevel output from inet is:

Code: [Select]
C:\IBMCOM\SYSLEVEL.TRP
IBM OS/2 LAN Adapter and Protocol Support
Version 5.50     Component ID 5639A5700
Current CSD level: WR08620
Prior   CSD level: WR08610

C:\IBMINST\SYSLEVEL.WSB
OS/2 Warp Server for e-business
Extended Edition 4.50     Component ID 5639F9300
Type 0
Current CSD level: XR04500
Prior   CSD level: XR04500

C:\MPTN\SYSLEVEL.DHC
IBM OS/2 Dynamic Host Configuration Protocol Services
Version 4.21     Component ID 562290901
Current CSD level: WR08620
Prior   CSD level: WR08610

C:\MPTN\SYSLEVEL.MPT
IBM OS/2 TCP/IP Stack
Version 5.50     Component ID 5639B1700
Current CSD level: WR08620
Prior   CSD level: WR08610

C:\MPTN\SYSLEVEL.NFS
NFS for TCP/IP on OS/2
Version 3.00.1     Component ID 5639A6602
Current CSD level: UN02100
Prior   CSD level: UN02000

C:\OS2\INSTALL\SYSLEVEL.OS2
Warp Server for e-business Base Operating System
Version 4.50     Component ID 5639A5550
Type 0S
Current CSD level: XR04500
Prior   CSD level: XR04500

C:\TCPIP\bin\SYSLEVEL.DDN
IBM OS/2 Dynamic Domain Name Server
Version 4.21     Component ID 562293600
Current CSD level: UN02100
Prior   CSD level: UN02000

C:\TCPIP\bin\SYSLEVEL.DHS
IBM OS/2 Dynamic Host Configuration Protocol Server
Version 4.21     Component ID 562293700
Current CSD level: UN02100
Prior   CSD level: UN02000

C:\TCPIP\bin\SYSLEVEL.IAK
 IBM Internet Connection for Warp
Version 4.21     Component ID 5639A6400
Current CSD level: UN02100
Prior   CSD level: UN02000

C:\TCPIP\bin\SYSLEVEL.TCP
IBM TCP/IP for Warp                                         
Version 4.21     Component ID 5639A6600
Current CSD level: UN02100
Prior   CSD level: UN02000


The trimmed syslevel output from main is:

Code: [Select]
C:\IBMCOM\SYSLEVEL.TRP
IBM OS/2 LAN Adapter and Protocol Support
Version 6.01     Component ID 5639A5700
Current CSD level: WR08705
Prior   CSD level: WR08701

C:\IBMINST\SYSLEVEL.WSB
Convenience Package - OS/2 Warp Server for e-business
Version 4.52     Component ID 5639F9301
Type 0C     
Current CSD level: XR04502
Prior   CSD level: XR04501

C:\MPTN\SYSLEVEL.DHC
IBM OS/2 Dynamic Host Configuration Protocol Services
Version 4.31     Component ID 562290901
Current CSD level: WR08705
Prior   CSD level: WR08701

C:\MPTN\SYSLEVEL.MPT
IBM OS/2 TCP/IP Stack
Version 6.01     Component ID 5639B1700
Current CSD level: WR08705
Prior   CSD level: WR08701

C:\MPTN\SYSLEVEL.NFS
NFS for TCP/IP on OS/2
Version 3.00.3     Component ID 5639A6602
Current CSD level: UN02205
Prior   CSD level: UN02200

C:\OS2\INSTALL\SYSLEVEL.OS2
Convenience Package - OS/2 Warp Server for e-business
Version 4.52     Component ID 5639A6150
Type 0C
Current CSD level: XR04502
Prior   CSD level: XR04502

C:\TCPIP\bin\SYSLEVEL.DDN
IBM OS/2 Dynamic Domain Name Server
Version 4.32     Component ID 562293600
Current CSD level: UN02205
Prior   CSD level: UN02200

C:\TCPIP\bin\SYSLEVEL.DHS
IBM OS/2 Dynamic Host Configuration Protocol Server
Version 4.32     Component ID 562293700
Current CSD level: UN02205
Prior   CSD level: UN02200

C:\TCPIP\bin\SYSLEVEL.TCP
IBM TCP/IP for Warp                                         
Version 4.32     Component ID 5639A6600
Current CSD level: UN02205
Prior   CSD level: UN02200

C:\TCPIP\bin\SYSLEVEL.VPN
IBM TCP/IP VPN for Warp                         
Version 4.32     Component ID 5639A6601
Current CSD level: UN02205
Prior   CSD level: UN02200

These machines were built 25+ years ago, and may have been partially patched, meaning that the syslevel files should be mostly correct. ;)

I do remember seeing years ago some tuning of the IP stack parameters, which is what triggered the question.

Cheers,
-Chris

Lars

  • Hero Member
  • *****
  • Posts: 1476
  • Karma: +74/-0
    • View Profile
Re: OS/2 IP Stack Hardening
« Reply #5 on: December 15, 2025, 09:29:55 am »
So, what machine gives you problems ?

It is obvious that "inet" is outdated and has no convenience package installed, in contrast to "main" which seems up-to-date.

