Debian SID users: help me by running an nmap on localhost

introuble · 12-16-2006, 03:28 PM

Hello. This thread is for users of up-to-date Debian SID systems. Run an nmap on localhost and tell me the values of "TCP Sequence Prediction: Difficulty" and "IPID Sequence Generation". Run:

Code:

nmap -A -O -vv 127.0.0.1

The reason of this request is that, after issuing the above command on my box, I found out the "Difficulty" value surprisingly low [~ 200]; "IPID Seq Gen:" to be "All zeros". I'm trying to find out if this is normal behavior with up-to-date SID boxes or just a personal problem. Also, should anyone know how to "fix" this, please tell me

I'm not afraid of custom [configured] kernels, nor modifying the kernel source.

Should this turn out to be a Deb Unstable specific thing, if anyone knows details [i.e. urls to debian mailing list archives about this stuff or whatever]; please let me know.

macemoneta · 12-16-2006, 03:50 PM

Well, as a point of reference, on Fedora Core 6 I get:

TCP Sequence Prediction: Class=random positive increments
Difficulty=3603973 (Good luck!)
IPID Sequence Generation: All zeros

JackieBrown · 12-16-2006, 04:03 PM

TCP Sequence Prediction: Difficulty=201 (Good luck!)
IPID Sequence Generation: All zeros

nx5000 · 12-18-2006, 05:19 AM

TCP Sequence Prediction: Class=random positive increments
Difficulty=3559929 (Good luck!)
IPID Sequence Generation: All zeros

On kernel 2.6.18-3-686 (sid). Sid or etch or sarge doesn't make a difference AFAIK, the tcp/ip stack is still in the kernel.

craigevil · 12-18-2006, 05:00 PM

Starting Nmap 4.20 ( http://insecure.org ) at 2006-12-18 17:52 EST
Initiating SYN Stealth Scan at 17:52
Scanning orders.webpower.com (127.0.0.1) [1697 ports]
Completed SYN Stealth Scan at 17:52, 0.09s elapsed (1697 total ports)
Initiating Service scan at 17:52
Warning: OS detection for 127.0.0.1 will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Initiating OS detection (try #1) against orders.webpower.com (127.0.0.1)
Retrying OS detection (try #2) against orders.webpower.com (127.0.0.1)
Initiating gen1 OS Detection against 127.0.0.1 at 1.800s
Warning: OS detection will be MUCH less reliable because we did not find at least 1 open and 1 closed TCP port
Host orders.webpower.com (127.0.0.1) appears to be up ... good.
All 1697 scanned ports on orders.webpower.com (127.0.0.1) are closed
Too many fingerprints match this host to give specific OS details
TCP/IP fingerprint by osscan system #2:
SCAN(V=4.20%D=12/18%OT=%CT=1%CU=39647%PV=N%DS=0%G=N%TM=45871BAE%P=i686-pc-linux-gnu)
T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)
T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)
U1(R=Y%DF=N%T=40%TOS=C0%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUL=G%RUD=G)
IE(R=Y%DFI=N%T=40%TOSI=S%CD=S%SI=S%DLI=S)
Network Distance: 0 hops

OS and Service detection performed. Please report any incorrect results at http://insecure.org/nmap/submit/ .
Nmap finished: 1 IP address (1 host up) scanned in 5.994 seconds
Raw packets sent: 1721 (77.860KB) | Rcvd: 3437 (147.132KB)

Hm where is everyone getting the info they are posting? The above is what I get.

JackieBrown · 12-18-2006, 07:12 PM

It should be the final output.

introuble · 12-19-2006, 03:43 AM

Quote:

TCP Sequence Prediction: Class=random positive increments
Difficulty=3559929 (Good luck!)

Ouch. So it appears that on some boxes it's high, on some boxes it's low. I wander why. nx5000.. did anything special to your box?

Quote:

uname -a: Linux - 2.6.18-3-686 #1 SMP Sun Dec 10 19:37:06 UTC 2006 i686 GNU/Linux

nx5000 · 12-19-2006, 04:14 AM

Did I change anything? Hummmm good question :-)

First we have the same stock kernel

Running it again I realized that I don't have the latest nmap.

