From owner-freebsd-net@FreeBSD.ORG  Wed Apr 30 13:18:54 2003
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP id 1272F37B401
	for <net@FreeBSD.org>; Wed, 30 Apr 2003 13:18:54 -0700 (PDT)
Received: from khavrinen.lcs.mit.edu (khavrinen.lcs.mit.edu [18.24.4.193])
	by mx1.FreeBSD.org (Postfix) with ESMTP id 4A66043F93
	for <net@FreeBSD.org>; Wed, 30 Apr 2003 13:18:53 -0700 (PDT)
	(envelope-from wollman@khavrinen.lcs.mit.edu)
Received: from khavrinen.lcs.mit.edu (localhost [IPv6:::1])
	by khavrinen.lcs.mit.edu (8.12.9/8.12.9) with ESMTP id h3UKIpVo055538
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
	Wed, 30 Apr 2003 16:18:52 -0400 (EDT)
	(envelope-from wollman@khavrinen.lcs.mit.edu)
Received: (from wollman@localhost)
	by khavrinen.lcs.mit.edu (8.12.9/8.12.9/Submit) id h3UKIpcF055535;
	Wed, 30 Apr 2003 16:18:51 -0400 (EDT)
	(envelope-from wollman)
Date: Wed, 30 Apr 2003 16:18:51 -0400 (EDT)
From: Garrett Wollman <wollman@lcs.mit.edu>
Message-Id: <200304302018.h3UKIpcF055535@khavrinen.lcs.mit.edu>
To: Mike Silbersack <silby@silby.com>
In-Reply-To: <20030430015609.M514@odysseus.silby.com>
References: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu>
	<20030430015609.M514@odysseus.silby.com>
X-Spam-Score: -19.8 ()
	IN_REP_TO,QUOTED_EMAIL_TEXT,REFERENCES,REPLY_WITH_QUOTES
X-Scanned-By: MIMEDefang 2.33 (www . roaringpenguin . com / mimedefang)
cc: net@FreeBSD.org
Subject: Re: Reducing ip_id information leakage
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Apr 2003 20:18:54 -0000

<<On Wed, 30 Apr 2003 01:58:36 -0500 (CDT), Mike Silbersack <silby@silby.com> said:

> Looks good to me, I've been contemplating doing just this for a while.

> It's too bad we don't have an inexpensive function we can use for the !DF
> case.  I'd like to make the OpenBSD function the default for frag packets,
> but it seems just too heavyweight..

What we'd really like is cheap random sequences on Z/65536Z.  It is
fairly trivial to generate cheap non-random sequences on that group --
there's a whole family of trivial ones, but these are easy to analyze.
Ultimately I don't think it's really worth that much effort, and the
DF trick, since it's normally enabled for all TCP sessions, gives us
99% of the value at 0.1% of the cost.

-GAWollman