And from Alex' website, I deduce that if you install convenience package 2 for WSeB, then that includes updates to the TCP/IP stack. Once you have done that, you can potentially install further updates as per Alex' website.

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #6 on: December 15, 2025, 11:23:41 pm »
Both go. Monthly at least.

I've tried applying CP2 to one of the machines, but it kills my desktop, so I gave up and copied the stack across from the machine that did work.

Patches are only a part of the problem.

The other, is what I was originally asking for, the hardening/tuning settings that can be applied to the stack to better protect it. Is there a list of settings and recommendations/script to run? That's exactly that I'm looking for.

Cheers,
-Chris

Ian B Manners

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 488
  • Karma: +10/-0
  • I am the computer, it is me.
    • View Profile
    • ComKal Networks Australia
Re: OS/2 IP Stack Hardening
« Reply #7 on: December 19, 2025, 04:02:02 am »
Hi Chris,

WSeB/Warp v4.52

Assuming you are using 'inetcfg -s all' in your setup.cmd file (check your mtu if you manually set it in setup.cmd as well).
These are the settings I have in x:/mptn/etc/inetcfg.ini

Code: [Select]
#Inetcfg: CURRENT DEFAULT MINIMUM MAXIMUM

keepalive 20 7800 0 7800 KeepAlive (sec)
tcpswinsize 128480 32768 1024 246723 TCP SendWindow Size
tcprwinsize 128480 32768 1024 246723 TCP RecvWindow Size
udpswinsize 64240 9216 1024 246723 UDP SendWindow Size
udprwinsize 64240 41600 1024 246723 UDP RecvWindow Size
lingertime 60 120 0 65535 Linger Time (sec)
probecnt 8 8 1 8 Number Of KeepAlive Probes
ipforward 1 0 0 1 IP Forwarding flag ON/OFF
mtudiscover 0 1 0 1 TCP Path MTU Discovery ON/OFF
arpkillc 1200 1200 180 15300 ARP Complete TimeOut (sec)
arpkilli 180 180 60 1200 ARP InComplete TimeOut (sec)
lipcstswinsize 64240 10240 1024 246723 LIPC Stream SendWindow Size
lipcstrwinsize 64240 10240 1024 246723 LIPC Stream RecvWindow Size
lipcdgswinsize 8030 2048 1024 246723 LIPC Dgram SendWindow Size
lipcdgrwinsize 8030 4096 1024 246723 LIPC Dgram RecvWindow Size
synattack 0 0 0 1 SYN Attack Flag ON/OFF
syncookie 0 0 0 1 SYN Cookie Flag ON/OFF
firewall 0 0 0 1 FIREWALL ON/OFF
multidefrt 0 1 0 1 Multiple Default Routes ON/OFF
winscale 1 1 0 1 TCP Window Scale ON/OFF
timestmp 0 0 0 1 TCP TimeStamps ON/OFF
realslow 20 20 1 100 TCP TW Q Slow Timeout ticks
perfhttp 1 1 0 1 Fast Path HTTP ON/OFF
tcpttl 64 64 1 255 TCP  TTL (hops)
udpttl 64 64 1 255 UDP  TTL (hops)
icmpttl 64 64 1 255 ICMP TTL (hops)
fragttl 60 60 1 255 Fragment TTL (sec)
reusetw 1 1 0 1 Reuse Time Wait ON/OFF
msl 60 30 1 16384 TCP MaxSegLifeTime (sec)
cc 0 0 0 1 TTCP function ON/OFF
sack 0 0 0 1 Selective ACK ON/OFF

Your mileage will vary depending on needs but with the amount of rubbish hitting my server when its on, I long ago changed 'keepalive' to 20 secs to stop socket attacks to some extent, along with using Injoys FW. With the speed of connections now, keepalive can likely be set to 10 sec.

multidefrt and ipforward depend on your needs
synattack and syncookie I leave to the firewall, and having them off improves the servers uptime to months.
arpkill I also leave to the firewall but you can reduce those if you have a direct inet connection.
some ICMP and udp packets are also clobbered at my firewall.
mtudiscover also depends on your server, router etc. I turn it off for the server but it needs to be changed depending on your service provider if done manuallly.

The past 24 months, the internet has so much crud hitting servers it has become difficult to self host.
Cheers
Ian B Manners

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #8 on: December 23, 2025, 12:52:53 am »
Legend!
What I was looking for THANK YOU!!!!

In the end, a machine that I built in the late 90's or so was too crippled to update (and that's before getting to the PMShell Desktop handle issues...).

So I bit the bullet and rebuilt it. I just mounted the old crippled Drive C to act as a reference/config source, so I could copy existing settings (nfs mounts, tcpnbk.lst, pinghost.lst and most importantly the DDNS configs) across.

I got so annoyed that I even set up RSU files for all of the fix packs, but lost them when I rolled the VM snapshot back.

If anyone has any interest, I'll re-create them, as they aren't too hard at all, and I'll host them (FP's included), so basically a one-click update (per FP). That should make someone's life easier. I've been able to mirror bits of public.dhe.ibm.com/ps/products/os2/ that I need, but good old ftp to service.ibm.com is long gone and anonymous no longer works. Not sure if RSU can https these (with newer relevant TLS certs no less), hence me hosting via ftp.

