Return to MORE-FUN-WITH-IPID CVS log

Up to [ELWIX - Embedded LightWeight unIX -] / embedaddon / hping2 / docs

Annotation of embedaddon/hping2/docs/MORE-FUN-WITH-IPID, revision 1.1

1.1     ! misho       1: Posted to bugtraq mailing list (20 Nov 1999):
        !             2: 
        !             3: ---
        !             4: Hi,
        !             5: 
        !             6: some little new ideas about IP ID issue:
        !             7: 
        !             8: The first is about linux firewalling: since it increase IP ID global counter
        !             9: even if an outgoing packet will be filtered we are able, for example, to
        !            10: scan UDP ports even if ICMP type 3 output is DENY, and in general it is possibleto know when TCP/IP stack reply a packet even if the reply is dropped.
        !            11: I think (but not tested) that this is true for almost all firewalls.
        !            12: 
        !            13: The second issue concern the ability to uncover firewall rules. For example
        !            14: it is travial to know if host A filter packets from the IP X.Y.Z.W monitoring
        !            15: IP ID incresing of host A or host with X.Y.Z.W address (this changes if we are
        !            16: interested to know input or output rules) and sending packets that suppose
        !            17: some reply. Also this is related with the ability to scan the ports of hosts
        !            18: that drop all packets with a source different than host.trusted.com.
        !            19: There are others stuff like this but they are only different faces of the
        !            20: same concepts.
        !            21: 
        !            22: Some people thinks that this kind of attacks isn't a "real world" attacks,
        !            23: I'm strongly interested to know what's bugtraq readers opinion (IMO this
        !            24: kind of attacks are feasible and usefull for an attacker. For exaple the
        !            25: ability to scan the ports with only spoofed packets and the ability to
        !            26: guess remote hosts traffic are a lot real).
        !            27: 
        !            28: ciao,
        !            29: antirez