Randomizing tcp initial sequence numbers, and IP id field

Home › Forums › Discussions › Support › Randomizing tcp initial sequence numbers, and IP id field

Viewing 2 posts - 1 through 2 (of 2 total)
  • Author
    Posts
  • September 2, 2004 at 9:33 am #5612
    krisleech
    Participant

      not worked with ‘random’ seq field but i have heard about the use of strange atractors – they are part of choas theory and show patterns in disorder or order in disorder. A graph showing the strange attractor shows a line that follows a pattern but never repeats the same path twice and leeps from negative to posative at ‘random’ intervals. Could be useful.

      Kris,

      September 7, 2004 at 4:48 pm #5613
      Wyatt
      Participant

        Thanks krisleech, the randomization you are talking about is a little further than even I was looking for. We just want to randomize the initial sequence numbers, not all the sequence numbers. Let me give you some stats from our research to show you what we a looking for. The following is 2 lists of initial sequence numbers seen by a target destination. The first is a list of ISNs (initial sequence numbers) seen from a normal Microsoft windows 2000 host directly connected. Note there is some randomizaiton. The second is with a PIX 525 inline between the source (2 windows 2000 hosts) and the destination (the same target host). The PIX greatly improved the randomization of the ISNs. These should highlight the differences and level of randomization we would like to see:
        1.BASELINE (no firewall involved, just Microsoft’s native randomizing)
        3821792392
        3822536869
        3823369052
        -1min pause
        3834763729
        3835673715
        3836565869
        -1min pause
        3848653605
        3849412963
        3850277338
        -1min pause
        3862514801 suspicious
        3863329333
        3863993408
        -1min pause
        3876307621
        3877050874
        3877880730
        15. PIX firewall – future reference ethereal capture c:temppix2.txt

        FIREWALL INSIDE INTERFACE SAW: 245852646 (from comp1)
        246488339 (from comp1)
        247409802 (from comp1)
        247997942 (from comp1)
        248683549 (from comp1)
        3005282343(from comp2)
        3005947206(from comp2)
        3006637540(from comp2)
        3007270429(from comp2)
        3007936591(from comp2)
        DESTINATION SAW the following ISNs in order, for the above packets:
        497976609
        698736491
        1144843323
        1753896461
        2045921313
        85892628
        3876006248
        3622132887
        489476749
        174402616
        – no comparison right? The PIX, in it’s state table, runs its own list of sequence numbers which allows it to greatly improve randomization. That is what we are looking for using Winpkfilter. Well that, and the randomization of the IP id field, which is simple compared to ISNs.

        Does anyone have a copy of a program in which they have manipulated tcp/ip fields that works, that we could get a copy of? Thank you.

      • Author
        Posts
      Viewing 2 posts - 1 through 2 (of 2 total)
      • You must be logged in to reply to this topic.