Let me know and I'll have a bit of fun and put them up.

I'm actually running the OS/2 hosts as MS Virtual PC (V7) running in an XP VM on ESX V7. ;) The hardest bit of all of that it getting the initial install done until you can add the MS Virtual PC additions and THEN the mouse starts behaving to make it usable. :) So cloning VM's, coping disks etc is really easy and quick.

Cheers to all! Thanks for the help.

Ian B Manners

  • Global Moderator
  • Sr. Member
  • *****
  • Posts: 488
  • Karma: +10/-0
  • I am the computer, it is me.
    • View Profile
    • ComKal Networks Australia
Re: OS/2 IP Stack Hardening
« Reply #9 on: December 23, 2025, 02:39:42 am »
Hi Chris,

If it is of help, I created os2serv updates in the https://www.os2site.com/sw/upgrades/ directories.
One example is in https://www.os2site.com/sw/upgrades/wseb/fixpack3/zip/index.html which is the WSeB FP3. Instructions are in the install.txt file.

I have my original OS/2 Warp3 from the 90's, which has been updated over the decades to OS/2 Warp 4.x running in Virtualbox under Ubuntu. Use it for PMView, PMMail and a few other OS/2 related programs etc. OS/2 has always been an reasonably easy OS to transfer between media and computers. Almost blew it away to start again over the years but managed to get it working again after various um.. mishaps.. so I still call it my original install after v2.11 that Gavin Povey from IBM gave me.

Still an enjoyable OS to use and maintain.
Cheers
Ian B Manners

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #10 on: December 23, 2025, 11:35:01 am »
Cool.

But.

Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=service.boulder.ibm.com anonymous pspdist@vnet.ibm.com ps/products/os2/rsu/xr_e003
FTP_SITE=service.boulder.ibm.com anonymous pspdist@vnet.ibm.com
PKG_FILE={
  NAME=ps/products/os2/rsu/csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

Does that RSU file actually work? Given that I can't FTP to service.boulder.ibm.com (TLS failure).


ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #11 on: December 23, 2025, 11:50:22 am »
I got this working.

Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=ftp.warpspeed.com.au Updates Updates ./XR_E003
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=./csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

Only to find that it's for WSeB 4.50 (base) only. It did not recognize that it had anything to do on the WSeB CP2 XR04502 host. What FP do I need for that?

Honestly, it's been that long that I don't even remember what XR_D.. XR_C.. etc are even for these days. I'm getting old! lol. 60 next year. Ugh. But hey, I only just turned 59 last month! :)

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #12 on: December 24, 2025, 06:33:08 am »
For anyone that's interested, I've created an XR_C005.rsu file and the necessary ftpinstl.zip - actually it was the xr_c005.tbl file that was the hard bit - I have zero clue as to what CRC method they are using, as it matches none of mine. However, put a dummy one in (FFFFFFFF) and it will whinge and tell you it's the wrong one, but it tells you what it wants! :)

Anyhoo,

Enjoy.

Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=ftp.warpspeed.com.au Updates Updates ./XR_C005
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=./csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

If someone wants to test it (I have), feel free - let me know how you go.

Now to do the RSU's for the rest of the stack. :)

ChrisGWarp

  • Newbie
  • *
  • Posts: 30
  • Karma: +3/-0
    • View Profile
    • WarpSpeed Computers
Re: OS/2 IP Stack Hardening
« Reply #13 on: December 24, 2025, 10:35:39 am »
And here they all are. All fully hosted.  ;D
 8)

IP08608.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=INSTFIXP.CMD
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=.\IP08608\IP08608.ZIP
  UNZIP=Y
  FILE_SIZE=4508654
  UNZIPPED_SIZE=5338365
  MODE=B
}

UN02334.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=INSTFIXP.CMD
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=.\UN02334\UN02334.ZIP
  UNZIP=Y
  FILE_SIZE=5568935
  UNZIPPED_SIZE=6232522
  MODE=B
}

WR08708.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=INSTFIXP.CMD
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=.\WR08708\WR08708.ZIP
  UNZIP=Y
  FILE_SIZE=3076593
  UNZIPPED_SIZE=3741666
  MODE=B
}

xr_c005.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=ftp.warpspeed.com.au Updates Updates ./XR_C005
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=./csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

xr_d003.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=ftp.warpspeed.com.au Updates Updates ./XR_D003
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=./csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

xr_e003.rsu
Code: [Select]
INSTALL_TYPE=R
INSTALL_PGM=ftpinstl.exe pristine
INSTALL_PARMS=ftp.warpspeed.com.au Updates Updates ./XR_E003
FTP_SITE=ftp.warpspeed.com.au Updates Updates
PKG_FILE={
  NAME=./csf144.zip
  UNZIP=Y
  FILE_SIZE=1500000
  UNZIPPED_SIZE=42500000
  MODE=B
}

Enjoy!

Anyone game for a XR_C006 ?  :o
« Last Edit: December 25, 2025, 11:23:36 am by ChrisGWarp »