From owner-freebsd-net Mon Apr 16 2: 3:22 2001 Delivered-To: freebsd-net@freebsd.org Received: from obsecurity.dyndns.org (adsl-63-207-60-139.dsl.lsan03.pacbell.net [63.207.60.139]) by hub.freebsd.org (Postfix) with ESMTP id DC9B537B422; Mon, 16 Apr 2001 02:03:15 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id C6CB866D8B; Mon, 16 Apr 2001 02:03:11 -0700 (PDT) Date: Mon, 16 Apr 2001 02:03:11 -0700 From: Kris Kennaway To: Mike Silbersack Cc: Mark T Roberts , freebsd-security@FreeBSD.ORG, net@FreeBSD.org Subject: Re: non-random IP IDs Message-ID: <20010416020311.A1292@xor.obsecurity.org> References: <001f01c0c30b$805b0840$d2e2fdce@netrex.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="fdj2RfSjLxBAspz7" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: ; from silby@silby.com on Thu, Apr 12, 2001 at 12:40:32AM -0500 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --fdj2RfSjLxBAspz7 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Thu, Apr 12, 2001 at 12:40:32AM -0500, Mike Silbersack wrote: > Each IP packet sent has with it a 16-bit ID. The numbers must remain > unique over a short period of time so fragmentation can work properly. As > such, everything except recent openbsds simple increments the id by 1 for > each packet sent out. >=20 > As a result, you can tell the number of packets sent on an idle host by > seeing the difference in id numbers for the packets it sends back to you. > It's not really that important of an issue, don't worry about it. Here's a patch ported from OpenBSD which randomizes this (supposedly such that it respects the constraint of not wrapping within the prescribed time period). I should wrap it in a sysctl, I guess. http://www.freebsd.org/~kris/ipid.patch Comments? Kris --fdj2RfSjLxBAspz7 Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE62rVOWry0BWjoQKURAmEnAKCPsC4cKouTayuBqji58oWOUH22DACdF7A0 3Is0lLB0DmTyUzAHsY6q/rU= =WMzk -----END PGP SIGNATURE----- --fdj2RfSjLxBAspz7-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message