[69820] in North American Network Operators' Group

home help back first fref pref prev next nref lref last post

Re: TCP RST attack (the cause of all that MD5-o-rama)

daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue Apr 20 17:01:25 2004

To: "Patrick W.Gilmore" <patrick@ianai.net>
Cc: nanog@merit.edu
In-Reply-To: Your message of "Tue, 20 Apr 2004 15:40:38 EDT."
             <99C2AAA0-9302-11D8-B101-000A9578BB58@ianai.net> 
From: Valdis.Kletnieks@vt.edu
Date: Tue, 20 Apr 2004 16:49:01 -0400
Errors-To: owner-nanog-outgoing@merit.edu


--==_Exmh_164603684P
Content-Type: text/plain; charset=us-ascii

On Tue, 20 Apr 2004 15:40:38 EDT, "Patrick W.Gilmore" said:

> Assuming a well randomized starting sequence number (just give me this 
> one for the moment),

Nope.  I won't give you that one, because that's a big chunk of the
problem:

http://lcamtuf.coredump.cx/newtcp/ (one year later)
http://razor.bindview.com/publish/papers/tcpseq.html  (original paper)

It seems that Cisco has its act mostly together, but a *LOT* of other
vendors don't, even a year after...

--==_Exmh_164603684P
Content-Type: application/pgp-signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001

iD8DBQFAhYy8cC3lWbTT17ARAmaZAJ9cW2CKMmtQCvOeZW/gWeoeBIaUvwCdHS/6
8p5nj69oZHPBxK4U35Zbi7w=
=Cbab
-----END PGP SIGNATURE-----

--==_Exmh_164603684P--

home help back first fref pref prev next nref lref last post