[4996] in North American Network Operators' Group
Re: DoS, ICMP, proxies, SYNDefender
daemon@ATHENA.MIT.EDU (Perry E. Metzger)
Thu Oct 3 20:20:14 1996
To: Tim Bass <bass@linux.silkroad.com>
cc: nanog@merit.edu, iepg@iepg.org
In-reply-to: Your message of "Thu, 03 Oct 1996 19:24:51 EDT."
<199610032324.TAA00261@linux.silkroad.com>
Reply-To: perry@piermont.com
Date: Thu, 03 Oct 1996 20:03:35 -0400
From: "Perry E. Metzger" <perry@piermont.com>
Tim Bass writes:
> If you are an attacker and know your target host is about
> to set up a connection with a particular host address,
> then if you timed it exactly right you could nuke the
> connection during one state of the TCP connection,
> SYN_RCVD.
Yup. If you don't think this is a serious problem, well, I can think
right away of how to use such a defect to cause serious harm to the
infrastructure of the net. Indeed, I can think of two.
We are trying to reduce the number of ways that forged packets can be
used to cause harm, not open new ones.
> So, if you can guess sequence numbers, ip addresses, and the
> exact state on the connection..... er..
What makes you think you can't? You CAN guess sequence numbers, and
pretty consistantly. The paper by Bob Morris on how to do it is nearly
a decade old.
We have a simple and practical pair of ways of dealing with this:
ingress filtering and host hardening. Lets stick with things that
cause no additional harm, shall we?
Perry
