From owner-freebsd-net Mon Apr 16 23:30:49 2001 Delivered-To: freebsd-net@freebsd.org Received: from obsecurity.dyndns.org (adsl-63-207-60-27.dsl.lsan03.pacbell.net [63.207.60.27]) by hub.freebsd.org (Postfix) with ESMTP id 8608637B42C; Mon, 16 Apr 2001 23:30:43 -0700 (PDT) (envelope-from kris@obsecurity.org) Received: by obsecurity.dyndns.org (Postfix, from userid 1000) id 0CE8F66D8B; Mon, 16 Apr 2001 23:30:43 -0700 (PDT) Date: Mon, 16 Apr 2001 23:30:42 -0700 From: Kris Kennaway To: Matt Dillon Cc: Niels Provos , Kris Kennaway , Wes Peters , freebsd-security@FreeBSD.ORG, net@FreeBSD.ORG, provos@OpenBSD.org Subject: Re: non-random IP IDs Message-ID: <20010416233042.A21394@xor.obsecurity.org> References: <20010416214611.6DA3F207C1@citi.umich.edu> <200104170157.f3H1v4d87804@earth.backplane.com> Mime-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-md5; protocol="application/pgp-signature"; boundary="LQksG6bCIzRHxTLp" Content-Disposition: inline User-Agent: Mutt/1.2.5i In-Reply-To: <200104170157.f3H1v4d87804@earth.backplane.com>; from dillon@earth.backplane.com on Mon, Apr 16, 2001 at 06:57:04PM -0700 Sender: owner-freebsd-net@FreeBSD.ORG Precedence: bulk X-Loop: FreeBSD.org --LQksG6bCIzRHxTLp Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Mon, Apr 16, 2001 at 06:57:04PM -0700, Matt Dillon wrote: >=20 > :No reasoning. You do not need the htons(). The fragment ids just > :need to be unique. An htons() does not change that property. I dont > :like that code very much. A variable-block-size cipher in counter > :mode would do the job better. > : > :However, what many ppl do not realize is that you can use predictable > :ip ids to anonymously port scan machines. Bugtraq talks about how to > :do that. > : > :Niels. >=20 > It's not worth doing. We would be introducing unnecessary cpu burn on > every single packet we sent out, all to solve a problem that doesn't > really exist. Well, that's why it's a sysctl defaulting to off in my patch. Don't turn it on if you don't want to. Kris --LQksG6bCIzRHxTLp Content-Type: application/pgp-signature Content-Disposition: inline -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.0.4 (FreeBSD) Comment: For info see http://www.gnupg.org iD8DBQE62+MSWry0BWjoQKURAgE9AJ96+j/E1Qs1Z1zMQq98Ig3S2lXjcwCg6V9k sRXiXBxL0MznuvHiSe7j/vk= =rx/L -----END PGP SIGNATURE----- --LQksG6bCIzRHxTLp-- To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-net" in the body of the message