Quote:

root@nyb# nmap -A -O -vv 127.0.0.1

Starting Nmap 4.00 ( http://www.insecure.org/nmap/ ) at 2006-12-19 11:57 CET
DNS resolution of 0 IPs took 0.00s. Mode: Async [#: 2, OK: 0, NX: 0, DR: 0, SF: 0, TR: 0, CN: 0]
Initiating SYN Stealth Scan against gforge (127.0.0.1) [1672 ports] at 11:57
Discovered open port 113/tcp on 127.0.0.1
Discovered open port 21/tcp on 127.0.0.1
Discovered open port 22/tcp on 127.0.0.1
Discovered open port 111/tcp on 127.0.0.1
Discovered open port 8443/tcp on 127.0.0.1
Discovered open port 8081/tcp on 127.0.0.1
Discovered open port 8080/tcp on 127.0.0.1
The SYN Stealth Scan took 0.17s to scan 1672 total ports.
Initiating service scan against 7 services on gforge (127.0.0.1) at 11:57
The service scan took 66.14s to scan 7 services on 1 host.
Initiating RPCGrind Scan against gforge (127.0.0.1) at 11:58
The RPCGrind Scan took 0.09s to scan 1 ports on gforge (127.0.0.1).
For OSScan assuming port 21 is open, 1 is closed, and neither are firewalled
For OSScan assuming port 21 is open, 1 is closed, and neither are firewalled
For OSScan assuming port 21 is open, 1 is closed, and neither are firewalled
Host gforge (127.0.0.1) appears to be up ... good.
Interesting ports on gforge (127.0.0.1):
(The 1665 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
21/tcp open ftp?
22/tcp open ssh OpenSSH 4.3p2 Debian-7 (protocol 2.0)
111/tcp open rpcbind 2 (rpc #100000)
113/tcp open ident Ident2
8080/tcp open http-proxy WWWOFFLE caching webproxy 2.9a
8081/tcp open blackice-icecap?
8443/tcp open ssl/unknown
2 services unrecognized despite returning data. If you know the service/version, please submit the following fingerprints at http://www.insecure.org/cgi-bin/servicefp-submit.cgi :
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port21-TCP:V=4.00%I=7%D=12/19%Time=4587C590%P=x86_64-unknown-linux-gnu%
SF:r(NULL,208,"\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
SF:0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0
SF:\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
==============NEXT SERVICE FINGERPRINT (SUBMIT INDIVIDUALLY)==============
SF-Port8081-TCP:V=4.00%I=7%D=12/19%Time=4587C595%P=x86_64-unknown-linux-gnu%r(WWWOFFLEctrlstat,1C,"WWWOFFLE\x20Incorrect\x20Password\n");
No exact OS matches for host (If you know what OS is running on it, see http://www.insecure.org/cgi-bin/nmap-submit.cgi).
TCP/IP fingerprint:
SInfo(V=4.00%P=x86_64-unknown-linux-gnu%D=12/19%Tm=4587C5DB%O=21%C=1)
TSeq(Class=RI%gcd=1%SI=2609CE%IPID=Z)
TSeq(Class=RI%gcd=1%SI=260942%IPID=Z)
TSeq(Class=RI%gcd=1%SI=26099C%IPID=Z)
T1(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNTNW)
T2(Resp=N)
T3(Resp=Y%DF=Y%W=8000%ACK=S++%Flags=AS%Ops=MNNTNW)
T4(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T5(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
T6(Resp=Y%DF=Y%W=0%ACK=O%Flags=R%Ops=)
T7(Resp=Y%DF=Y%W=0%ACK=S++%Flags=AR%Ops=)
PU(Resp=Y%DF=N%TOS=C0%IPLEN=164%RIPTL=148%RID=E%RIPCK=E K=E%ULEN=134%DAT=E)

TCP Sequence Prediction: Class=random positive increments
Difficulty=2492828 (Good luck!)
IPID Sequence Generation: All zeros

Nmap finished: 1 IP address (1 host up) scanned in 77.457 seconds
Raw packets sent: 1717 (70.4KB) | Rcvd: 3823 (233KB)

I have this in /etc/sysctl.conf:

Quote:

