LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - General
User Name
Password
Linux - General This Linux forum is for general Linux questions and discussion.
If it is Linux Related and doesn't seem to fit in any other forum then this is the place.

Notices

Reply
 
Search this Thread
Old 12-16-2006, 05:45 AM   #1
introuble
Member
 
Registered: Apr 2004
Distribution: Debian -unstable
Posts: 700

Rep: Reputation: 31
TCP Sequence Prediction


Following an nmap scan against localhost, I get this:

Quote:
TCP Sequence Prediction: Difficulty=201 (Good luck!)
IPID Sequence Generation: All zeros
This is on .. a day old Debian System. Now.. something tells me this is not a good thing security wise. I remember on the old Debian box (before the recent reinstall) a relatively high Difficulty, and the "IPID Sequence Generation" to be "Random positive increments" (or something). I also remember on a FreeBSD box that the TCP SP Difficulty was "999..."; "IPID Seq Gen:" was "Truly Random".

All in all.. how do I increase the difficulty of the tcp sequence prediction [who/what gives this difficulty?] and the "IPID Seq Generation" ?
 
Old 12-16-2006, 07:41 AM   #2
matthewg42
Senior Member
 
Registered: Oct 2003
Location: UK
Distribution: Kubuntu 12.10 (using awesome wm though)
Posts: 3,530

Rep: Reputation: 63
It's down to the TCP implementation in the kernel. Not sure how to change it - maybe there is a kernel build option.
 
Old 12-16-2006, 07:43 AM   #3
matthewg42
Senior Member
 
Registered: Oct 2003
Location: UK
Distribution: Kubuntu 12.10 (using awesome wm though)
Posts: 3,530

Rep: Reputation: 63
This is an interesting article on the subject: http://www.bindview.com/Services/Raz...001/tcpseq.cfm
 
Old 12-16-2006, 09:32 AM   #4
introuble
Member
 
Registered: Apr 2004
Distribution: Debian -unstable
Posts: 700

Original Poster
Rep: Reputation: 31
Quote:
It's down to the TCP implementation in the kernel.
Then should all up-to-date Debian SID boxes display the same thing as my box?
 
Old 12-16-2006, 02:54 PM   #5
matthewg42
Senior Member
 
Registered: Oct 2003
Location: UK
Distribution: Kubuntu 12.10 (using awesome wm though)
Posts: 3,530

Rep: Reputation: 63
Maybe debian has a choice of kernels, possibly where there are different settings which might affect this. I don't know enough about debian to know. I just use default kernels If you find out, please post here - I'd like to know.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Linux change TCP kernel Parameter for TCP DELAY ACK TICKS linux_mando Linux - Networking 5 08-22-2006 08:20 AM
A little prediction titanium_geek LQ Suggestions & Feedback 5 09-15-2005 04:05 PM
nmap - TCP Sequence Prediction ddaas Linux - Security 2 02-09-2005 02:16 AM
Woody 3.0 Open Ports 1470/tcp/uaiact 1518/tcp/vpvd What for?How can I remove them? alexxxis Debian 5 07-05-2004 05:18 PM
close port 6000/tcp 515/tcp SchwipSchwap Linux - Newbie 1 09-12-2002 08:24 AM


All times are GMT -5. The time now is 07:30 AM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration