LinuxQuestions.org - TCP Sequence Prediction

- Linux - General (https://www.linuxquestions.org/questions/linux-general-1/)

- - TCP Sequence Prediction (https://www.linuxquestions.org/questions/linux-general-1/tcp-sequence-prediction-511013/)

TCP Sequence Prediction

Following an nmap scan against localhost, I get this:

Quote:

TCP Sequence Prediction: Difficulty=201 (Good luck!)
IPID Sequence Generation: All zeros

This is on .. a day old Debian System. Now.. something tells me this is not a good thing security wise. I remember on the old Debian box (before the recent reinstall) a relatively high Difficulty, and the "IPID Sequence Generation" to be "Random positive increments" (or something). I also remember on a FreeBSD box that the TCP SP Difficulty was "999..."; "IPID Seq Gen:" was "Truly Random".

All in all.. how do I increase the difficulty of the tcp sequence prediction [who/what gives this difficulty?] and the "IPID Seq Generation" ?

It's down to the TCP implementation in the kernel. Not sure how to change it - maybe there is a kernel build option.

This is an interesting article on the subject: http://www.bindview.com/Services/Raz...001/tcpseq.cfm

Quote:

It's down to the TCP implementation in the kernel.

Then should all up-to-date Debian SID boxes display the same thing as my box?

Maybe debian has a choice of kernels, possibly where there are different settings which might affect this. I don't know enough about debian to know. I just use default kernels :) If you find out, please post here - I'd like to know.