# Uncomment the next line to enable Spoof protection (reverse-path filter)
net.ipv4.conf.default.rp_filter=1

# Uncomment the next line to enable TCP/IP SYN cookies
net.ipv4.tcp_syncookies=1

This in /etc/systune.conf:

Quote:

# More aggresive buffering, usable for servers
/proc/sys/vm/bdflush:100 5000 640 2560 150 30000 5000 1884 2

# Network tuning

# Maximal number of remembered connection requests for heavy loaded server
# /proc/sys/net/ipv4/tcp_max_syn_backlog:8192

# Number of TCP retries, less for fast recovery
/proc/sys/net/ipv4/tcp_retries1:2

# Enable syncookies
/proc/sys/net/ipv4/tcp_syncookies:1

# Don't respond for broadcast ICMP
/proc/sys/net/ipv4/icmp_echo_ignore_broadcasts:1

# FreeBSD isn't RFC1122 compatible
/proc/sys/net/ipv4/icmp_ignore_bogus_error_responses:1

And my iptables rules (automatically generated, not really needed):

Quote:

root@nyb# iptables -L
Chain INPUT (policy DROP)
target prot opt source destination
LOG tcp -- anywhere 127.0.0.0/8 LOG level info prefix `INPUT DROP 2'
DROP tcp -- anywhere 127.0.0.0/8
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED
LOG 0 -f anywhere anywhere LOG level info prefix `INPUT DROP 3 '
DROP 0 -f anywhere anywhere
ACCEPT 0 -- anywhere anywhere
LOG 0 -- base-address.mcast.net/4 anywhere LOG level info prefix `INPUT DROP 4 '
DROP 0 -- base-address.mcast.net/4 anywhere
PUB_IN 0 -- anywhere anywhere
PUB_IN 0 -- anywhere anywhere
PUB_IN 0 -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn
DROP udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
DROP 0 -- anywhere base-address.mcast.net/8
LOG 0 -- anywhere anywhere LOG level info prefix `INPUT DROP 6 '
DROP 0 -- anywhere anywhere

Chain FORWARD (policy DROP)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere state RELATED,ESTABLISHED

Chain OUTPUT (policy ACCEPT)
target prot opt source destination
PUB_OUT 0 -- anywhere anywhere
PUB_OUT 0 -- anywhere anywhere
PUB_OUT 0 -- anywhere anywhere

Chain INT_IN (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
DROP tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn
DROP udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
DROP 0 -- anywhere base-address.mcast.net/8
LOG 0 -- anywhere anywhere LOG level info prefix `INT_IN DROP 8 '
DROP 0 -- anywhere anywhere

Chain INT_OUT (0 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere

Chain PAROLE (2 references)
target prot opt source destination
LOG tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE LOG level info prefix `PAROLE DROP 0'
DROP tcp -- anywhere anywhere tcp flags:FIN,SYN,RST,PSH,ACK,URG/NONE
ACCEPT tcp -- anywhere anywhere state NEW tcp flags:FIN,SYN,RST,ACK/SYN
LOG tcp -- anywhere anywhere LOG level info prefix `PAROLE DROP 1'
DROP tcp -- anywhere anywhere
ACCEPT 0 -- anywhere anywhere

Chain PUB_IN (3 references)
target prot opt source destination
ACCEPT icmp -- anywhere anywhere icmp destination-unreachable
ACCEPT icmp -- anywhere anywhere icmp echo-reply
ACCEPT icmp -- anywhere anywhere icmp time-exceeded
PAROLE tcp -- anywhere anywhere tcp dpt:ssh
PAROLE tcp -- anywhere anywhere tcp dpt:auth
DROP tcp -- anywhere anywhere tcp dpts:netbios-ns:netbios-ssn
DROP udp -- anywhere anywhere udp dpts:netbios-ns:netbios-ssn
DROP 0 -- anywhere base-address.mcast.net/8
LOG icmp -- anywhere anywhere LOG level info prefix `PUB_IN DROP 5'
DROP icmp -- anywhere anywhere
LOG 0 -- anywhere anywhere LOG level info prefix `PUB_IN DROP 7 '
DROP 0 -- anywhere anywhere

Chain PUB_OUT (3 references)
target prot opt source destination
ACCEPT 0 -- anywhere anywhere

