From owner-freebsd-security@FreeBSD.ORG Wed Apr 21 04:52:17 2004 Return-Path: Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id A60DB16A4CE for ; Wed, 21 Apr 2004 04:52:17 -0700 (PDT) Received: from gw.celabo.org (gw.celabo.org [208.42.49.153]) by mx1.FreeBSD.org (Postfix) with ESMTP id 6134743D41 for ; Wed, 21 Apr 2004 04:52:17 -0700 (PDT) (envelope-from nectar@celabo.org) Received: from localhost (localhost [127.0.0.1]) by gw.celabo.org (Postfix) with ESMTP id E3CD554898; Wed, 21 Apr 2004 06:52:16 -0500 (CDT) Received: from gw.celabo.org ([127.0.0.1]) by localhost (hellblazer.celabo.org [127.0.0.1]) (amavisd-new, port 10024) with SMTP id 84127-07; Wed, 21 Apr 2004 06:52:06 -0500 (CDT) Received: from lum.celabo.org (lum.celabo.org [10.0.1.107]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client CN "lum.celabo.org", Issuer "celabo.org CA" (verified OK)) by gw.celabo.org (Postfix) with ESMTP id 8FEEA54889; Wed, 21 Apr 2004 06:51:25 -0500 (CDT) Received: by lum.celabo.org (Postfix, from userid 501) id 2246E1D0C50; Wed, 21 Apr 2004 06:31:30 -0500 (CDT) Date: Wed, 21 Apr 2004 06:31:30 -0500 From: "Jacques A. Vidrine" To: Dragos Ruiu Message-ID: <20040421113130.GA19738@lum.celabo.org> Mail-Followup-To: "Jacques A. Vidrine" , Dragos Ruiu , Mike Tancsa , Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?= , freebsd-security@freebsd.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <200404201332.40827.dr@kyx.net> X-Url: http://www.celabo.org/ User-Agent: Mutt/1.5.6i cc: freebsd-security@freebsd.org cc: Dag-Erling =?iso-8859-1?Q?Sm=F8rgrav?= Subject: Re: TCP RST attack X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.1 Precedence: list List-Id: Security issues [members-only posting] List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 21 Apr 2004 11:52:17 -0000 On Tue, Apr 20, 2004 at 01:32:40PM -0700, Dragos Ruiu wrote: > That's what this thing boils down to imho - the > space you have to blast through, the time you have to do it in, and > the bandwidth/rate available to do it. And there are competing factors, > and questions about what are the real world values. I'm still waiting > on final answers... Consider that on a T1, you can generate 1536 Mbps = ~4800 RSTs per second. If you know ((src addr, src port), (dst addr, dst port)), and assume a 32K window, then you need to send at most about 2^17 RST packets to hit your target. 2^17 / 4800 =~ 27 seconds. If you have to guess the source port, then we're talking about 2^16 times as many packets needed, which is still `only' about 20 days. Of course, the window is sliding during that time... I'm not sure right now if that makes your chances better or worse :-) Cheers, -- Jacques Vidrine / nectar@celabo.org / jvidrine@verio.net / nectar@freebsd.org