From owner-freebsd-security Mon Apr 16 20:39: 1 2001 Delivered-To: freebsd-security@freebsd.org Received: from silby.com (adam042-060.resnet.wisc.edu [146.151.42.60]) by hub.freebsd.org (Postfix) with ESMTP id 7D03137B43C for ; Mon, 16 Apr 2001 20:38:58 -0700 (PDT) (envelope-from silby@silby.com) Received: (qmail 16693 invoked by uid 1000); 17 Apr 2001 03:38:52 -0000 Received: from localhost (sendmail-bs@127.0.0.1) by localhost with SMTP; 17 Apr 2001 03:38:52 -0000 Date: Mon, 16 Apr 2001 22:38:52 -0500 (CDT) From: Mike Silbersack To: Julian Elischer Cc: Darren Reed , Kris Kennaway , Mark T Roberts , , Subject: Re: non-random IP IDs In-Reply-To: <3ADBB93B.3C9DC3DE@elischer.org> Message-ID: MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII Sender: owner-freebsd-security@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org On Mon, 16 Apr 2001, Julian Elischer wrote: > there is a site that calculates server uptime from these numbers. > All the leading machines are freeBSD. When you do this it will > no-longer be able to track us :-( They're using TCP timestamps to do that, not ip ids. And if I get my way, those will be unuseable for uptime detection soon enough... :) > what is the problem in having these numbers sequential? Anonymous port scans, some firewall probing as mentioned by darren, and the ability to see the idleness of a host. Not enough to make randomization the default policy, but certainly enough to justify a sysctl. Mike "Silby" Silbersack To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-security" in the body of the message