Date: Wed, 30 Apr 2003 16:35:24 -0500 (CDT) From: Mike Silbersack <silby@silby.com> To: Garrett Wollman <wollman@lcs.mit.edu> Cc: net@FreeBSD.org Subject: Re: Reducing ip_id information leakage Message-ID: <20030430162628.A3741@odysseus.silby.com> In-Reply-To: <200304302018.h3UKIpcF055535@khavrinen.lcs.mit.edu> References: <200304292247.h3TMlpPU044307@khavrinen.lcs.mit.edu> <200304302018.h3UKIpcF055535@khavrinen.lcs.mit.edu>
next in thread | previous in thread | raw e-mail | index | archive | help
On Wed, 30 Apr 2003, Garrett Wollman wrote: > What we'd really like is cheap random sequences on Z/65536Z. It is > fairly trivial to generate cheap non-random sequences on that group -- > there's a whole family of trivial ones, but these are easy to analyze. > Ultimately I don't think it's really worth that much effort, and the > DF trick, since it's normally enabled for all TCP sessions, gives us > 99% of the value at 0.1% of the cost. > > -GAWollman I think that even a trivial pseudo-random sequence would be good to implement. With the standard ip_id++ sequence, you can precisely monitor the number of packets sent and also determine if two IPs are shared by the machine without any work. Any sort of psuedo-random sequence would at least require you to go through some work to determine any information. I have this nagging feeling that taking most TCP sessions out of the equation makes the obfuscation of the remaining ip_id'd packets more important, but I can't figure out why exactly. Do we set the DF flag on most UDP and ICMP packets? Mike "Silby" Silbersack
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030430162628.A3741>