Dead Gateway Detection: The TCP Failover That Hands Attackers Your Traffic

Windows ships with a small, well-intentioned TCP feature called Dead Gateway Detection. If your machine has more than one default gateway configured and the primary stops answering, TCP will quietly move active connections over to a backup gateway so your traffic keeps flowing. Useful in a multi-homed data-centre server. On a laptop or a workstation, it is an attack surface almost nobody thinks about.

How the attack works

The feature is controlled by whether TCP treats a burst of retransmissions as a signal that the current gateway is “dead.” The problem: nothing about that signal is authenticated. An attacker on the same layer-2 segment who can inject spoofed TCP RST packets (or otherwise drive up retransmissions to a target) can convince the victim’s stack that its real gateway has failed — and trigger a failover to a gateway the attacker controls.

Once traffic is flowing through the attacker’s box, it is the same end state as an ARP-spoofing or rogue-DHCP man-in-the-middle: they can read, tamper with, or blackhole everything the victim sends off-subnet. The difference is that dead-gateway failover leaves far fewer of the usual fingerprints — there is no gratuitous ARP storm, no second DHCP server on the wire, just a host quietly deciding to use a different next hop.

Why it’s in the same family as ICMP redirects and IRDP

Windows has a whole cluster of legacy network-layer features that let the network, rather than the administrator, decide where a host sends its packets:

• ICMP Redirects (EnableICMPRedirect) — a forged Type 5 packet installs a bogus host route.
• ICMP Router Discovery / IRDP (PerformRouterDiscovery) — a forged Router Advertisement installs a rogue default gateway.
• IPv4 Source Routing (DisableIPSourceRouting) — a packet dictates its own return path, bypassing anti-spoofing filters.
• Dead Gateway Detection (EnableDeadGWDetect) — retransmissions trigger a silent failover to a backup gateway.

Every one of these is a route-injection primitive, and every one is enabled or partially enabled by default. The CIS Windows Benchmark and Microsoft’s MSS hardening guidance recommend turning all of them off on endpoints that don’t genuinely need multi-gateway failover — which is nearly all of them.

The fix

Dead Gateway Detection is governed by a single machine-wide DWORD:

HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\EnableDeadGWDetect

Set it to 0 to disable the failover behaviour, then reboot (the TCP/IP stack reads this value at start-up):

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters' -Name EnableDeadGWDetect -Value 0

The catch is knowing the value is wrong in the first place. Windows enables dead-gateway detection by default, and a missing key is just as exposed as an explicit 1 — so “I never configured this” is not the safe state, it’s the vulnerable one.

How WinSentinel checks it

WinSentinel’s Network module reads EnableDeadGWDetect as part of a single-machine audit and grades it the same fail-safe way it grades the ICMP redirect, IRDP and source-routing controls:

• Pass only when the value is explicitly 0 (detection disabled).
• Warn when it is 1 or absent — because the Windows default is exposed.
• Warn when the value can’t be read at all, rather than silently assuming it’s fine.

The finding ships with the exact one-line remediation above, so you can go from “flagged” to “fixed” without leaving the report. It runs entirely locally — no agent, no cloud, no account — on every machine, free.

Run winsentinel --audit to see your machine’s full network-posture report, including Dead Gateway Detection and the rest of the route-injection family, in about a minute.