From owner-freebsd-net@FreeBSD.ORG Wed Apr 30 15:20:38 2003 Return-Path: Delivered-To: freebsd-net@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 4DBA737B401 for ; Wed, 30 Apr 2003 15:20:38 -0700 (PDT) Received: from ints.mail.pike.ru (ints.mail.pike.ru [195.9.45.194]) by mx1.FreeBSD.org (Postfix) with ESMTP id B53F443FB1 for ; Wed, 30 Apr 2003 15:20:36 -0700 (PDT) (envelope-from babolo@cicuta.babolo.ru) Received: (qmail 86149 invoked from network); 30 Apr 2003 22:39:04 -0000 Received: from babolo.ru (HELO cicuta.babolo.ru) (194.58.226.160) by ints.mail.pike.ru with SMTP; 30 Apr 2003 22:39:04 -0000 Received: (nullmailer pid 1573 invoked by uid 136); Wed, 30 Apr 2003 22:23:44 -0000 X-ELM-OSV: (Our standard violations) hdr-charset=KOI8-R; no-hdr-encoding=1 In-Reply-To: <200304302142.h3ULgZ0i056433@khavrinen.lcs.mit.edu> To: Garrett Wollman Date: Thu, 1 May 2003 02:23:44 +0400 (MSD) From: "."@babolo.ru X-Mailer: ELM [version 2.4ME+ PL99b (25)] MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset=US-ASCII Message-Id: <1051741424.259802.1572.nullmailer@cicuta.babolo.ru> cc: net@FreeBSD.org Subject: Re: Reducing ip_id information leakage X-BeenThere: freebsd-net@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Networking and TCP/IP with FreeBSD List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 30 Apr 2003 22:20:38 -0000 > < said: > > > I think that even a trivial pseudo-random sequence would be good to > > implement. With the standard ip_id++ sequence, you can precisely monitor > > the number of packets sent and also determine if two IPs are shared by the > > machine without any work. > > See Bellovin's paper for how to do it for any fixed increment without > much work. > > The trouble is that we need sequences that are guaranteed not to > repeat too fast -- and even then we'll still break on modern networks > anyway, as I noted in my comment. Why not to use 16 bit of 32 bit pseudorandom generator? > Solaris apparently goes out of its way to create a different ip_id > sequence for every combination of (which is allowed), > but this still doesn't buy you much if your system is capable of > performing NFSv2 transactions at 100 Mbit/s. > > > I have this nagging feeling that taking most TCP sessions out of the > > equation makes the obfuscation of the remaining ip_id'd packets more > > important, but I can't figure out why exactly. > > I feel rather the opposite. > > > Do we set the DF flag on most UDP and ICMP packets? > > ping(8) can set it, but the kernel is not able to do so, since it > can't predict the MTU in advance of sending the ICMP.