[69820] in North American Network Operators' Group
Re: TCP RST attack (the cause of all that MD5-o-rama)
daemon@ATHENA.MIT.EDU (Valdis.Kletnieks@vt.edu)
Tue Apr 20 17:01:25 2004
To: "Patrick W.Gilmore" <patrick@ianai.net>
Cc: nanog@merit.edu
In-Reply-To: Your message of "Tue, 20 Apr 2004 15:40:38 EDT."
<99C2AAA0-9302-11D8-B101-000A9578BB58@ianai.net>
From: Valdis.Kletnieks@vt.edu
Date: Tue, 20 Apr 2004 16:49:01 -0400
Errors-To: owner-nanog-outgoing@merit.edu
--==_Exmh_164603684P
Content-Type: text/plain; charset=us-ascii
On Tue, 20 Apr 2004 15:40:38 EDT, "Patrick W.Gilmore" said:
> Assuming a well randomized starting sequence number (just give me this
> one for the moment),
Nope. I won't give you that one, because that's a big chunk of the
problem:
http://lcamtuf.coredump.cx/newtcp/ (one year later)
http://razor.bindview.com/publish/papers/tcpseq.html (original paper)
It seems that Cisco has its act mostly together, but a *LOT* of other
vendors don't, even a year after...
--==_Exmh_164603684P
Content-Type: application/pgp-signature
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
Comment: Exmh version 2.5 07/13/2001
iD8DBQFAhYy8cC3lWbTT17ARAmaZAJ9cW2CKMmtQCvOeZW/gWeoeBIaUvwCdHS/6
8p5nj69oZHPBxK4U35Zbi7w=
=Cbab
-----END PGP SIGNATURE-----
--==_Exmh_164603684P--