Skip site navigation (1)Skip section navigation (2)
Date:      Mon, 16 Apr 2001 02:03:11 -0700
From:      Kris Kennaway <kris@obsecurity.org>
To:        Mike Silbersack <silby@silby.com>
Cc:        Mark T Roberts <newsletter@marktroberts.com>, freebsd-security@FreeBSD.ORG, net@FreeBSD.org
Subject:   Re: non-random IP IDs
Message-ID:  <20010416020311.A1292@xor.obsecurity.org>
In-Reply-To: <Pine.BSF.4.31.0104120035120.2153-100000@achilles.silby.com>; from silby@silby.com on Thu, Apr 12, 2001 at 12:40:32AM -0500
References:  <001f01c0c30b$805b0840$d2e2fdce@netrex.com> <Pine.BSF.4.31.0104120035120.2153-100000@achilles.silby.com>

next in thread | previous in thread | raw e-mail | index | archive | help

--fdj2RfSjLxBAspz7
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Thu, Apr 12, 2001 at 12:40:32AM -0500, Mike Silbersack wrote:

> Each IP packet sent has with it a 16-bit ID.  The numbers must remain
> unique over a short period of time so fragmentation can work properly.  As
> such, everything except recent openbsds simple increments the id by 1 for
> each packet sent out.
>=20
> As a result, you can tell the number of packets sent on an idle host by
> seeing the difference in id numbers for the packets it sends back to you.
> It's not really that important of an issue, don't worry about it.

Here's a patch ported from OpenBSD which randomizes this (supposedly
such that it respects the constraint of not wrapping within the
prescribed time period).  I should wrap it in a sysctl, I guess.

  http://www.freebsd.org/~kris/ipid.patch

Comments?

Kris

--fdj2RfSjLxBAspz7
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.4 (FreeBSD)
Comment: For info see http://www.gnupg.org

iD8DBQE62rVOWry0BWjoQKURAmEnAKCPsC4cKouTayuBqji58oWOUH22DACdF7A0
3Is0lLB0DmTyUzAHsY6q/rU=
=WMzk
-----END PGP SIGNATURE-----

--fdj2RfSjLxBAspz7--

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-net" in the body of the message




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20010416020311.A1292>