Running it again after removing the firewall:

Quote:

TCP Sequence Prediction: Class=random positive increments
Difficulty=5239359 (Good luck!)
IPID Sequence Generation: All zeros
Service Info: OS: FreeBSD

Ahhhh I'm the best 5239359 !!!! ;-)
FreeBSD? :

Upgrading nmap to 4.20-1 (hum should have begun from here)

Uptime: 0.016 days (since Tue Dec 19 11:49:25 2006)
Network Distance: 0 hops
TCP Sequence Prediction: Difficulty=200 (Good luck!)
IPID Sequence Generation: All zeros
Service Info: OS: Linux

That's it

Anyway, it says good luck... Did you try to blind-spoof anything?

introuble · 12-19-2006, 04:52 AM

Not sure what to make of this. Either NMap is reporting badly.. or.. ehh.. no idea what. I noticed one time it said my UpTime was over 150 days and I had the computer up for less than half an hour :-/

I don't have a modif. /etc/systune.conf; nor do I run a firewall. My /etc/sysctl.conf however:

Code:

net/ipv4/icmp_echo_ignore_all = 1
net/ipv4/icmp_echo_ignore_broadcasts = 1
net/ipv4/icmp_ignore_bogus_error_responses = 1
net/ipv4/conf/all/accept_redirects = 0
net/ipv4/conf/all/send_redirects = 0
net/ipv4/conf/all/forwarding = 0
net/ipv4/conf/all/log_martians = 1
net/ipv4/conf/all/rp_filter = 1
net/ipv4/conf/all/accept_source_route = 0
net/ipv4/tcp_syncookies = 1

I've commented everything and rebooted, rescanned. Same thing. So this doesn't make a diff.

nx5000 · 12-19-2006, 05:51 AM

I looked at the code.
If you get difficulty over or equal 16, its the highest (good luck).

/* Convert a TCP sequence prediction difficulty index like 1264386
into a difficulty string like "Worthy Challenge */
const char *seqidx2difficultystr(unsigned long idx) {
return (idx < 3)? "Trivial joke" : (idx < 6)? "Easy" : (idx < 11)? "Medium" : (idx < 12)? "Formidable" : (idx < 16)? "Worthy challenge" : "Good luck!";
}

And looking deeper in the code, you see that nmap 4 was using seqidx2difficultystr1 while nmap 4.2 uses the above mentionned one.

/* Convert a TCP sequence prediction difficulty index like 1264386
into a difficulty string like "Worthy Challenge */
const char *seqidx2difficultystr1(unsigned long idx) {
return (idx < 10)? "Trivial joke" : (idx < 80)? "Easy" : (idx < 3000)? "Medium" : (idx < 5000)? "Formidable" : (idx < 100000)? "Worthy challenge" : "Good luck!";
}

See the difference in idx scale!

Fedora core 6 uses nmap 4.11 by default (unless repacked)

I don't see any problem but it could be interesting to see an openbsd's result on nmap 4.20

introuble · 12-19-2006, 07:06 AM

That explains why both versions of NMap say "Good Luck". But what it doesn't explain is why they report diff. TCP sequence prediction difficulty indexes.

introuble · 12-19-2006, 07:17 AM

..

Code:

root:~# nmap -V

Nmap version 4.11 ( http://www.insecure.org/nmap/ )
root:~# nmap -A -O -vv 127.0.0.1
<...>
TCP Sequence Prediction: Class=random positive increments
                         Difficulty=4907895 (Good luck!)

And..

Code:

root:~# nmap -V

Nmap version 4.20 ( http://insecure.org )
root:~# nmap -A -O -vv 127.0.0.1
<...>
TCP Sequence Prediction: Difficulty=188 (Good luck!)

Fascinating.

UPDATE:
Was looking through the NMAP ChangeLog and found this:

Quote:

Fixed a TCP sequence prediction difficulty indicator bug. The index
is supposed to go from 0 ("trivial joke") to about 260 (OpenBSD).
But some systems..

nx5000 · 12-19-2006, 07:23 AM

-O1: Only use the old (1st generation) OS detection system

Hum if I run -O1 I get trivial joke

nmap is the joke